If your web designer has stopped replying, you need three things to get control of your website back: the domain registration, the hosting account, and WordPress administrator access. Each can be recovered separately, and in most cases you do not need the original developer’s cooperation for any of them.
This happens more than anybody admits. Someone builds a site, registers everything in their own name because it was easier at the time, and then moves on, gets ill, changes career, or simply stops answering email. The business is left with a website it cannot edit and nobody to ask.
It is recoverable. Work through it in this order, because the order matters.
Start with the domain. It matters most.
Your domain is the only thing on this list that cannot be rebuilt. Lose the hosting and you rebuild the site. Lose the domain and you lose your email, your search rankings, every business card in circulation and every link anyone has ever made to you.
Find out who holds it. For a .uk domain, Nominet’s WHOIS lookup shows the registrant, and Nominet has a formal process for disputing or changing the registrant of record if the name is not held in your business’s name. For other extensions, a WHOIS lookup will at least show the registrar, and their support team will explain their own process.
What helps enormously: invoices showing you paid for it, correspondence where the designer refers to it as your domain, and anything showing the business trading under that name. Registrars deal with this regularly and they are not looking for a reason to say no.
Do this first, and do it before the renewal date if you can see one coming. A domain that lapses can be bought by anybody.
Then the hosting
If you have been paying the hosting bill directly, you are most of the way there already. Ring the host, prove who you are, and ask them to reset access on the account.
If the designer resold you hosting on their own account, you may not be able to take it over, because it is genuinely their account. That is not a disaster. What you need is a copy of the site, and any host will help you migrate a site you own onto hosting you control. If you cannot get a copy at all, the site can be rebuilt from what is publicly visible plus whatever the Internet Archive has kept.
Then WordPress itself
Once you have hosting access, administrator access to WordPress follows, even with no password. A new administrator account can be created directly in the database, or through the hosting control panel, by anybody who knows what they are doing. It is a ten-minute job.
When you are back in, before anything else: change every password, look at the user list and remove accounts that should not be there, and check that no plugin is sending data somewhere you do not recognise. A departing developer is very rarely malicious, but old accounts belonging to people who have moved on are a genuine security problem in their own right.
What if they are holding it deliberately?
Occasionally somebody withholds access over an unpaid invoice, or out of sheer awkwardness. Two things are worth knowing.
The first is that a domain registered for your business, paid for by your business, generally belongs to your business regardless of whose name went in the box, and registrars have processes for exactly this. The second is that it is almost always quicker to rebuild than to win an argument. If the dispute is genuinely about money, paying a disputed invoice you can afford is often cheaper than a month of your time.
How not to be here again
- Register the domain yourself, in your business’s name, on an account with your email address. Let a developer manage it, never own it.
- Hold the hosting account yourself for the same reason, and add your developer as a user.
- Keep your own administrator account in WordPress, and do not let it be the only one nobody uses.
- Take your own backups, somewhere that is not the same server as the website.
- Ask what happens if you leave before you hire anybody. The answer tells you a great deal.
For what it is worth, this is why hosting here runs through a separate company and why every client gets a full export on request. Your site should be yours, and the only thing that should keep you with a developer is that the arrangement is working.
Common questions
Who legally owns my website?
It depends on what you agreed, and most small projects never agreed anything in writing, which is the root of the problem. In practice the content is yours, the domain should be yours, and the design and code depend on your contract. I am a developer and not a solicitor, so if real money is involved, take proper advice rather than mine.
Can I recover my site with no access to anything at all?
Usually, yes, though it may mean rebuilding rather than recovering. Start with the domain, because that is the piece that cannot be recreated. Everything else has a route, even if the route is building it again on hosting you control.
How long does it take to get control back?
Hosting and WordPress access are usually same-day once you can prove who you are. Domain transfers and registrant disputes run on the registrar’s timetable and can take a week or two. Start that clock first and do the rest while it runs.
My site has been sitting unmaintained. Is it safe?
Assume not, and check. A WordPress site nobody has updated for a year or two is the most commonly compromised thing on the web, and plenty of infections are quiet by design. If yours turns out to be compromised, cleaning it up is a fixed £200, and it is worth doing before you build anything on top of it.
If you are stuck
Tell me what you can still get into and what you cannot, and I will tell you what your options are, whether or not you end up hiring me for it. Most of the sites I look after were built by somebody else, and a fair few arrived exactly this way. Get in touch.