The agency that built your Craft CMS site knows the codebase inside out. That knowledge is an asset when the relationship is working well, and it becomes a vulnerability the moment it ends. Craft CMS is a powerful platform, but it can be heavily customised, and the more bespoke the build, the more dependent you are on someone who understands what was built and why.
If your agency has gone quiet, merged with another company, stopped working with Craft, or simply shut down, this guide covers what to do first and what your options look like.
What to secure immediately
Before anything else, make sure you have the following:
- Craft CMS control panel access. You should have an admin account on your own site. If you do not, or the credentials you have no longer work, this needs resolving immediately. It is possible to reset Craft admin access at the server level if you have hosting access.
- Git repository access. If the codebase is in version control (which it should be), make sure you have access to that repository. If the agency hosted it in their own GitHub or GitLab organisation, you need a copy of it before that access disappears.
- Database credentials and a recent backup. Your Craft database contains all your content and configuration. A current backup should be treated as essential.
- Hosting access. SSH or SFTP credentials for the server, or access to whatever hosting control panel is in use.
- Domain control. Confirm that the domain registration is in your name, with your email address on the registrar account. Agencies that hold domain registrations for clients can hold you to ransom, intentionally or otherwise, when the relationship ends.
- Composer dependencies documentation. Craft is built on Composer, and the plugins and their versions are defined in composer.json and composer.lock. Having these files from the codebase means any new developer can reconstruct the dependency tree.
What to tell a new developer
When you approach a new Craft CMS specialist, the following information will help them assess the situation and give you an accurate picture of what taking over the site involves:
- Which version of Craft CMS the site is running (visible in the Craft CP under Settings)
- Which plugins are installed and whether any are custom-built by the agency
- Whether the site uses Craft Commerce, and if so, what version
- Whether there is any custom module code beyond standard plugins
- When the site was last updated and whether there are known outstanding issues
What good handover support looks like
A specialist taking over a Craft CMS site should spend time genuinely understanding the codebase before making changes. Craft installations can be complex, with dependencies between plugins, custom modules, and Twig templates that are not always obvious until you have read through the code carefully.
The first engagement should include a proper audit: what version of Craft is running, which plugins are active and whether they are current, what custom code exists and what it does, whether there are any security or stability issues that need addressing immediately, and what the site's dependencies look like for hosting and third-party services.
The question of upgrading at handover
If your Craft CMS site is on an old version, a handover is often a sensible moment to address the upgrade at the same time. Craft 2 and Craft 3 sites in particular carry real risk from outdated dependencies and security vulnerabilities. Moving to Craft 4 or Craft 5 while establishing a new support arrangement means you are starting the new relationship on a solid foundation rather than inheriting known technical debt.
If your Craft CMS agency has gone quiet and you need to find specialist support, get in touch and Karl will take a look at your specific situation and give you a clear view of what taking over the site would involve.