What to do when your web developer disappears
The person who built your website has gone quiet. Emails bounce or go unanswered, the phone rings out, and you're realizing you may not have a single password to your own site. Somewhere there's a domain with a renewal date, a hosting account on someone else's card, and an email setup you can't touch. This is a real emergency, and it has a clock on it, so the worst thing you can do is start with the part that upsets you most, getting the site back, instead of the part that expires first, the domain. Here's the recovery sequence in the order that actually protects you.
Work in the order things expire
Panic sorts your worries emotionally. Recovery sorts them by deadline. Some things you can fix any time; others, once lost, are gone or expensive to claw back. Handle them in this order:
- Domain name, first and always. If it lapses, your website and email addresses stop working and the name can eventually be registered by someone else. Everything else depends on it.
- Hosting, where your site's files live. Losing access is a problem, but hosting is replaceable and your content is often recoverable elsewhere.
- Email, if your business email runs on this domain or host. It's tied to the two items above.
- Site files and content, the actual pages. Usually the easiest to reproduce or recover from a backup or the web archive.
- Find the renewal dates first. Your deadline is set by whichever comes soonest, and that's usually the domain.
Find out who actually controls your domain
Your domain is the asset worth fighting for, so start there, and it costs nothing to check. Use ICANN's official Lookup tool at lookup.icann.org, or your registrar's WHOIS/RDAP search, and enter your domain. You're looking for four things:
- The registrar, the company where the domain is registered, such as GoDaddy or Namecheap. This is who you'll contact for recovery.
- The expiration date, your hard deadline. Write it down.
- The registrant, the listed owner. If privacy protection is on, this may be masked, which is normal and not a problem by itself.
- The status, codes like clientTransferProhibited that tell you whether the domain is locked against transfer.
Two scenarios, and why the expiry date rules everything
If the account is under your name or your business email, you're in a strong position: the registrar's standard account recovery can get you back in.
If the developer registered the domain under their own name or account, recovery is harder. You'll be asking the registrar to help you regain control or move the domain, and you'll need documentation to prove it's yours. ICANN's transfer rules also lock a domain against inter-registrar transfer for a period after registration or an ownership change, so a move may not be instant even once you're approved.
Either way, note the expiration date now and measure every other decision against it. A domain you own but haven't touched in years is still safe until it lapses; a domain in dispute that expires mid-fight is a far worse problem.
Identify and recover hosting and email
Once you understand the domain situation, find where the site is actually hosted. A DNS lookup, which any free online tool will run for you, shows the nameservers and points to the hosting provider; your email host shows up in the domain's MX records; and the site's footer or a "powered by" note sometimes names the platform too. The registrar, the host, and the email provider can all be three different companies, so map each one.
To get back into a registrar or hosting account you don't have the password for, use the provider's official account-recovery process rather than repeated login attempts, which can lock the account down further. Major US registrars and hosts have documented recovery paths that accept business documentation when you can't use the email or phone on file. Prepare your evidence before you start, follow the provider's recovery form or support flow exactly, and expect it to take time, because these reviews are done by real people, not instantly by software.
Save a copy of the site before anything breaks
While you sort out access, protect the thing customers actually see, your content. You don't need any logins for this.
- Check the Internet Archive's Wayback Machine at web.archive.org. Enter your domain and browse past snapshots; you can copy text, find images, and recover pages that may have changed or vanished. If your recent site isn't captured well, use its "Save Page Now" feature to archive the current live version immediately, before anything expires.
- Download whatever you can already reach, saving pages, images, and copy from the live site while it's still up.
- With a copy of your content in hand, you're no longer negotiating from zero. Even in the worst case, where you can't recover the old site at all, you can rebuild without writing everything again from scratch.
The evidence packet US support desks accept
Whether you're recovering an account or reporting a domain transfer you didn't authorize, support teams need to verify you're the rightful owner. Gather these before you contact anyone; a complete packet turns a weeks-long back-and-forth into a single review. Requirements vary by provider, so check the specific registrar's or host's recovery page for its exact list, but this is what's typically requested:
- Business formation documents, such as articles of incorporation or LLC formation papers.
- Your EIN confirmation letter from the IRS.
- Government-issued photo ID of the business owner.
- Proof you paid, including invoices, receipts, or card and bank statements showing charges for the domain or hosting.
- A business email address and phone number that match, or reasonably connect to, the account.
- Any written record with the developer, a contract if you have one, but also emails, texts, or invoices showing they built the site for you.
Disputes, no contract, and the honest fork: recover or rebuild
If the developer initiated a domain transfer you didn't authorize, know that ICANN's Transfer Dispute Resolution Policy governs disputes between registrars over transfers. It isn't a form you file yourself; it's the framework a registrar uses when an unauthorized transfer is reported, so raise it with your registrar's support team rather than trying to invoke it directly. And if you paid informally with no written agreement, which is common for US small businesses, your payment records and account documentation become your evidence. For a genuine ownership dispute, especially one involving money or a refusal to release the domain, talk to an attorney; this is a recovery playbook, not legal advice.
Eventually you'll face a choice: keep fighting to recover the old site, or rebuild fresh. A simple decision rule keeps it clear.
- If you control the domain, you've won the part that matters. The domain is the asset; the site is replaceable. Rebuilding on a domain you own is fast and clean, and you walk away with full access.
- If recovering the old site means weeks of support tickets for content you've already saved from the archive, rebuilding is often faster than waiting, and it fixes the lockout for good.
- If you don't yet control the domain, don't rebuild anywhere until that's resolved or you've secured a new domain. And never let the old domain lapse while you decide; renewing a domain you're fighting over is cheap insurance. Content can be rewritten, but a domain, once lost, can be gone for good, so spend your urgency there first.
Frequently asked questions
Can a web developer legally hold my website hostage?
It depends on who registered the domain, who paid for what, and any agreement you had. If the domain and hosting are in your name, a developer withholding access has little standing. If they registered everything under their own account and you have no contract, it's murkier, though your payment records still carry weight. Whether refusing to release something you paid for crosses a legal line in your specific case is a question for an attorney, not a blog post.
What happens if my domain expires while I'm locked out?
Expiration doesn't release the name instantly. There's usually a grace period right after expiry when you can still renew normally, then a redemption period where recovery is possible but costs significantly more, and only after that can the name be released to the public. The safe move is to renew before it expires if you have any access at all; waiting into the redemption period is expensive and risky.
How do I find out who my hosting company is?
Run a DNS lookup on your domain with any free online tool; the nameservers usually reveal the host. Your email provider shows in the domain's MX records, and a WHOIS or RDAP lookup identifies the registrar, which is where the domain lives and may differ from where the site is hosted. Between those three, you can map out every company involved.
Do I need the original developer to move or rebuild my website?
Not if you control the domain and have a copy of your content. With access to the domain's registrar and a backup, or pages recovered from the Wayback Machine, you or a new developer can point the domain to new hosting and rebuild without the original person's cooperation.
I never signed a contract. Do I have any rights to my site?
Often yes, but you'll prove them with evidence rather than a document. Payment records, business documentation, and account details showing the site was built for your business are what registrars and hosts use to verify ownership. For anything that becomes a genuine legal dispute, consult an attorney about your specific situation.
Karkium regularly takes over stranded projects like this, and structures every new build so you hold the domain, the hosting, and the logins from the start, with nothing that can walk out the door if a vendor does. Whether you're mid-emergency or making sure this never happens again, that's the work.