How to Take Over a Craft CMS Website From Another Team

Step one: secure the five things

Before you audit anything, before you fix anything, establish what you control. There are five items, and you want all five in your organization’s name — not your agency’s, not a former employee’s.

1. The Craft license. Craft licenses belong to whoever holds them and can be transferred through Craft’s own console. If your agency holds it, request the transfer.

2. The hosting account. Whose credit card is on file? If the answer is your agency’s, you don’t control where your site lives. Getting billing into your name is the single biggest step toward keeping control of your site.

3. The code repository. Your templates and custom code should live in a git repository your organization owns, with your agency added as a collaborator — not the other way around.

4. The domain and DNS. Your domain should be registered to your company at a registrar you can log into. This is the one that turns a bad breakup into a genuine emergency.

5. A copy of the database. Not just a backup that exists somewhere. A file you have downloaded and can hand to someone.

If all five are already yours, a transition is straightforward. If some aren’t, get them before you announce anything.

Who should own what

A quick way to check where you stand. The left column is what you want when the dust settles.

An access request you can send

If your agency holds any of the five, ask for everything in writing, in one message. Keep it short and neutral; it’s an administrative request, not an accusation.

Hi [name],

We’re putting the accounts behind our website into our company’s name, so we hold them directly going forward. Could you help us with the following by [date]?

1. Transfer the Craft CMS license for [site] to our Craft Console account ([email]).
2. Add [email] as an owner on the hosting account, and move billing to our card.
3. Transfer the code repository to our organization ([org name]), or add us as an admin.
4. Confirm the domain registrar and registrant, and send the transfer authorization code if the domain is in your account.
5. Send a current database export and a copy of the uploaded files (images, PDFs).
6. Send any environment details we’d need to deploy: the .env keys in use (not the values in email; we’ll set up a secure way to share them), build steps, and cron jobs or queue workers.

Thanks for your help with this.

Two notes. Ask for the license and domain first, because they take longest and matter most. And don’t ask for passwords in email; ask to be added as a user, or agree on a password manager share.

Step two: find out what you have

Now audit it. This is the part that needs a Craft-competent developer, but here’s what should be on the list so you can tell whether the audit was thorough.

Version status. Which version of Craft, and which version of PHP? If it’s Craft 4 or earlier, you’re on unpatched software — see Craft versions and end-of-life dates for what that means.

Backups, tested. Not “are backups configured” but “restore one and prove it works.” An untested backup is a rumor.

Plugin inventory. Every plugin, its version, whether its author still maintains it, and what happens if it stops working. Plugins no longer maintained by their authors, still handling forms or payments, are the most common serious finding.

Security posture. Admin accounts still active for people who left. Exposed admin URLs. Missing firewall. Credentials committed into the repository.

Integrations. Every connection to a CRM, email platform, ERP, or payment processor — and whether each one is still working. Silently broken integrations dropping leads for months is depressingly common.

Deployment process. Is there one? Or has somebody been editing files directly on the live server? The second answer means there’s no reliable record of what the site is supposed to look like.

Performance and caching. Usually the least urgent finding and the easiest win once everything else is stable.

Step three: stabilize before you improve

The instinct after an audit is to fix everything at once. Resist it. Sequence matters, because some of these are actively dangerous and others are merely untidy.

Do first, in order:

1. Get a verified backup you can restore
2. Patch or upgrade if the version is end of life
3. Remove admin access for people who’ve left
4. Fix any integration that’s silently failing
5. Put monitoring in place so you find out about outages first

Everything else — performance, cleanup, refactoring, the redesign somebody has been pushing for — waits. You cannot improve a site you can’t restore.

Step four: set up the care that prevents a repeat

Once the site is stable, the question becomes how it stays that way. Whatever arrangement you had before produced the situation you just cleaned up, so it’s worth being deliberate.

The three things that prevent a repeat:

• Updates on a schedule someone else owns. Not “when we get around to it,” and not dependent on you asking.
• A stated response time. Vague availability is how you end up back where you started.
• Small changes without an estimate. If every request has a cost attached, requests stop happening, and drift resumes.

That’s what maintenance and support plans exist to cover. Not glamorous, but it’s the difference between a site that’s an asset in three years and one nobody wants to open.

Two real takeovers

CenTrak brought us their Craft site in late 2022. Every demo request and sample kit order on the site starts on a Craft form and lands in HubSpot, so it had to keep working through the handoff. Step two turned up the kind of findings this guide lists: a damaged database that had to be recovered and migrated, and a plugin interfering with Craft’s queue. The site now runs nightly full backups, and Watchtower alerts us when queue jobs pile up. It has caught backlogs of hundreds of pending jobs.

World Electronics came to us in June 2026 looking for a new team. Their nightly catalog import and hourly stock files had slowed to a crawl, and so had the site. The first review covered the usual handoff checks (Craft updates, SEO settings, structured data), and then went after the cause of the slowdown. The nightly import now finishes in under 3 minutes.

Neither one started with a redesign. Both started with custody and an audit.

What this looks like when we do it

We take over Craft sites we didn’t build regularly — it’s how most of our maintenance clients arrived. Audit first, over three to five business days, producing a written findings document that’s yours to keep whether or not you continue with us. Then urgent stabilization in the first week or two, custody transfer in weeks two to three, and steady maintenance from there.

We also won’t contact your current provider without your say-so, which matters more than it sounds when you’re still figuring out your options.

Looking for a new Craft CMS developer? Tell us about the site and we’ll tell you what we’d look at first.