Your web developer disappeared: how to take back your domain, hosting, access and code
Your developer stopped replying and you have no access to the domain, hosting or code? A checklist to regain control of your website without losing data.
Short answer: if your web developer disappeared, recover the domain and hosting first, because without them you can lose the website entirely. Then move on to the site admin, code repository, email, analytics and ad accounts. Check the domain WHOIS, the hosting invoices and the list of admins, take a full backup, and only then change passwords or vendors.
It is a common story. A freelancer or a small agency built the site, everything worked, and then the person stopped answering. While the site loads, it feels like there is no problem. The problem shows up at the worst moment: the domain was not renewed, the SSL certificate expired, the site got hacked, or you urgently need to change a price before a sale. Below is a checklist for taking back control of your website yourself, and a clear line on when a specialist is worth it.
The first 48 hours
- Do not delete or move anything. Do not touch DNS, migrate the site or install “recovery” plugins until you know where everything lives.
- Ask the developer in writing, by email and messenger, to hand over access to the domain, hosting, site admin, code repository and connected services. Give a reasonable deadline, such as five business days. That message is useful evidence if you later need the registrar or host to restore access without them.
- Check when the domain expires. If it is less than a month away, this is the most urgent task on the list.
- Save everything that is public: copy, photos, page structure, contact details. If the site goes down, this is your starting point.
- Collect financial proof: invoices and receipts for the domain, hosting and development. They show the business is yours.
Check it yourself: a 30-minute access audit
Go through the list and mark each item “I have access”, “the developer has it” or “not sure”.
- Domain: which registrar, who the registrant is, the expiry date, and which email address receives registrar notices.
- DNS: where the records are managed: the registrar, the host or Cloudflare. That decides who can point your site and email elsewhere.
- Hosting or server: the provider, whose account it is, who pays, and whether you can log in to the control panel.
- Site admin: WordPress, Shopify, Webflow, Squarespace or BigCommerce. Do you hold an owner or administrator account?
- Code: is there a repository (GitHub, GitLab, Bitbucket) and are you a member? For custom-built sites and web apps this is critical.
- Email on your domain: Google Workspace, Microsoft 365 or the host’s mail, and who the administrator is.
- Analytics and ads: Google Analytics 4, Tag Manager, Search Console, Google Ads, Meta Business. Are you the owner or just a guest?
- Google Business Profile: who is the primary owner of your listing on Maps.
- Paid services: theme and plugin licences, Shopify apps, email marketing, SMS, CRM. Whose card and whose email?
- Backups: where they are stored, when the latest one was taken, and whether anyone has ever tested a restore.
Who should own what
| Asset | Where to check | What good looks like | If you have no access |
|---|---|---|---|
| Domain | WHOIS/RDAP (lookup.icann.org or the country registry) | You or your company is the registrant, with your email | Contact the registrar with documents; request the transfer (auth) code |
| Hosting / server | Invoices, emails from the provider, the site’s IP | Account on your email, paid with your card | Host support: prove ownership, transfer the account |
| Site admin | Login page, user list | You hold the owner or admin role | Via hosting (WordPress) or platform support (Shopify, Webflow) |
| Code | Repository, contract | Repo in your organisation, or a full copy with you | Copy from the server; export the theme on hosted platforms |
| Analytics, Ads, Meta | Access settings in each tool | You own it; vendors get limited roles | New accounts you own; historical data may be lost |
| Google Business Profile | business.google.com | You are the primary owner | Request access to the profile through Google |
How to recover each piece
Domain first
Whoever controls the domain controls the website and the email. If the domain is registered to you but the password sits with the developer, reset it through the registrant email or contact the registrar with documents. If the developer is listed as the registrant, legally the domain is theirs, and you need an agreement or a lawyer. For generic domains such as .com, .net and .org, ICANN rules require the registrar to give the registrant the code needed to transfer the domain to another registrar. Country domains follow their own registry rules, so ask your registrar.
Hosting
If hosting is billed to your card or your company, the provider’s support can usually move the account to you after verification. If the site sits on a server the developer rents, the safest path is a full copy of the files and database moved to an account you own. Until then, a missed payment on their side means your site can vanish.
WordPress, Shopify, Webflow
- WordPress: with hosting access, a new administrator can be created through the database panel or WP-CLI. Then review the user list and remove unknown admins, but only after a backup.
- Shopify: the store owner can transfer ownership in the users settings. If the store was built as a development store in a Partner account, it is handed to the client through the Partner Dashboard. With no access at all, contact Shopify support.
- Webflow: the site lives in a workspace and can be transferred to yours together with its site plan. The current owner or Webflow support does this.
Code and repository
For sites built on a theme, the code is the theme and its plugins, and both can be pulled from the server. For custom sites, portals and web apps without a repository and change history, a new developer first has to spend time working out how everything fits together. That is why code should live in a repository where you own the organisation, not where you are a guest.
Analytics, ads and your Google listing
In GA4, Tag Manager, Search Console, Google Ads and Meta Business, add yourself as owner or admin and give the developer a limited role. If those accounts belong to the vendor and they are unreachable, it is sometimes easier to create new ones under your company: you lose history but stop depending on someone else’s login. Search Console can be re-verified via DNS as soon as you control the domain.
What not to do
- Do not edit DNS without knowing what runs on it. You can break email that nobody connected to the website.
- Do not update everything on the live site. A site that has not been updated for years often breaks after a mass plugin update. Back up first, then test on a staging copy.
- Do not remove the developer from accounts before you have a full backup and every password, or you may lose access only they had.
- Do not order a brand-new site in a panic. Fixing the current one is often cheaper (realistic price ranges are in how much a website costs in 2026). Decide after an audit, and if a new site is the answer, move to it with our redesign SEO checklist.
How to never end up here again
- An access register: one sheet or password manager with every service, login, owner and renewal date.
- Everything in your name: domain, hosting, Google and Meta accounts and the repository on a company email, paid with your card. Vendors are users, never owners.
- A contract that covers code ownership and the duty to hand over access at the end of the engagement. What else to check in a new contractor’s proposal is in how to choose a web agency: red flags.
- Off-site backups, automated, with at least one tested restore.
- Documentation: what is installed, why, which plugins are critical and how to update them. Then any specialist can pick up the site in days, not weeks.
From our own work
When we take over someone else’s project, step one is an inventory: what is installed, who set it up and what actually works. In a tracking audit for a Shopify store, that inventory showed the Google Tag Manager container loading three times on every page, once from the theme and twice from custom pixels, so ad tags fired three times. We shipped a fix release with publishing instructions and documented what is set up, where and why. A document like that is what removes dependency on a single person, including on us.
On long projects such as the Shopify store for a supplements brand, changes go out in small releases and are checked on a test store first. If another team picks the project up tomorrow, the change history and the working environment are already there.
When to call a specialist
- the domain or hosting is registered to the developer and they are not responding;
- the site is already down, hacked or throwing errors;
- there is no backup at all and the site takes orders or enquiries;
- it is a custom site or platform with no repository and no documentation;
- you need to decide whether to keep the current site or build a new one.
Symptoms and consequences are covered on the developer dependency page. The usual starting point is a technical audit (from €300): we check access, code, plugins, security and backups, and you get a prioritised report. After that we can take the site on ongoing support (from €100 per month) with updates tested on staging, daily backups and documentation. If the audit shows that maintaining the current code costs more than replacing it, we will say so and quote a redesign or a new site.
Tell us briefly what the site is, what you can access and what you cannot through the contact form, and we will suggest where to start in your case.
FAQ
My developer has not replied for a month but the site works. Should I do anything?
Yes, while it still works. Check who owns the domain and when it expires, take a full backup and move the logins to your own accounts. Doing this after the site goes down is far more expensive and stressful.
How do I find out who owns my domain?
Run a WHOIS/RDAP lookup at lookup.icann.org for .com, .net, .org and other generic domains; country domains have their own registry lookups. If the details are hidden, contact the registrar listed in the result.
Can a website be recovered without hosting access?
Partly. If the site still loads, the copy, images and page structure can be saved and rebuilt. The database, orders and settings live on the server, so hosting is the second priority after the domain.
The developer wants money to hand over access. What should I do?
Check your contract and invoices first: if you paid for the domain and the work, the rights should be yours. Technically, domains and hosting accounts are usually recovered through the registrar and hosting provider with proof of business ownership. Legal disputes are for a lawyer; we help with the technical side.
How much does it cost to take over a site from another developer?
A technical audit with a list of risks starts at €300, and ongoing support starts at €100 per month. The final cost depends on the state of the site: sometimes updates and backups are enough, sometimes part of the code needs rewriting.