devautomation

Posted on May 21

WordPress client onboarding: the exact process I use to start every maintenance contract right

#freelance #wordpress #business #webdev

The first 30 days of a maintenance contract determines whether a client stays for 2 months or 2 years.

Most freelancers skip onboarding entirely. They say "I'll take care of updates" and start updating. Then a miscommunication happens -- client didn't know backups weren't included, or they expected same-day responses, or they thought you were responsible for content changes that weren't in scope.

Here's the onboarding process I use for every new maintenance client. It takes 2 hours total and prevents 80% of future issues.

Step 1: The access collection call (20 min)

Before touching the site, get everything you need to actually manage it. Schedule a 20-minute call or send a structured form:

Required:

WordPress admin credentials (or application password)
Hosting control panel access
FTP/SFTP credentials
DNS panel access (Cloudflare, domain registrar)
Backup destination access (Google Drive folder, S3 bucket)

Nice to have:

Current backup plugin and schedule
Staging environment URL
Contact at hosting provider
Payment gateway dashboard access (for WooCommerce sites)

I use a simple Google Form for this. Clients fill it out before the first meeting. Nothing delays onboarding more than waiting for credentials one at a time over email.

Step 2: The site audit (30-40 min)

Before agreeing to maintain a site, know what you're agreeing to maintain.

Plugins:

wp --allow-root plugin list --fields=name,version,status,update --format=table

Look for: abandoned plugins (last update 12+ months ago), duplicate functionality, security plugins, backup plugins.

Core version:

wp --allow-root core version
wp --allow-root core check-update

Users:

wp --allow-root user list --role=administrator

File permissions:

stat -c "%a" wp-config.php
find . -name "*.php" -perm /o+w 2>/dev/null | head -5

Current backup situation:

Is any backup plugin installed?
Where is it backing up?
When was the last successful backup?
Is the backup destination off-server?

Performance baseline:

Run PageSpeed Insights once before you start
Document the score
This is your before/after comparison in the first monthly report

Document everything. Send the client a "Site Audit Summary" after this step. It shows you know what you're doing and sets realistic expectations about the site's current state.

Step 3: The service agreement (10 min to sign)

Before doing any work: sign a service agreement. This isn't bureaucracy -- it's what defines the relationship.

Key sections:

Scope -- exactly what is and isn't included (updates, backups, content changes, bug fixes, emergency response)
Response time -- what the client can expect and when
Backup policy -- where backups go, how long they're retained, whether you're responsible for restores
Payment terms -- monthly invoice, due date, late fees
Cancellation -- notice period (30 days minimum), what happens to their access
Liability -- what you're and aren't responsible for if something goes wrong during an update

Without a signed agreement, every conversation about scope is a negotiation. With one, "is that included?" has a clear answer.

Step 4: First maintenance run (and documenting it)

Do the first maintenance run manually, step by step, and document everything:

Take a full backup (files + database)
Run updates (core, plugins, themes)
Verify the site still works
Fix anything that broke
Check security issues from the audit and remediate (rename admin user, fix permissions, disable debug.log)

Send the client a detailed first report:

Current plugin versions (before/after)
Security issues found and fixed
Backup location
Next scheduled maintenance date
Any recommendations (plugin they should remove, PHP version to upgrade, etc.)

The first report is the most important one. It sets the expectation for every future report and demonstrates value immediately.

Step 5: Communication setup

Two things to establish in week 1:

Regular reporting: Monthly report sent on the same date every month. Template + scheduled send. The client knows when to expect it without asking.

Escalation path: What happens in an emergency? Who calls whom? What's the response time? Document this explicitly. "Site down" is different from "plugin broke the checkout" which is different from "client wants a design change."

I use a simple doc shared with the client:

EMERGENCY (site down / payment broken): WhatsApp/call within 2 hours
URGENT (feature broken, form not sending): Email + reply within 24 hours
STANDARD (content change, question): Next monthly maintenance window
BILLING: Invoice sent on [date] monthly, due net 14

The onboarding checklist

[ ] Access collection form sent and completed
[ ] All credentials received and stored securely
[ ] Site audit completed and documented
[ ] Audit summary sent to client
[ ] Service agreement signed
[ ] Payment method set up
[ ] First maintenance run completed
[ ] First report sent
[ ] Backup destination confirmed and tested
[ ] Communication protocol documented
[ ] Next maintenance date scheduled

This takes 2 hours spread over the first week. After that, the client relationship runs on autopilot.

What happens when you skip onboarding

I've inherited clients from freelancers who skipped onboarding:

No credentials documented anywhere (had to request everything from scratch)
No backup for the 18 months the previous developer worked on it
No service agreement (client thought bug fixes were included, they weren't)
Client called/emailed whenever anything looked slightly different on their site
No baseline performance data (no way to show improvement)

Each of those problems adds hours of work and strains the relationship before it's even established.

Two hours upfront saves ten hours later.

The service agreement template, onboarding checklist, monthly report template, and first-audit template are all in:
WordPress Agency Starter Kit -- use DEVTO for a discount.