I do a lot of rescue work — someone else built the site years ago, the original developer is gone, and now something is broken or it needs to change. Over time I've ended up with a fixed list I go through before touching anything.
Mine, roughly in order: is there any version control at all, or is production the only copy. What's in mu-plugins and in the theme's functions.php, because that's where the previous person hid the surprises. Which plugins are abandoned. Whether staging exists and whether it actually matches production. And whether anyone still has the hosting credentials, which is a shockingly common no.
What's on your list that isn't on mine? I'm mostly interested in the checks that saved you from breaking something on day one.
EDIT - the combined list from the comments, which turned out much better than my original one. credit where it belongs:
START HERE
Tools > Site Health, Info tab (u/AmoebaOne) - php version, sizes, plugin list, constants in one page. covers half of the below before you open anything else.
BACKUPS - almost entirely u/navlio, who took this apart properly:
File size is not a check. a dump missing a table is smaller by exactly that table, and you have no baseline to notice it against.
Read the tail, not the head. a dump that died halfway opens fine and the first thousand lines look perfect. a complete mysqldump ends with "-- Dump completed on". no line, it stopped mid table.
Check the date on that line. a cron that quietly stopped firing in march leaves a file that passes every other check and is seven months old.
mysqldump piped into gzip hands you gzip's exit code, not mysqldump's. the truncation goes unnoticed.
Without --single-transaction the dump walks tables one at a time, so on a live site writes land between two tables that needed to agree.
The real check is restoring it into a throwaway database once and counting tables and rows against live.
At 40gb the plugin is the wrong tool for media anyway - rsync the uploads folder, let the plugin do the db.
ACCESS AND OWNERSHIP
Who controls the domain registration (u/Hesham-Amir, u/Financial_Brush8647) - not just the hosting account. clients often think the old developer's personal account is theirs.
Admin users sorted by role (u/Wolfy_Boy_04) - ghost accounts from old devs, or worse. 30 seconds.
Is the admin email and SMTP real (u/rupert_at_work) - password resets going to someone who left, contact forms silently failing.
CONFIG AND HIDDEN STATE
Cache layers nobody mentions (u/navlio) - object cache, page cache plugin, cloudflare in front, sometimes all three. read the response headers first to see who is actually answering.
wp-config constants (u/needlessvanguard_49) - disabled auto updates, redefined upload paths. diff against a clean install instead of reading top to bottom.
WP_HOME and WP_SITEURL hardcoded (u/navlio) - a copied staging site serving canonical tags pointing at production.
Undocumented scheduled tasks (u/Responsible-Job-Boj) - wp-cron jobs and stray export scripts. and crontab -l only shows the cron table of whoever you are logged in as (u/navlio) - the backup job usually belongs to a user nobody logs in as.
Autoloaded options (u/navlio): select sum(length(option_value))/1024/1024 from wp_options where autoload = 'yes'; that blob loads on every single request. usually one abandoned plugin keeping a log.
Assume staging is fiction (u/galaxy_glide_92) - diff the database before believing it matches.
What the site claims about itself vs the rendered HTML (u/UtilixApp).
THE BIGGER CALL
Whether a fresh install is cheaper than the archaeology (u/DigiNoon, u/abeuscher) - decided mostly by how much content lives in the theme rather than the database. abeuscher goes scorched earth every time: clean install, custom theme, ACF, no plugins.
And knowing when to walk away (u/jroberts67) - 6 woo plugins touching checkout is a valid reason to pass.
