Use this checklist before you hand a WordPress site to a client, or before you take over a site from another developer. It covers what clients ask about most in the first 90 days after launch: who owns what, what breaks, and who can edit what.
1. Access and ownership
- ☐ Domain registrar login is in the client’s name, with 2FA on, and the renewal date is noted
- ☐ Hosting account is owned by the client (or the agency, in writing) and billing contacts are current
- ☐ DNS records are documented: A/CNAME, MX, SPF, DKIM, DMARC
- ☐ Every WordPress admin account is named and personal (no shared “admin” login); former contractors are removed
- ☐ Theme, plugin, and premium license keys are registered to the client or agency account, not a freelancer’s personal account
- ☐ Git repository access is transferred, or a final zip of the code is delivered
2. Code and theme
- ☐ Custom theme lives in version control with a README covering how to build and deploy
- ☐ Child theme or custom theme in use, so no parent theme was edited directly
- ☐ Build assets (Vite/webpack) are compiled and committed or deployed; the build steps are written down
- ☐ No hard-coded URLs, credentials, or API keys in theme files
- ☐ PHP version on the host matches what the theme and plugins need
- ☐ WP_DEBUG is off in production and debug.log is not publicly reachable
3. Plugins
- ☐ Each active plugin has a written reason to exist; unused plugins are removed (not just deactivated)
- ☐ Premium plugins have active licenses and the renewal owner is agreed
- ☐ Auto-update policy is agreed (core minor updates on; plugin updates on, or reviewed monthly)
- ☐ No abandoned plugins (last updated more than 12 months ago) without a plan
4. Editor experience
- ☐ The client can edit pages, menus, and site settings without touching code
- ☐ Block patterns or custom blocks cover the layouts they will reuse
- ☐ Locked or limited blocks are set where layout must not break
- ☐ User roles are right: editors are Editors, not Administrators
- ☐ A short “how to edit your site” guide (doc or video) is delivered
5. SEO basics
- ☐ Search engine visibility is ON (Settings → Reading) after launch
- ☐ robots.txt returns 200 and lists the sitemap
- ☐ XML sitemap works and leaves out thank-you, utility, and duplicate pages
- ☐ Every page has a unique title and meta description
- ☐ 301 redirects are in place for every changed URL from the old site
- ☐ Google Search Console and analytics are verified under the client’s account
6. Performance
- ☐ Page caching is on and purges on content changes
- ☐ Images are resized and served in modern formats; the hero image is preloaded
- ☐ Lighthouse mobile check run on the homepage and a key landing page; results recorded as a baseline
- ☐ No render-blocking third-party scripts the client doesn’t need
7. Accessibility
- ☐ Keyboard-only pass: every link, menu, and form is reachable, with a visible focus state
- ☐ Headings follow order (one H1, no skipped levels)
- ☐ Form fields have real labels; errors are announced
- ☐ Color contrast meets WCAG AA
- ☐ Images have meaningful alt text (or empty alt if decorative)
- ☐ No accessibility overlay plugin relied on as the fix
8. Security and backups
- ☐ Automated daily backups stored off the server, with a restore tested at least once
- ☐ 2FA for all administrator accounts
- ☐ File editing in wp-admin disabled (DISALLOW_FILE_EDIT)
- ☐ Login protection or rate limiting in place
- ☐ SSL certificate auto-renews; the site forces HTTPS
9. Forms and email
- ☐ Every form was tested end-to-end and arrives at the right inbox
- ☐ Transactional email is sent through an authenticated SMTP or API service (not unauthenticated PHP mail)
- ☐ Spam protection is on (Akismet, honeypot, or similar)
- ☐ Form entries are stored or exported somewhere the client can reach
10. Handoff package
- ☐ One document lists all logins and where they live (in a password manager, not email)
- ☐ Support terms are written down: what is covered, response time, and how to request changes
- ☐ Maintenance plan (who updates what, and how often) is agreed or explicitly declined
- ☐ Launch date, final invoice, and warranty window are confirmed in writing
Need a second set of eyes?
I do behind-the-scenes WordPress work for agencies and marketers: custom themes, blocks, and pre-launch checks. Send a short note, and I reply within one business day (ET).