You send a message and get nothing back. You try again a week later, then you call. The site still needs work, and now you realise you don't have a single password.
This is stressful, but it's rarely the end of your website. What matters most is the order you do things in. Here's what we'd do, starting today.
1. Send one last clear message
People get ill, change numbers and fall behind, so give them a fair chance and put it in writing. Send one calm message by email and WhatsApp that covers:
- what you need: domain access, hosting access, the admin login, the code and the latest backup
- a clear date, such as 7 days from now
- that you'll move the work to someone else after that date
Keep a copy, along with your contract and invoices. If a lot of money or a dispute is involved, speak to a lawyer as well.
You don't have to wait for a reply before starting the next steps.
2. List what you can still get into
Try each of these, using "forgot password" with your own email:
- Domain: the company where yourbusiness.com is registered
- Hosting: where the website files live
- Website admin: the WordPress dashboard, for example
- Business email: your mailboxes and who controls them
- Code: GitHub, GitLab or Bitbucket, if your site was custom-built
- Payments: Stripe, PayPal or anything else that takes money
- Google: Search Console and Analytics
Next to each one, write: have it, don't have it, or no idea. If you don't know where your domain is registered, a free WHOIS lookup will show you the company. Many results also show the expiry date.
3. Check the dates that can take you offline
The most urgent problem is often not the unfinished work. It's a domain or hosting plan that was paid on your developer's card and is about to expire.
Find the domain's expiry date first. If it's close, make this your first job, because your website and your business email both depend on that domain.
4. Save a copy before anyone changes anything
Do this before any updates or fixes:
- With hosting access: download the website files and the database. Most hosting panels have a backup tool for this.
- With only WordPress access: install a trusted backup plugin and download the backup to your own computer.
- With no access at all: save your text and pictures from the live pages, and check whether your hosting company can help once you've proved who you are.
Don't click "update all" yet. On an old site, one update can break the checkout, and without a copy there's no easy way back.
5. Get your access back, one door at a time
The domain
Start here, because everything else depends on it. If the domain is in your name or your company's name, the registrar's account recovery process is usually the way back in.
If it's in your developer's name, it gets harder. Ask the registrar what proof they accept, and gather your invoices and business documents. There's no guarantee, but it's worth the effort.
The hosting
If the account belongs to your developer, the hosting company may refuse to hand it over. That's not always a disaster. Once you control the domain and have a copy of the site, you can move to new hosting in your own name and point the domain there.
The website
With hosting access, a developer can usually create a new admin account for you, even when nobody remembers the old password.
The code and mobile apps
A WordPress site can usually be recovered from the server. A custom app is harder if the source code only exists on your old developer's computer. App store accounts can be difficult too, because a transfer usually needs the current owner's help. Ask for these first in your message.
6. Lock the old doors
Once you're back in control:
- change every password and turn on two-step login
- remove admin accounts you don't recognise, including old FTP and SSH access
- create new API keys for payment gateways and other connected services
- move paid plugins, themes and subscriptions to your own account and card
This isn't an accusation. It's simply how you make sure you know who can reach your site.
7. Get the code read before you decide anything
"We'll have to rebuild it" is an easy thing to say, especially from someone who hasn't looked. Often the better answer is a fix, not a rebuild.
Ask whoever takes over to tell you in writing:
- what is there and what is half done
- what is risky and needs attention first
- what it will cost to finish, agreed up front
8. Set it up so this can't happen again
Keep the domain, hosting and code in your own accounts, and give each developer their own login that you can remove. Keep backups away from the website's own server. Our website ownership checklist walks you through all of it.
Stuck with a site someone else built? We read the code first, tell you plainly what's wrong and carry on from where the work stopped. Ask us for a free code check.
