Your Web Developer Has Disappeared? How to Regain Control of Your Website, Domain and Hosting

The phone goes unanswered, emails stay unread, and the last invoice for "hosting and maintenance" went to someone you can no longer reach. For a small business this is unsettling precisely because the website still looks fine from the outside. Nobody knows who holds the keys.

It is a situation we handle regularly in our website rescue work, and it is almost always solvable. This guide walks you through it calmly, from finding out who controls what to making sure it never happens again. It is practical guidance based on experience, not legal advice.

1. Don't panic: what can and cannot go wrong

A website does not stop working because its developer stops answering. The files sit on a server, the domain points to that server, and both carry on until somebody switches them off or a bill goes unpaid. Only three things can genuinely go wrong:

• The domain expires. If the renewal is missed, the site and every email address on it go offline, and after a grace period anyone can register the name. This is the one real deadline, so find the renewal date first.
• The hosting is cancelled or unpaid. The account is suspended, the site goes offline and, after a while, the files and the provider's backups may be deleted.
• The site is neglected. No updates, no patches, no backups. Nothing breaks on day one, but the risk of a hack grows every month.

What cannot happen: nobody can take away the content you wrote, the photos you own or the brand you have built. Worst case, the site can be rebuilt.

2. Make an inventory of every account your website depends on

Before contacting anyone, search your inbox for invoices and welcome emails and ask your accountant which companies have been charging you. A typical small-business website depends on most of these:

• Domain registrar – where the name is registered and renewed.
• DNS – often the registrar, sometimes a separate service such as Cloudflare.
• Hosting – the server with the files and database, plus control panel, FTP/SFTP and database access.
• WordPress admin – the login at /wp-admin and any additional administrator accounts.
• Email mailboxes – with the web host, Google Workspace, Microsoft 365 or elsewhere.
• Google Analytics, Search Console and Business Profile – frequently set up under the developer's Google account.
• Payment provider – Stripe, Mollie, PayPal or similar, if you sell online.
• Premium plugins, themes and SaaS tools – page builders, SEO and backup plugins, form and newsletter tools. Licences bought on the developer's account stop updating when their subscription lapses.

For each item note who holds the account, which email address it is tied to, whether you have access and when it renews. The gaps are your to-do list.

3. Find out who owns your domain

The domain is the most important asset on the list. Whoever is listed as the registrant controls where the name points, and therefore your website and your email.

How to check the registrant

Run a WHOIS or RDAP lookup on your domain – each country's registry offers one: DENIC for .de, nic.at for .at, SWITCH for .ch, EURid for .eu and SIDN for .nl. Since GDPR most registries no longer show the registrant's name publicly, but you will still see the registrar, the name servers and often the expiry date. If the holder is hidden, the registrar or the registry's holder-verification procedure can tell you who it is.

If the domain is already in your company's name and you simply lack the login, the registrar's support will reset the access once you prove you represent the company (trade-register extract, ID, matching invoice details).

If the domain is registered in the developer's name

This is common and not necessarily malicious: many freelancers register domains for clients out of convenience. It only becomes a problem when they are unreachable. Your options, in order:

1. Ask for a transfer. Send a short, friendly, dated request (email plus a letter) asking the developer to change the registrant to your company or to provide the authorisation code (Auth-Code, AuthInfo, EPP code or transfer token, depending on the registry). Many "disappeared" developers reappear when a clear, polite request lands.
2. Contact the registrar. Explain that the domain is used exclusively for your business and send evidence: your company name in the site content and imprint, invoices from the developer for "domain", trade-register or trademark documents. Registrars have procedures for such cases and can often initiate a change of holder.
3. Use the registry's dispute procedure. Country registries and EURid offer procedures for a holder who cannot be reached or refuses to transfer a domain that clearly belongs to someone else. These take time, so start early.

Throughout, watch the expiry date: some registrars will let you pay the renewal yourself while the transfer is sorted out – ask.

4. Hosting: find the provider and get the account handed over

If you have no paperwork from the hosting company, the site itself will tell you where it lives. Look up the domain's A record – the IP address it points to – with any online DNS tool or the command nslookup yourdomain.com, then run an IP lookup on that address. The result names the hosting company or data-centre operator.

Contact the provider's support with the domain name and explain the situation. Providers will not hand an account to someone who merely claims to own a website, so expect to prove it with company registration documents, an ID of the managing director and evidence that your business has been paying. If the account is in your company's name but the login email is the developer's, this is usually enough to have the contact details changed.

If the account is in the developer's name and paid by them, the provider generally cannot give it to you. The practical route is then a migration: obtain a copy of the site – from the developer, an older backup or, if nothing else works, rebuilt from the live pages – set it up on hosting in your own name and point the domain at it. For a developer this is routine and typically done in a day or two.

5. Getting back into WordPress admin

The WordPress login is often the easiest lock to open, provided you control one of the pieces around it:

• Password reset by email. Go to yourdomain.com/wp-login.php, click "Lost your password?" and try every email address you have used with the developer; if an administrator account exists with one of them, the reset link arrives.
• Via the hosting panel. Many hosting panels include a WordPress toolkit with a one-click admin login, or let you add a new administrator without knowing any existing password.
• Via the database. With database access (phpMyAdmin or similar), an administrator's password can be replaced or a new administrator created. It sounds technical, and it is, but for a developer it takes minutes.

If none of these are available, everything hinges on hosting access (section 4) – which is exactly why the accounts matter more than the WordPress login itself.

6. Once you are in: secure, back up, document

Regaining access is not the finish line. Work through this list in order:

1. Take a full backup first – files and database – and store a copy outside the hosting account before you change anything.
2. Change every password: WordPress administrators, hosting panel, FTP/SFTP, database, mailboxes, registrar and DNS. Use a password manager owned by the business and switch on two-factor authentication wherever possible.
3. Review users. Remove administrator accounts you do not recognise, and check for extra FTP accounts, SSH keys and WordPress application passwords.
4. Rotate API keys and tokens: payment gateway, SMTP or transactional email, Google and social integrations, backup services.
5. Review plugins and themes. Note anything unfamiliar or unmaintained, and re-licence anything registered to the developer's account so updates continue.
6. Move analytics and search tools to your own Google account and remove the old access.
7. Update registrant and billing details on the domain and hosting so renewal notices reach you.
8. Document everything in one secured document: every service, login email, renewal date and who has access.

7. The legal and organisational side

Most of these situations start with a contract that never said who owns what – or with no written contract at all. The principle is simple: the business owns domain, hosting and content, and the developer is a technical contact who can be swapped out at any time. For future agreements, put the following in writing:

• Domain registered with your company as registrant and a company address as the account email.
• Hosting contracted and paid for in the company's name; the developer gets access, not ownership.
• Clear rights to the code, design, text and images, and third-party licences purchased in the company's name.
• An obligation to hand over all credentials and a complete backup within a defined number of days of the engagement ending.
• A named deputy or procedure in case the developer is unavailable.

Again, this is practical guidance from day-to-day work, not legal advice; for an existing dispute over a domain, a lawyer who knows your country's rules will be worth the fee.

8. Prevention checklist

• Register the domain yourself, in the company's name, with auto-renew on a company card.
• Use a company email address – never the developer's – as the contact on every service.
• Store all credentials in a business password manager and share access from there.
• Check once a quarter that you can actually log in to the registrar, hosting and WordPress.
• Keep an independent backup outside the hosting provider that you know how to restore.
• Insist on a written agreement with a handover clause, however small the project.

9. Need help taking your website back?

BuildWebs is a small, EU-based web studio, and taking over orphaned WordPress sites and WooCommerce stores is a regular part of our work. We help you regain access to domain, hosting and admin, audit and clean up what we find, migrate the site if that is the safer route, and then keep it updated and backed up under a website care plan from €49 per month. One-off rescues start at €290 at a fixed price agreed upfront, we usually begin within 24–48 hours, work remotely, and you deal directly with the developer doing the work.

If your developer has gone quiet and you are not sure what you still control, get in touch and describe the situation. We will tell you honestly what the next step is – even if it is simply a polite email you can send yourself.