Our web developer stopped responding. How do we get our website back?
Start with the accounts, not the developer. Look up your domain at lookup.icann.org, find your host from the domain's DNS records, and search company records for the registrar and the host. Those checks take about an hour and show which pieces sit in your company's name and which need the developer, the registrar or the host. Then send one written request for everything, with a date on it. Silence is often illness, a one-person business winding down or a spam filter, so keep that request polite.
What it usually means
Silence often has an ordinary explanation rather than a plan to hold the website hostage: an illness or a family emergency, a move into a full-time job, a business being wound down, or a backlog that got hard to face. Sometimes the silence isn't theirs at all. Your emails may be landing in their spam folder, or their replies in your quarantine, and a lapsed card on their own hosting can take their inbox offline for days before they notice. The first check below rules these out, and sets the tone for the request.
What the silence means for you depends on one thing: whose accounts the website lives in. If the domain, the hosting and the Google accounts are in your company's name, you hand the logins to someone else and carry on. If they're in the developer's accounts, most of it waits until the developer answers, unless your company is the registrant on the domain record. The wider ownership audit is in do you actually own your website?.
Silence isn't always total. Some developers still answer, just slowly: a reply three days later that asks another round of questions, then another, while a change you needed within a week sits undone. Asking for more clarification can be a way of not doing the job. If that's what the last few months looked like, run the checks below anyway; they cost nothing. If the replies keep coming and only the work stalls, changes that take weeks is the closer match.
What it costs while it stays this way
The domain has a date on it. The ICANN lookup shows when the registration expires, and ICANN's Expired Registration Recovery Policy has the registrar send renewal reminders about a month and about a week before that date, plus one more within five days after it. Those reminders go to the registered name holder's contact email. If that's the developer's address, your company probably won't see them. After expiry, the same policy requires the registrar to cut the domain's DNS for at least eight days while it can still be renewed, which takes the website and every company inbox on the domain down together.
Hosting is the hardest piece to get back without the developer. Bluehost's process for an individual who isn't the account's Primary Contact asks for a government photo ID plus a court order or other legal documentation. If the account was opened in your company's name, Bluehost's organization process asks instead for the ID plus two business documents. Either way it turns on whose name is on the account. And if the developer stops paying their own hosting bill, the site can go offline on the host's billing schedule with no notice to you at all.
Everything else hangs off those two. Search Console ownership is proved with a token placed in DNS or on the site, so whoever controls DNS or hosting controls who can verify. Company email is routed by the domain's MX records. That's why the recovery order below runs domain, then hosting, then everything else.
How to confirm it yourself
- Rule out the ordinary explanations first. Search your mail, including spam and any quarantine your IT provider runs, for the developer's domain. Then try one other channel: their phone, LinkedIn, or a letter to their business address. Run their own business domain through lookup.icann.org too; a status of redemption period or pending delete means their registrar is deleting it, and their own website being down or parked points the same way. The Secretary of State business search in the state where their business is registered shows whether it's active or dissolved.
- Look up your own domain at lookup.icann.org. Enter your domain and write down five things: the registrar, the Registrant Organization if it's shown, the expiration date, the status codes, and the nameservers. Many registrars redact contact details, so the registrant may be hidden behind a privacy service. To learn whose name is on it, search company mail for the registrar's name: under ICANN's WHOIS Data Reminder Policy, registrars present the registration details to the registrant at least once a year, by email or another channel, directly or through the admin contact, and the original registration and renewal receipts may be there too. No trace? Send a test message through the registrar's relay, such as GoDaddy's Contact Domain Holder option at the bottom of its WHOIS results, and see whether it reaches a company inbox. That shows whose email is on the record, not whose name. The registrar-versus-DNS split is covered in the domain registration check.
- Find the host from your DNS records. Open Google's Admin Toolbox Dig tool at toolbox.googleapps.com/apps/dig/, enter your domain and choose A. Paste the IP address it returns into ARIN's search at search.arin.net, which names the organization holding that address. If that's a hosting company, you have your host. If it's Google, Amazon or Microsoft, the site sits in a cloud account, which could be a managed host's, the developer's own, or a CDN in front of either; if it's Cloudflare, the real host is hidden behind its proxy. If your company pays for hosting, the host's name will be on the invoices in the next step; if it doesn't, the hosting account goes on the request list. Choose MX in the same tool to see who handles your email.
- Follow the money. Search the company card statements and accounts payable for the last two years for the registrar and the host by name, such as GoDaddy, Bluehost, WP Engine, or whatever the lookups turned up. A charge on a company card is evidence for the provider's ownership-change process, but it doesn't open the account: the password reset goes to the account's login email, and recovery belongs to the primary contact or the registrant. So search company mail for the provider's welcome or login emails too; if they reached a company address, the reset will as well. If the only trace is a hosting line on the developer's invoices, the account is theirs.
- Read the user list in any login you still have. If anyone at the company can still log in to the website, open the user list. In WordPress that's Users, then All Users. If someone at the company holds Administrator, add a second company administrator today, then make a full copy: a backup or migration plugin installed from Plugins, then Add New Plugin, such as All-in-One WP Migration, exports the database, media, themes and plugins as one file a new host can import. The free version's import is limited by the new host's upload size, so for a large site the host's own migration tool is the alternative. Tools, then Export saves only pages, posts and menus, without images or the theme.
- Check who owns the Google accounts. In Search Console, open Settings, then Users and permissions, which lists every owner and user; the page only shows for owners, so not being able to open it is its own answer. In Google Analytics, open Admin, then Account access management, and look for a company email holding Administrator. If both lists show only the developer, add them to the recovery list; the analytics side has its own step-by-step check.
What the developer's replies actually mean
If the developer does reply, it's usually in one of a few familiar forms.
“Sorry, it's been a crazy few months. I'll get to it next week.”
Often true, and the reason the first message should stay friendly. It commits to nothing, though. Reply with the list and a date. For the domain, the request is small: most registrars generate the transfer code instantly inside the account, so a week is generous.
“Before I can do that, I need a few things from you.”
Sometimes fair; a transfer does need a destination account. When every reply is another round of questions, the questions have become the reason nothing moves. Answer all of them in one message, with the decisions already made, and keep the date.
“The site files are mine. You paid for the design, not the code.”
Possibly true about the code, depending on your contract. It says nothing about the domain if your company is the registrant, about your content, or about your Google accounts. Get those moving now and settle the code question with the contract in hand.
What actually fixes it
Start with the domain. If your company is the registrant but the domain sits in the developer's account, the registrar's recovery process comes first; GoDaddy's Domain Access option is for a listed registrant who can't get into the account holding the domain, and it asks for a color copy of a government photo ID, plus business documentation when a company is on the account. Once you're in, ICANN's transfer policy covers the move: the registrar must provide the authorization code within five calendar days of your request where it isn't already self-service. If a registrar refuses without a valid reason, ICANN takes transfer complaints through its compliance form. If the developer is the registrant, it's a contract matter, and the contract, the invoices and the dated request below are the evidence.
One trap sits in the order. A change to the registrant's name, organization or email triggers a 60-day lock on transfers to another registrar, unless the registrar offered an opt-out and it was taken first. If you're moving registrars, transfer first and update the record after, the order ICANN's policy advises.
Hosting comes second, ahead of the Google accounts, because the site's files are at risk while the developer holds the host. With WordPress Administrator, the migration plugin copy holds the whole site, so once the domain is yours, import it at a new host and point the domain there. Without admin access, ask for a full-site backup file and the hosting account in the same message as the domain, and expect the host's ownership process if they never answer. The last resort is the live site's images and the Wayback Machine's copies of each page at web.archive.org. If the site turns out to live on a platform the developer or a marketing company owns, there may be nothing to move at all; that's its own warning sign, and the realistic plan is a rebuild in accounts you hold, with 301 redirects from the old addresses.
Once you hold DNS, take Search Console back without anyone's help. Add a Domain property, verify it with the TXT record Google gives you, then in Settings, Users and permissions remove the developer as an owner and delete their verification tokens, or they can verify again; a DNS token comes out now, a file token only once you hold the hosting. The setup that stops this happening twice is at the end of the domain registration check linked above.
The message to send
One message, sent by email and repeated on one other channel. It assumes the innocent explanation, asks for everything at once, and carries a date, so the reply, or the lack of one, is something you can act on.
Hi [name],
I hope everything's all right on your end. We haven't been able to reach you since [date], and we need to keep the website moving, so we're bringing the accounts in-house. This isn't a complaint, and if you're stepping back from the business, we understand completely.
Could you send the following by [date one week out]: for [domain.com], either the domain unlocked with its transfer authorization (EPP) code, or, if it stays at [registrar], pushed into our own account there with the registrant changed to [company name]; a full-site backup or migration export file; the hosting login, or the hosting account moved into our name; Administrator access to the website for [company email]; and the same address made an Owner in Search Console and an Administrator on our Google Analytics account.
If any of it is easier on a short call, I can do [two times]. If we haven't heard back by then, we'll start the recovery with the registrar and the host directly, using our contract and invoices.
Common questions
How long should we wait before treating the developer as gone?
Long enough to rule out the ordinary reasons, and no longer. A week of silence across two channels, after a message that plainly needs an answer, is enough to start the checks above. The domain's expiry date matters more than the waiting: if it's inside 60 days, start today.
Can the registrar give us the domain if the developer won't answer?
If your company is listed as the registrant, usually yes, through the registrar's account recovery process, with ID and business documents. If the developer is listed as the registrant, the registrar treats the domain as theirs, and moving it needs their authorization or legal paperwork. When the lookup is redacted, the yearly registration reminder in company mail, or a test message through the registrar's relay, tells you which case you're in.
Will the hosting company give us access?
If the account is in your company's name and its login email is a company address, yes, through its normal password reset. A company card alone isn't a way in. Otherwise it's the host's ownership process, and both of Bluehost's routes above are slow, which is why the full-site copy and the domain come first.
What if the website goes down before we get access?
If you hold the registrar account, you can point the domain at a new host with a simple holding page. If the DNS sits in the developer's Cloudflare or hosting account, keep company email working: before changing nameservers, look up the records you can query, meaning the website and www, MX, the TXT records on the root (SPF lives there), and any subdomains you know. A lookup can't list a whole zone, so DKIM and other service records come from your email provider's and each tool's setup pages. Then rebuild from the migration file, or the Wayback Machine copy and your own files. If the domain has already expired, ICANN's policy lets the registrant renew it during the renewal period.
Do we need a lawyer?
Not to start. The lookups, the money trail and the written request settle most cases. A lawyer earns the fee when the developer is the registrant and refuses, or when a host asks for legal documentation, and either way the contract, the invoices and the dated request are the first things they'll ask to see.