WordPress is portable in principle, but an agency can still build a WordPress site that is unnecessarily difficult for someone else to edit or migrate.
Common forms of technical lock-in include:
Restricting administrator access
The client receives an editor login but not a true administrator account. The agency remains the only party able to install plugins, create users, export data or change critical settings.
Using an agency-only theme or builder
The visible pages depend on a proprietary theme, custom builder or cloud library that is not included in the handoff. When the agency license is removed, layouts may lose features or become difficult to change.
Hard-coding ordinary content
Headings, phone numbers, services and calls to action are placed directly in theme files rather than editable fields. A new provider must modify code for changes that should be manageable in the content system.
Hiding core functionality in a custom plugin
Forms, content types, redirects, schema, location data or integrations are controlled by a custom plugin that is omitted, disabled remotely or undocumented during transfer.
Creating undocumented dependencies
The site relies on an external API, agency server, private code repository, build process or deployment key that the client cannot access. A future developer sees the finished output but not the system needed to maintain it.
Retaining premium licenses without disclosure
The website uses premium plugins or fonts under an agency account, but the client is never told which replacement licenses will be required. Updates and security fixes may stop after the relationship ends.
Making the database difficult to reuse
Some page builders store content in complex proprietary structures. That is not automatically improper, but it can make migration to another builder expensive. The agency should disclose the major tools and give the client a working site, not merely a folder of files that cannot be operated.
Failing to provide source files
The website contains compiled CSS or JavaScript, but the editable source, build configuration and design files are withheld. Another team can keep the current site online but cannot efficiently revise it.
Controlling DNS email and analytics together
The most dangerous lock-in is operational rather than visual. If one vendor account controls the domain, DNS, website, business email, analytics and advertising, a dispute can affect the entire company at once.
Not every complicated website is intentionally restrictive. Custom systems can require specialized knowledge. The test is whether the agency documented the system, disclosed dependencies, provided appropriate access and created a reasonable path for another qualified professional to continue the work.