What we found inheriting a WordPress abandoned by another agency
About two months ago a client called us who had spent three years working with another agency (I won’t say which, though I’m tempted). The agency had closed down without warning — the owner simply stopped answering emails — and the client was left with an online store that had been failing at checkout for weeks. They asked us to bring it back to life.
First problem: nobody had the hosting credentials. Not the client, not us, and apparently nobody alive either. It took us four days just to recover access to the panel, between tickets to the provider and an exchange of screenshots of old invoices proving the domain was theirs.
When we finally got into the server, things got worse. WordPress 5.4 (the current version at the time was around 6.4), seventeen installed plugins, four of which no longer even existed in the official repository, and a payment plugin storing the gateway keys in plain text inside a config-old.php file nobody had deleted. We also found a wp-config.php.bak accessible via direct URL, with no protection whatsoever. That file had been sitting there, by our estimate, for two years.
What bothers me most about these cases isn’t the technical mess itself — that gets fixed, it costs money and time, but it gets fixed. What bothers me is that the client paid for monthly maintenance for three years and nobody touched any of that. Not a single security update. The invoice said “maintenance and support,” and the only thing they did, as far as we could tell from the access logs, was answer the occasional ticket when something broke visibly.
We migrated the store to new hosting, rebuilt the theme from scratch relying on the one plugin that was actually worth keeping, and told the client something that isn’t always said out loud in this industry: a maintenance contract where the client can’t see what’s actually been done isn’t worth anything. Now they have a shared document where we log every update, every backup and every incident, with a date and who did it. It cost them an extra seven hundred euros that month for the urgency. They prefer that to another surprise.
And then there’s the uncomfortable part of billing for undoing someone else’s work. We billed twenty-two hours just for the “figure out what on earth is going on here” phase before touching a single line, and this client understood that, but it doesn’t always go that way. More than once we’ve had to explain that no, we’re not going to “just fix it” in two hours when underneath there’s a database with orphaned tables from a plugin five versions old and nobody knows what they were for.
I don’t have a clean formula to avoid this entirely. What we do now, when someone asks us to take over maintenance of a project we didn’t build, is ask for read-only access to the hosting before quoting a price, to get a real sense of the state of the house before committing to anything. Half the time the client doesn’t even know how to give us that, and that alone tells you plenty about who was actually running things until then.
How many small business websites in Spain right now have a public wp-config.php.bak waiting for someone to find it, and not exactly to fix it?