Whether you are the client hiring a new team or the agency receiving the handover, day one is for evidence, not heroics. Editing production without a map of what exists is how three-week fixes become three-month rewrites.
documentation audit before code changes
Gather the original brief, proposals, change orders, and invoices. List promised features vs what you can see in staging. Missing items are negotiation facts, not opinions. Ask for architecture diagrams, integration lists, and cron job schedules. If documentation does not exist, the first deliverable from the new team is to create it from the codebase.
Check if custom code lives in a child theme or scattered in database options (red flag).
credential and backup inventory
You need hosting, DNS, repository, CMS admin, payment gateways, email DNS, analytics, and tag manager access. Verify backups restore to a clean environment. Many takeovers discover backups were never tested until ransomware or a bad deploy forces the question.
| Asset | Why it matters | Missing risk |
|---|---|---|
| Git repository | Change history and rollback | FTP-only edits, no audit trail |
| Staging environment | Safe testing | Every fix risks live revenue |
| Dependency list | License and security review | Unknown GPL or abandoned packages |
| Integration credentials | ERP, CRM, shipping | Silent sync failures after handover |
code quality assessment
Run static review: WordPress plugin count and update status, Shopify app list, npm audit for Node projects. Search for hardcoded API keys, eval(), and direct SQL in WordPress themes. Check if custom code lives in a child theme or scattered in database options (red flag).
Inherited a stalled build?
Talk to us →what never to do on day one
Do not mass-delete plugins, “optimize” the database,” or launch a redesign to show progress. Do not change DNS or payment keys without a rollback plan. Stabilize revenue paths first: checkout, lead forms, and SSL.
realistic handover timeline
Week 1: access, backups, read-only audit. Week 2-3: fix production blockers and establish deployment workflow. Week 4+: re-scoped feature delivery with weekly demos. Communicate this to stakeholders so they expect stabilization before velocity.
what this looks like when we do it
Our takeover engagements start with a fixed audit deliverable in three to five days: risk register, gap analysis vs brief, and two options (finish vs rebuild) with hours and cost ranges. Stabilization sprints are usually 40 to 120 hours depending on stack and damage.
See project takeover services for how we structure access, NDA, and phased delivery. For vendor selection before you hire, pair this with how to evaluate a web development agency.
Handovers succeed when you treat the inherited system as unknown until proven. Audit, stabilize, re-scope, then build.
