What do you check first when taking over an existing WordPress site?

I check whether the core files, parent theme, or plugins have been edited directly. A quick comparison against clean originals or the repository can reveal custom patches, hacked files, or undocumented changes. Otherwise, the first normal update may wipe out behavior that someone was relying on.

Before investigating anything on production, I create a full backup and clone the site locally or into a safe staging environment. Then I can test updates, remove plugins, and inspect the configuration without risking the live site. Database size is worth checking on very large sites, but it usually matters less than having a reliable restore point.

I start by checking for vulnerable or badly outdated plugins and other obvious security problems. Some sites have dozens of neglected plugins, and that usually tells you immediately how risky the rest of the maintenance will be. I also want WordPress, the plugins, and the theme brought up to date—but only after making a complete backup and confirming it can actually be restored.

I identify the pages that currently bring in traffic before touching the site. I pull roughly a year of search-performance data and note which URLs get the most clicks, especially older posts that may not be mentioned in the handover. Those pages should be treated as protected assets, since a theme change, plugin removal, or permalink update can quietly damage their rankings.