Agency website recovery needs a clear chain of authorization and acceptance: the client approves the recovery scope, the agency coordinates evidence and decisions, and the restoration provider documents the delivered work. Define those roles before sharing access or asking someone to recreate the site.
This is an operational planning guide for an active agency-client project. It does not establish legal rights, promise white-label delivery or claim a particular project’s confidential handling arrangements.
Confirm what the agency may request
Record the client contact who can approve the work, the authorized website and the intended outcome. Permission to discuss a project is not automatically permission to publish content, change hosting or conduct payment tests.
Specify whether the task is source assessment, public-content reconstruction, an approved redesign or another bounded deliverable. Document any separately required authorization for account access, changes to URLs or consequential functions.
Ask the client to confirm which supplied material may be used and who will resolve uncertain assets. An archive’s public visibility is not a substitute for that decision. If rights or ownership are disputed, seek appropriate advice rather than treating this checklist as a legal determination.
Keep the evidence brief useful without adding secrets
A working brief can include public URLs, source dates, required page types, approved current facts and known gaps. It normally does not need passwords, recovery codes, private customer information or payment credentials.
OWASP’s secrets-management guidance recommends controlled access and least privilege rather than broad exposure of secrets. Agree an appropriate private access-sharing method and restrict access to the tasks being performed. Do not put credentials into a widely shared workbook, completion report or public screenshot.
Record who manages access and how it will be reviewed at handover, without recording the secret itself. Avoid sending a full private backup merely because a public-page assessment was requested; agree the required source scope first.
Assign decisions before they become blockers
The following responsibility register is a suggested blank planning model. Replace the roles with the actual named decision-makers; it is not a contract or a completed customer case.
- Current facts, offers and permitted assets
- The client approves or names the approver. The agency collects and reconciles the evidence. The restoration provider flags unsupported historical material.
- Recovery scope and exceptions
- The client approves the outcome. The agency coordinates the specification. The provider assesses feasibility and records gaps.
- Consequential functional tests
- The client authorizes affected systems. The agency coordinates the test arrangement. The provider executes only assigned, authorized tests.
- Final delivered scope
- The client accepts or requests correction. The agency reviews against client decisions. The provider supplies evidence and unresolved items.
Do not assume the provider controls the client’s domain, mail account or external integration. A missing dependency needs a named responsible person, not repeated requests to “finish the website.”
Resolve historical facts with the client
An archive may show expired offers, old addresses, former staff or a service that is no longer sold. Preserve the source evidence, then ask the appropriate client approver what should appear on the rebuilt site.
Separate fidelity decisions from current accuracy decisions. The owner may want a close visual recreation but still need updated facts. Record that approval so the provider does not silently copy outdated information or invent replacements.
When a required page is only partially available, present the supported content and the gap. New writing can be commissioned separately. It should not be described as the recovered original or used to hide incomplete source coverage.
Match access to the assigned work
For WordPress projects, the official roles and capabilities documentation explains how permissions control different tasks. A content reviewer and a person installing software do not necessarily need the same access. Check the actual installation rather than assuming a role name guarantees the required permission.
Agree who creates and reviews access, the intended task and when temporary access should be removed or changed. Do not revoke a shared account or rotate a credential without understanding dependent services and obtaining the necessary authorization.
Infrastructure work, mail changes and domain changes should remain separate from a WordPress content assignment unless specifically included. Broad access availability is not a reason to expand the task.
Deliver evidence the client can review
Supply the agreed destination list, content-source record, approved changes and relevant QA results. Identify what was checked, when, by whom and what remains unverified. A provider’s completion statement should be reviewable without requiring the client to reconstruct every decision from chat messages.
Ask the intended client editor to perform representative maintenance tasks using the actual delivered method. HTML-based editing, visual layout editing and ordinary post publishing are not interchangeable promises.
For forms or integrations, agree who observes the recorded submission or intended downstream result. A button or success message alone is not a complete operational verification. Tests affecting real customers, orders or payments must have explicit permission.
Close the project with named ongoing responsibilities
Record accepted scope, exceptions, retained sources, maintenance instructions and contacts for unresolved dependencies. Confirm who controls the domain, platform account and required service access. Ownership and day-to-day access are separate facts.
If the agency needs a branded or white-label handover, agree that arrangement explicitly. It is not automatically included in every recovery service, and this guide does not advertise an unverified white-label package.
The current service options describe delivery choices; the restoration guide explains archive limits. Use those alongside a project-specific brief, not as substitutes for client approval and a verified handover.
Agency recovery questions
Can an agency coordinate recovery for a client?
Yes, with documented client authorization for the requested scope and a clear approver for decisions. Additional system actions may need separate permission.
Should passwords appear in the evidence workbook?
No. Record access responsibility without exposing credentials; arrange appropriately controlled private sharing where access is necessary.
Who decides whether old facts remain correct?
The client or named subject-matter approver should decide. The provider should identify unsupported or outdated material, not invent current facts.
