If your web developer disappeared, check the domain first. If it is registered in your name, everything else has a replacement path and you will get your site back. If it is registered in the developer’s name, that is the urgent problem, because the domain is the only asset here you cannot rebuild.
A client came to me on a Tuesday with a screenshot of a hosting expiry notice and no way to renew it. Here is what they had: a site still loading, a Facebook page, one old invoice, and a Gmail thread that had gone quiet six months earlier. Here is what they did not have: a single login. Not the hosting, not the domain, not the CMS, not even the email address the developer had used to set it all up.
I checked the WHOIS record first. The domain sat at Namecheap, and the registrant contact was the developer’s personal Gmail, not the client’s business. That made the client a guest on their own domain. The hosting I could have replaced in an afternoon. The domain I could not touch at all.
Most guides on this hand you a list of four things to track down. They are the right four things, listed in the wrong order, which matters when you have one hour and no idea where to start.
Whose name is on the domain?
When a web developer disappeared without handing anything over, the domain decides how bad the situation is. Run a lookup at ICANN’s registration data tool. Read three fields: who is listed as the registrant, which registrar holds the name, and when it expires.
That expiry date deserves a moment. A domain you do not control, approaching renewal, is the most urgent item on this entire page.
Here is why the domain sits above everything else:
| Asset | If you lose access |
|---|---|
| Hosting account | Replaceable. Move to a new host |
| WordPress admin | Recoverable in minutes once you control hosting |
| Files and database | Rebuildable from a copy, a backup, or archives |
| Content | Recoverable from the live site or Wayback Machine |
| Domain | Not replaceable. Someone else legally holds the name |
Everything except the last row is an inconvenience. The last row is your brand.
What if the registrant details are redacted?
Since GDPR, most registrant fields show nothing useful, and many domains also sit behind a privacy proxy service. That is not a dead end. The registrar is still shown, and the registrar is who you actually need to contact. Redacted ownership makes the next step slower, not impossible.
One more thing worth knowing before you plan anything. ICANN’s Transfer Policy locks a gTLD domain against moving to a new registrar for 60 days after it is first registered, for 60 days after any previous transfer, and for 60 days after a change of registrant. The first two cannot be shortened by anyone, including the registrar. The change-of-registrant lock can often be declined, but only at the moment the change is made, which is no help to you afterwards.
Country-code domains such as .co.uk, .ca and .au sit outside this policy and follow their own registry rules. ICANN’s GNSO Council voted in March 2025 to remove the 60-day lock, but registrars are still working through implementation, so it remains in force. Re-check the current position rather than assuming. (Accurate as of Q3 2026.)
Even with no lock in play, a registrar transfer needs three things at once: the domain unlocked at the current registrar, a valid transfer authorization code (you will see it called a TAC or an EPP code, they are the same thing), and someone able to open the registrant email to confirm the move. The transfer itself then takes about five to seven days. Miss any one of the three and nothing happens, which is why the email address turns out to matter more than the argument about who owns what.
Is the site still up, and what should I save right now?
This changes what you do in the next ten minutes.
If the site is still live, you have an asset and some time. Take a copy of it now, before any confrontation. You do not need credentials to save public pages, and a developer who feels cornered can take a site offline. Do this first and argue second.
Three ways to do that, none of which require a login:
- Run a full mirror with HTTrack on Windows, or
wget --mirror --convert-links --page-requisiteson macOS and Linux. This pulls the rendered HTML, CSS, images and structure into a folder you own. - Use Save Page Now at the Wayback Machine to force a fresh archive snapshot of your key pages today, rather than relying on whatever it happened to capture last year.
- Export your XML sitemap first so you know every page that exists. Without it people mirror the homepage and five obvious pages, then discover two months later that a landing page bringing in enquiries was never saved.
If the site is already down, recovery runs through archives and any backup sitting outside the developer’s control. The Wayback Machine will not give you your files, but it usually gives you text, structure and images to rebuild from. Our guide on what to check first during emergency website downtime covers ruling out the simpler causes before you assume the developer pulled it.
Either way, one instruction applies immediately: change every password you can still reach. The developer may still hold working credentials, and a soured relationship plus retained access is a bad combination. The WordPress security basics guide lists which accounts to rotate and in what order.
How do I find out who hosts my site without any logins?
Read the DNS records. This is faster than the bank statement method and almost nobody mentions it.
Run dig NS yourdomain.com on macOS or Linux, or nslookup -type=ns yourdomain.com on Windows. Any free DNS lookup tool in a browser does the same job. The nameservers usually name the host outright, and even when they point at Cloudflare rather than the host, that tells you Cloudflare sits in front and is another account to recover.
Then run the same lookup for MX records. Those name your email provider, which is the single item people forget until it stops working. If the MX records point at Google Workspace or Microsoft 365, your choke point is the domain verification record, and that lives with whoever controls the DNS.
Write down every provider this exercise reveals. You will contact several of them, more than once.
What do I need to get back, and in what order?
Work down the list. Each item is easier if you already hold the one above it.
1. The domain. Registrar, registrant, expiry date. Covered above.
2. The DNS. Whoever controls the nameservers controls where your traffic and email go, even without touching the hosting account.
3. The hosting. Check card and bank statements for recurring charges. GoDaddy, Bluehost, SiteGround, WP Engine, Kinsta and HostGator all show up in the transaction line. Those statements often reveal the registrar too, which helps when WHOIS is redacted.
4. WordPress admin. If you have dashboard access and nothing else, export your content immediately. Tools, then Export, then All content, then Download Export File, as set out in the WordPress export documentation. It costs two minutes and nobody can take it back afterwards.
One trap catches almost everyone here. That XML file holds your posts, pages, comments, custom fields and taxonomies. It does not hold your media library, your theme, your plugin settings or your database options. People watch a file download, assume the site is saved, and find out months later that every image is missing. Mirror the front end as well, and if you can reach the hosting panel, pull a full file and database backup on top.
5. Email. Business email frequently runs through the same hosting account. Losing it hurts more than losing the website.
Does paying the invoices prove the account is mine?
It is the strongest lever you have, and it goes almost unmentioned everywhere else.
Hosting companies restore access to the account owner after identity verification, and the person paying the invoices has a strong claim even when the account email belongs to someone else. Gather your evidence before you pick up the phone rather than during the call.
What to have in front of you:
- Bank or card statements showing you paid for the hosting or domain
- Your business registration documents
- Any contract, written scope, or invoice for the original work
- Trademark records, if the domain matches your brand name
What to say: you are the business owner, the website belongs to your business, you have been paying for the account, the person who set it up is unreachable, and you need ownership verified and access restored.
Contact the host and the registrar separately. They are usually different companies and each runs its own process.
The most common blocker is not the hosting. It is the email address the account was built on: an old Gmail, an inbox belonging to an employee who left, or the developer’s own address.
That single detail closes two doors at once. Every password reset goes to it, so self-service recovery is finished before it starts. And a registrar transfer runs through the registered name holder, which means the authorization code is issued to whoever controls that account and the confirmation emails land in that inbox. If nobody can open it, the transfer stops there no matter how clean your ownership claim is.
Verification through a human at support becomes the only route left. Say that in your first message rather than working through a reset flow that cannot succeed. It moves you to a person about three days sooner.
What if the domain is registered in my developer’s name?
Two things run in parallel, and separating them is what gets you back online quickly.
Start the registrar conversation today. Send the proof listed above and ask what their process is for a disputed registration. Be ready for an answer you will not like. Registrars generally do not arbitrate ownership disputes between two parties, and most will only move a domain on the registrant’s consent, a court order, or a formal dispute decision. Some are more helpful than that when the evidence is overwhelming, but plan for the strict version.
Where the domain matches a trademark you hold and the registration was made in bad faith, the formal route is a UDRP complaint rather than a support ticket. That is the mechanism that actually compels a registrar to move a name.
Filing with WIPO costs $1,500 for a single panelist covering up to five domains, and a standard case runs roughly 45 to 60 days from filing to decision. WIPO added an expedited track in 2026 at $4,000 that targets a decision in about a month. Other approved providers publish lower base fees, so compare before filing. Legal representation sits on top of all of that and commonly adds $3,000 to $7,000, and none of it is recoverable from the losing side. (Fees as of Q3 2026, confirm the current schedule before you file.)
Two caveats that decide whether this route is even open to you. UDRP requires trademark rights, registered or unregistered depending on the jurisdiction, so a business trading under a name that does not match its domain may not qualify. And a developer who registered the domain while doing the work is not automatically a cybersquatter, although panels have found bad faith where a contractor registered in their own name and then refused to release it. This is the point where a lawyer earns their fee.
Rebuild in parallel. Do not wait for any of that to finish before setting up hosting you control and getting a site ready to go live. Build it on a staging environment so it is tested before it faces the public, and our guide to migrating a WordPress site without downtime covers the switch when control returns.
On ownership of the work itself: in most client arrangements the content is yours, and having paid for a website generally gives you rights to the result. I am not a lawyer, though, and if the developer actively disputes it, a solicitor or attorney is the right call rather than another email.
How long does this actually take?
Here is the shape of the recovery I described at the top, where the domain sat in the developer’s name.
| Stage | Realistic time |
|---|---|
| Audit: WHOIS, DNS, hosting fingerprint | 1 to 2 hours |
| Copying the live site | 2 to 6 hours |
| Registrar dispute and ownership proof | 10 to 20 business days |
| Transfer, once approved | 5 to 7 days |
| Rebuild and DNS cutover | 3 to 10 days |
The first two rows happen on day one. The rebuild runs alongside the dispute rather than after it, which is the whole reason for doing both in parallel, so the dispute window is what actually sets the clock. Expect three to six weeks in total. If a 60-day transfer lock applies, add two months and accept that nobody can shorten it.
What happens if the domain expires while I am locked out?
An expired domain does not vanish at midnight. For .com, .net, .org and most other gTLDs it moves through three stages, and which one you are in decides both your cost and your clock.
| Stage | Roughly how long | What you can do |
|---|---|---|
| Renewal grace | 30 to 45 days after expiry, set by the registrar | Renew at the normal price, no penalty |
| Redemption | About 30 days after that | Only the registrant can restore it, and a registry restore fee applies on top of the renewal, commonly $80 to $200 |
| Pending delete | About 5 days | Nothing. No renewal, no restore, no purchase |
After pending delete the name drops and anyone can register it, which usually lands somewhere around 65 to 80 days after the original expiry date. Country-code domains run their own timelines and some offer no grace period at all. (Timings and fees as of Q3 2026.)
Two practical consequences. If you are close to regaining control, the expiry date is your deadline and everything else waits. If you have given up on the domain, the drop date is the one chance to buy your own name back at ordinary price, so put it in your calendar.
The honest worst case
If the domain is registered to someone who will not release it and will not respond, and no formal route succeeds, you may end up rebranding onto a new domain. That is rare, it is not the likely outcome, and pretending it never happens would be dishonest. If you reach that point, our guide to changing your WordPress domain name covers the redirect work and what the move actually costs you in traffic.
How do I stop this happening with the next developer?
Three rules, and none of them requires technical knowledge.
Register the domain yourself, in your business name, on an email address you control and will still have in five years. If a developer registers it for you, insist on being the listed registrant rather than a contact.
Give developers user roles, not ownership. They get administrator access on your hosting account and your WordPress install. The accounts stay in your name. This is standard practice and anyone reputable will expect it.
Keep your own backups, stored somewhere neither the developer nor the host controls. Our WordPress backup guide covers setting that up, and it is worth reading why restores fail before you need one, because an untested backup is not a backup.
One structural point the three rules do not cover. If one person disappearing can take your website offline, the problem is not that person. Ongoing WordPress maintenance under your own accounts removes the single point of failure, which is the actual fix.
Key takeaways
The domain decides how bad this is, so run a registration lookup before anything else. Redacted registrant details still reveal the registrar, and the registrar is who you contact. Read the nameserver and MX records in the same sitting, because they tell you who hosts the site and who runs your email without a single login.
If the site is still live, mirror it today, before any difficult conversation. Export your WordPress content the moment you have dashboard access. Change every password you can still reach.
Your payment history is the strongest lever with both hosts and registrars, so gather statements, invoices and business registration before you call. And if the domain sits in their name, start the formal route and rebuild at the same time rather than waiting for one to finish. Watch the expiry date throughout, because it is the only hard deadline in the whole process.
Frequently asked questions
How do I find out who hosts my website?
Look up your domain’s nameserver records with a DNS lookup tool, or run dig NS yourdomain.com in a terminal. The nameservers usually name the hosting company directly. Check the MX records in the same lookup, since those reveal your email provider, which is often a separate account you also need to recover.
Can I get my website back if my web developer disappeared and will not respond?
Usually yes, provided the domain is in your name or your business’s name. Hosting companies restore access to verified account owners, and paying the invoices gives you a strong claim. Gather bank statements, business registration and any contract, then contact the host and registrar separately.
What happens if my domain expires while I am locked out?
It moves through a renewal grace period of roughly 30 to 45 days where you can renew at the normal price, then about 30 days of redemption where restoring it costs a fee commonly between $80 and $200, then about five days of pending delete where nothing works. Treat the expiry date as your hard deadline.
How long does it take to recover a domain registered in a developer’s name?
Weeks rather than days. Registrars rarely move a domain without the registrant’s consent, a court order or a dispute decision. A standard UDRP case runs roughly 45 to 60 days from filing, and WIPO’s expedited track targets about a month. Start on day one and rebuild on hosting you control in parallel.
How much does it cost to rebuild a site I cannot access?
Two things move it: whether the live site still exists to copy from, and how much custom functionality sits behind it. Two recent recoveries invoiced at $800 and $2,500. A brochure site that still loads is the cheaper case; undocumented custom code costs more. Our WordPress repair cost guide has fuller ranges.
Can I move my site if I only have FTP access?
Yes. FTP gives you the files, and if you can also reach phpMyAdmin or any database export tool through the hosting panel, you have everything needed for a full migration. Without database access you still have the theme, uploads and plugin files, which is enough for a rebuild rather than a clone.
Need someone to untangle it with you?
Tracking down a registrar, proving ownership to a host and rebuilding a site you have never had access to is slow work, and it is worse when that site is your main source of enquiries. Survyc is an AI-first digital agency, and this is standard work here. The pattern from the job at the top of this page repeats: the hosting is the easy part, the domain is the fight, and a dead inbox is what actually sets the clock. We tell you honestly what looks recoverable and what does not before you spend anything, and we hand the finished WordPress build over under accounts in your name.
If your web developer disappeared and you are working out where to start, tell us what you are dealing with or email info@survyc.com.
Last reviewed: September 2026
