My question is:
Should a money dispute arise, like I suspect one will is the client able to access the database and everything so they can migrate it to their website? They don't have FTP access or access to the database. BUT they do have the controls available in wp-admin.
There is still about 20 hours of work to go but constant alarm bells have arisen which worry me.
So I want to be able to withhold the website if I can, but I think they already potentially can access all that is required via wordpress wp-admin if they are cunning enough.
If that's the case, I think I'll bring up my concerns to talk out before I continue...