Most businesses with a Craft CMS site didn’t choose Craft themselves. A web agency built it, recommended the platform, and handled everything from launch onward. That arrangement works well until it doesn’t, and there are several ways it can stop working.
The agency might fold. It might pivot away from Craft to a different stack. The relationship might break down. The key contact might leave, taking their knowledge of your site with them. Whatever the reason, the result is the same: you’re left with a business-critical website and no one who properly understands it.
What gets left behind
In the best case, you’ll have access to your hosting control panel, your domain registrar, your Craft control panel, and a well-organised codebase with a Composer setup you can work with. In practice, the reality is often messier. Access credentials may be missing or held by the agency. Hosting and domains may be registered in the agency’s name. Custom plugins may exist with no documentation explaining how they work or why certain decisions were made.
Craft’s licensing model adds another layer: if the license key is registered to the agency’s account, you’ll need to transfer it. The same applies to any paid plugins purchased through the Plugin Store.
The knowledge gap
The hardest part of taking over a Craft site isn’t usually the technical work. It’s reconstructing the knowledge that existed only in someone else’s head. Things like: why a particular plugin was chosen, how a specific Matrix field layout works and what content editors rely on it for, what that queued job is doing and whether it’s still needed, why the entry types are structured the way they are.
None of this is in the code. It was in the agency’s institutional knowledge, and now that knowledge is gone.
What to do immediately
The first priority is access. Get control of your hosting account, domain registration, Craft license, and CMS login. If the agency registered any of these on your behalf, recovering them ranges from straightforward to complicated depending on how cooperative they are.
Once access is secure, the next step is a proper technical audit: what version of Craft is running, what plugins are installed and whether they’re current, what the server environment looks like, and whether there’s a reliable backup in place.
What comes next
With access secured and the audit done, you’re in a position to make informed decisions. Some sites come across in good shape and just need a developer to maintain continuity. Others have accumulated technical debt, outdated plugins, or configuration problems that need addressing before ongoing support makes sense. Knowing which situation you’re in is the starting point for everything else.