Why can an open-source WordPress website still lock you in?

By IGEARS TECHNOLOGY LIMITED · Reviewed 2026-09-13

A practical situation: the agency relationship ends

An illustrative owner commissions a WordPress website, pays the hosting invoice and can edit pages.Read more

When changing agency, they discover that the domain account, server backups, theme licence and form integration belong to accounts the agency controls. The site still works, but a new team cannot safely update, restore or move it. This is an example scenario, not an allegation about a named developer.

Open-source rights and operational control are different

WordPress core is distributed under GPLv2 or later. That licence grants software freedoms; it does not automatically transfer a hosting account, domain registration, commercial subscription or external service. The rights to custom designs, code, content and licensed assets depend on the relevant licences and agreement. Verify both the documents and the actual access.

Four ways a WordPress implementation becomes dependent

Review the dependency and the recovery route together.

Supporting detail

Account control: domain, DNS, hosting, administrator access, email delivery and analytics remain in an agency-only account.
Feature control: an agency subscription activates a page builder, form, multilingual or commerce extension that the owner cannot renew independently.
Content structure: layouts, translations, custom fields and workflows depend on plugin-specific data or shortcodes.
Knowledge control: custom code, deployment steps, backups and integration credentials are undocumented or unavailable.

A paid plugin is not automatically a lock-in problem

Paid maintenance, hosting and extensions may provide real value.Read more

The risk rises when a business-critical feature has no understood expiry policy, replacement account, export format or alternative maintainer. Ask what happens on non-renewal, agency departure and a change of domain. These are different events; testing one does not prove the others.

The test: can another team restore and operate the site?

Use a protected staging environment. Restore both database and files, document the required runtime and install the permitted licences.Read more

Then test a page edit, a form submission, translated URLs, account permissions, scheduled jobs and a backup restore. Record what breaks and who can resolve it. A WordPress content export alone is not a complete site backup.

Reduce the dependency before a crisis

Inventory licences and owners first. Obtain organisation-controlled accounts, a complete backup and a documented handover.Read more

Replace only the dependencies that cause a material problem; keep WordPress when it still fits. IGEARS can review your current implementation, test its portability and scope a phased improvement with clear acceptance criteria.

Common questions

Does WordPress being GPL mean I own every part of my website?

No. WordPress core rights do not determine ownership or transfer rights for every account, custom deliverable, trademark, font, image or external service. Review their licences and your agreement.

Should I remove every paid plugin?

No. Keep valuable, maintained plugins when their costs, licence ownership and exit arrangements are clear. Test replacements on staging before changing production.

Sources and verification

Policies and features can change. Verify the current terms and your installed edition before implementation.