Backup plan
What a full WordPress backup contains, how often to run it, where to keep it, how to test it.
Free printable checklist
Site takeover access inventory
Every login, account and file to collect when you inherit a website, in the order that keeps it safe: domain first, backup before changes, then access, code and renewals.
KIT-05
PDF, 1 page, 6 KB
Download the PDF
One page. Prints on any black and white printer. No signup.
Domain and DNS first
- Registrar account owned by the business, 2FA on.
- RDAP saved: registrar, expiry, status, NS.
- Auto-renew on, card valid, registrar lock on.
- Registrant email is not only on this domain.
- DNS host and any CDN or proxy identified.
- Full DNS zone exported and stored.
Hosting, email, backups
- Hosting account in the owner’s name.
- Panel, SFTP and SSH logins in a password manager.
- Off-server backup of files and DB, before changes.
- Backup restored to staging once, and it works.
- Mail provider (MX) known, owner holds admin.
- Site mail route known. SPF and DKIM pass.
Who can get in
- Admin users reviewed. Unknowns queried first.
- Application passwords checked on each admin.
- Panel users, SFTP, SSH keys, DB users checked.
- New passwords and 2FA on every kept account.
- Old developer and support logins removed.
Code and licenses
- wp core verify-checksums run, issues checked.
- No PHP files in uploads. MU plugins explained.
- Premium plugins listed: license owner, expiry.
- Licenses moved to the owner. Bundles noted.
- Nulled or abandoned plugins replaced.
Services and renewals
- Analytics and Search Console owned by business.
- Payment and shipping in the owner’s live account.
- Uptime, SSL and domain alerts reach a person.
- Renewals register filled in, dates and owners.
- Handoff document saved for the owner.
Keep packing
The rest of the bag
Hack recovery
After a WordPress hack: contain it, keep evidence, find the way in, clean, harden, recover.
Pre-launch
Check DNS, SSL, WordPress settings, security, speed, SEO, forms and backups before a new or redesigned site goes live.
Switching hosts
Move a WordPress site to a new host without losing email, SSL, data or rankings: inventory, rehearse, cut over, then wait.
Store fraud response
When a WooCommerce store is hit by card testing: confirm it, slow it down in the first hour, clean up the orders, report it and harden the checkout.
Monthly maintenance
A one-page monthly routine for a WordPress site: backups tested, updates in a safe order, renewals, uptime, Search Console, forms and security checks.
Renewals register
A fill-in register for everything a website renews, with the provider, account owner, who pays, renewal date, cost and cycle, auto-renew and sites for each, one row per item.