The situation
The site was built three years ago. The developer has moved on, or the agency has been slow to reply, or the marketing manager who set everything up has left. You want to make a change and discover you cannot log in to anything. The domain renewal email goes to someone else. The hosting is in a name you do not recognise.
This is one of the most common reasons businesses call us, and it is nearly always recoverable. It just has to be done in the right order, in writing, and before a renewal date rather than after.
Which accounts matter, in order
- The domain. Whoever controls the registrar account controls whether your website and email exist. Recover this first.
- DNS, if managed separately from the registrar (often Cloudflare). Controls where the domain points.
- Hosting. Where the site's files and database live.
- The website admin. The login to edit content.
- Email, if your business email runs on the domain.
- Everything else: Google Business Profile, Search Console, analytics, booking tool, payment processor, social accounts.
If you can only get one thing, get the domain. With the domain you can rebuild everything else. Without it, everything else is on borrowed ground.
Step one: find out who holds what
Domain. Look up your domain in a WHOIS tool. The registrar's name will show even if the owner details are hidden. If you or a colleague has an account at that registrar, log in and check. If not, the domain is registered in someone else's account.
Hosting. A DNS lookup on your domain gives an IP address; a reverse lookup or a hosting-checker tool tells you the company. Check whether anyone in the business has an account there.
Admin. Try the obvious login pages. For WordPress, /wp-admin. Use "forgot password" with every business email address you have. If a reset email arrives, you have admin access; do that before anything else.
Everything else. Search your email archive for "welcome to", "your account", "invoice" and the names of the services. Old invoices reveal which accounts exist and who paid.
Write it all down: each account, who appears to hold it, the renewal date if you can find one.
Step two: ask, properly
Email the person or company who holds the accounts. Be specific, be polite, and be clear that you are asking for ownership, not access.
We're tidying up ownership of our online accounts. Could you please transfer the following into accounts in our name by [date, two weeks out]: the domain registration for [domain], the hosting account for the website, and administrator access to the site. For the domain, we've set up an account at [registrar] under [email]; a transfer or account change to that email is ideal. Please also send any other logins related to the site. Happy to cover any transfer costs.
Give a date. Offer to pay reasonable costs. Copy a second person in your business so there is a record. Most developers respond to this within days, because most of them never intended to hold anything; it was just easier at the time.
Step three: the transfers
Domain. Two routes. The registrar can change the account holder's details to yours, which is usually a support request from the current holder. Or the domain is transferred to a new account at the same or a different registrar, which involves an authorisation code from the current holder and takes a few days. Either way, the outcome is an account with your email and your card. Turn on auto-renew and two-factor authentication the same day.
Hosting. Hosts can usually transfer an account or a site to a new owner. Alternatively, and often cleaner, a developer you trust takes a full backup and sets the site up on hosting in your name, then the old account is closed.
Admin. Have them create an administrator user with your email. Log in, confirm you can see everything, then remove or downgrade their user if the relationship is ending.
Email. If your email runs through the developer's account with Google Workspace or Microsoft 365, that needs its own careful transfer so no mail is lost. Do not let anyone cancel the old account until every mailbox has moved.
When they will not respond
Escalate in writing. A second email, then a letter. State that the domain and website were paid for by you and are your property, list the accounts, and set a final date.
Go to the registrar. Registrars have dispute processes for exactly this: a business whose domain is registered by a contractor. It requires evidence, invoices, your business name in the site content, trademark if you have one, and takes weeks, but it works.
Go to the host. Hosts will often work with the site's evident owner when the account holder is unreachable, at least to provide a backup.
Take a copy now. Whatever the state of the accounts, a developer you trust can usually get a complete copy of the public site and, with any admin access, the content. That copy means the site can be rebuilt on your own accounts if the originals are never recovered.
Watch the renewal date. If the domain lapses because the holder did not renew, there is usually a grace period of a few weeks in which it can still be recovered, at a higher fee. After that it can be bought by anyone. The renewal date is the deadline for everything above.
Once you have them
Put every login in a password manager owned by the business. Turn on two-factor authentication everywhere. Set renewal reminders. Add anyone who works on the site as a user under your account, never the other way round. Write the one-page document of what exists and where.
This is how the ownership section of our audits always starts, because none of the other findings matter if the client does not hold the keys. If you are stuck partway through, the recovery is something we do regularly, and the first step is the same: find out who holds the domain, today.