The Situation Is More Common Than You Think
A small professional services firm calls us. Their website is down. Not hacked — just down. The hosting renewal lapsed, the auto-payment failed, and the email notifications went to the developer who built the site four years ago.
That developer has since retired. Or moved. Or simply stopped picking up the phone. The client doesn't have login credentials for the hosting account. They don't know who the registrar is. They don't have access to the domain. The site — the one they paid $6,000 for — is gone.
This is not an edge case. We hear a version of it every month.
When a small business hires a freelancer or a small agency to build their site, they often delegate everything: the hosting account, the domain registration, the CMS login, the plugin licenses. It feels efficient at the time. The developer knows what they're doing. You don't need to worry about it.
Then the developer is unavailable — for any reason — and all of that delegated access goes with them.
What You Probably Don't Have Access To
If your site was built by someone else, go through this list right now:
- Domain registrar login — where your domain is registered (GoDaddy, Namecheap, Google Domains, Hover). If you don't have the username and password, you don't control your domain.
- Hosting account login — the account that pays for the server your site runs on. Separate from the website itself.
- WordPress admin credentials — the username and password to log into your CMS. Different from the hosting login.
- Email associated with all of the above — if recovery emails go to your developer's address, you can't reset any of the above without their help.
- Any plugin license keys — premium plugins (page builders, SEO tools, form plugins) are often tied to a developer's personal account. When they leave, the licences often go with them.
If you're missing more than one of these, your site is more fragile than you think — regardless of how well it's running today.
What You Can Do Right Now
If the developer is still reachable: Ask for a credentials handoff document. Any professional should provide this on request. What you need: hosting login, domain registrar login, WordPress admin login, and any plugin licence keys. Ask for the associated email addresses to be transferred to your own email.
If the developer is unreachable: Start with the domain. You may be able to recover it by proving ownership through ICANN's transfer dispute process — but this takes time and isn't guaranteed. Contact the hosting company directly with proof of business ownership (tax documents, incorporation papers, payment records). Most hosts have a recovery process, though it can take weeks.
If the site is down and recovery isn't fast: A temporary landing page with your contact information and a redirect from your domain is better than nothing. It keeps your phone number and email visible while you sort out the underlying issue.
The honest truth is that recovery from a total lockout is expensive, slow, and sometimes impossible. The only real fix is to not be in that position.
The Structural Problem
The reason this keeps happening is that WordPress sites — and most CMS-based sites — are not self-contained. They require ongoing infrastructure: a hosting account, a domain registration, a CMS licence, an ecosystem of plugins, often a maintenance retainer. Each of those dependencies is an opportunity for access to be held somewhere you don't control.
"If you can't log in to it, you don't own it."
This isn't a problem with the developer. Most developers who handle these accounts do so with good intentions. The problem is structural. The web industry built a model where the ongoing operation of your site is bundled with ongoing access by the person who built it, and nobody told the business owner that was happening.
The alternative is a site that you own outright — where the files are yours, the hosting account is yours, the domain is registered to you, and no one person's availability determines whether your business has a web presence.
That's exactly what we build. Every client gets a full credentials handoff, every account registered in their name, every file delivered to their own repository. If we stopped existing tomorrow, every client's site would keep running without us.
That's not a feature. That's the minimum standard a site owner should demand.
Frequently Asked Questions
What do I do if my web developer is unreachable and I need site access?
Start with your domain registrar. Check payment records or old emails for any mention of GoDaddy, Namecheap, Cloudflare, or similar. Contact them directly with proof of business ownership. For the hosting account, the same approach applies — most hosts have a business account recovery process. WordPress admin access can sometimes be recovered via the hosting panel's database tools if you have hosting access first.
Who should own my domain name?
You should. Always. The domain should be registered to your business email address, paid from your business payment method, and the login credentials should be yours alone. A developer may manage DNS settings on your behalf, but the registrar account should be in your name.
Can I transfer my WordPress site to a new developer?
Yes, if you have hosting access. A standard WordPress migration involves exporting the database, copying the files, and importing them to a new hosting account. If you don't have hosting access, you may need to work through your hosting provider's support team to regain control before a transfer is possible.
See What WordPress Is Costing You
Use our free calculator — enter your real numbers and see the 3-year comparison.
Do the Math →