Your developer is gone: how to take back your WordPress site, domain and hosting

Taking over a WordPress site from a previous developer means getting every account that runs the website into your business's name: the domain, the DNS, the hosting, the WordPress admin, the backups and the paid plugin licences. Business owners usually discover this only when something breaks and the developer or agency does not reply. Threads on the WordPress.org support forums and small-business forums describe the same pattern again and again: a domain registered in the designer's name, a site on the designer's hosting account, or an admin login that was never handed over. This guide shows you how to find out what you actually control, in about twenty minutes, and how to recover the rest.

What "owning your website" actually means

Owning your website means the business, not a person, is the named holder of each account the site depends on. The WordPress files are only one piece. If any account in this table is in someone else's name, they can take the site offline, often without meaning to, simply by not renewing it.

Find out where you stand in 20 minutes

You can check most of this yourself today without logging in to anything. Write down what you find; you will need it later.

1. Look up your domain. Go to ICANN Lookup and type your domain. Note the registrar (the company the domain is registered with), the expiry date and the nameservers. Since 28 January 2025, ICANN has used the RDAP system as the official source of this data for generic domains, replacing the old WHOIS service. Owner names are often hidden for privacy, but the registrar and expiry date are shown.
2. Search your inbox and accounts payable for the registrar's name and the words "renewal", "hosting", "invoice", "domain". If the business has never paid a registrar or host directly, the developer almost certainly holds those accounts.
3. Read the nameservers. Names like ns1.yourhost.com point to the host; names ending in cloudflare.com mean DNS is at Cloudflare. That tells you which account controls DNS.
4. Check your WordPress access. Can you log in? Do you see Plugins and Users in the menu? If not, read our guide to being locked out of WordPress admin.
5. Look for licence receipts for page builders and premium plugins. If none came to the business, they were bought on the developer's account.
6. Check Google accounts. In Google Analytics and Search Console, see whether any business address has owner or administrator access.

The result is a simple list: accounts the business holds, accounts the developer holds, and accounts nobody can find. That list is the whole project.

The domain comes first

The domain is the one account you cannot rebuild. A new host and a rebuilt site are a cost; a lost domain can mean a new business address, new email, and lost search rankings. So check the expiry date before anything else.

For generic domains such as .com, .net and .org, ICANN's Expired Registration Recovery Policy sets the minimum rules every accredited registrar must follow:

• The registrar must send the registered holder at least two expiry notices, one about a month before and one about a week before. If the developer is the registered holder, those notices go to them.
• After expiry, the registrar must interrupt the domain's DNS for at least the last eight days the domain can still be renewed, so the website and email stop working. Many owners first learn of the problem this way.
• After deletion, registries of generic domains must offer a 30-day Redemption Grace Period during which the previous holder can still restore it, usually at an extra fee.

Country domains have their own registries and rules. A .ca domain, for example, is governed by CIRA, which has its own eligibility and renewal policies, so ask your registrar what applies.

If the domain is registered in the developer's name, ask them to change the registrant to the business, or to transfer the domain into an account the business opens at a registrar of your choice. They will need to remove the transfer lock on the domain and give you the transfer authorisation code (sometimes called the EPP or auth code). Registrars can apply a temporary lock after some ownership changes, so do this well before the expiry date, not in the last week.

Hosting: three situations, three answers

Your next step depends on whose name the hosting account is in.

The WordPress.org forums have a long history of this exact question. In one thread about a domain held in a departed designer's name, the advice was that a domain transfer does not depend on moving the hosting first, and that the designer could hand over copies of the theme, plugins and database straight away. That is good advice in general: the domain, the hosting and the files are separate, so do not let one hold up the others.

How to ask for the handover

Ask once, in writing, with a specific list and a reasonable date. Vague requests such as "can you send us our website" stall. A list does not.

Here is a message you can adapt:

Hi [name], we are moving support of our website to a new provider and need everything transferred into the business's name. Please could you send or arrange the following by [date, two weeks out]:

1. Domain: change the registrant to [business name, email], or remove the transfer lock and send the transfer code.
2. Hosting: move the site to an account in our name, or send a full backup of the files and database.
3. DNS: an export or screenshot of all DNS records, including email records.
4. WordPress: an administrator login for [company email].
5. Licences: a list of every paid plugin and theme, and whether the licence is yours or ours.
6. Google Analytics, Search Console and Tag Manager: add [company email] as owner or administrator.
7. Any custom code not on the server, such as a Git repository.

If there are unpaid invoices for this work, please send them and we will settle them. Thanks for your help.

Two points about tone. First, many developers are not hiding anything; they are busy, or they have moved on and forgotten the site. Second, if money is genuinely owed, paying it is usually the fastest way to the handover. Check your contract first: it may say who owns the domain, the code and the accounts.

If they will not reply

Most handovers happen once someone asks clearly. When they do not, work from what you control.

1. Hosting in your name: the host can verify you and reset access. Everything else can be fixed from there.
2. Domain in their name, still active: contact the registrar, explain the situation, and ask what evidence they accept. Policies vary. If it becomes a dispute, get legal advice; a lawyer's letter often moves things that emails do not.
3. Hosting in their name, site still up: a developer can often rebuild a site from what is publicly visible, but a public copy does not include the database, users, orders or form entries. Act before the site goes down.
4. Licences in their name: buy your own licence. It is usually cheaper than chasing the old one, and it puts security updates back in your hands.
5. Google accounts: Search Console lets a new owner verify the site with a DNS record or a file, so once you control DNS or hosting, you can claim it.

For the developer taking over: the first-day checklist

This section is for whoever takes the site on. The rule is: copy first, change nothing, then look. Many takeover sites have never been audited, and some have been compromised for months.

# 1. take an off-server copy before touching anything
wp db export takeover-$(date +%F).sql
tar -czf takeover-files-$(date +%F).tar.gz --exclude=wp-content/cache .

# 2. versions and integrity
wp core version
wp core verify-checksums
wp plugin verify-checksums --all
wp eval 'echo PHP_VERSION, PHP_EOL;'

# 3. who has access
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered

# 4. plugins and themes, including inactive ones and pending updates
wp plugin list --fields=name,status,version,update_version
wp theme list --fields=name,status,version,update_version

# 5. code that loads on every request and is easy to miss
ls -la wp-content/mu-plugins
grep -nE "DISALLOW_FILE_MODS|AUTOMATIC_UPDATER_DISABLED|WP_AUTO_UPDATE_CORE" wp-config.php

# 6. scheduled tasks
wp cron event list

wp plugin verify-checksums only works for plugins from the WordPress.org directory; premium plugins will report that they cannot be verified, which is expected.

Then record what is outside WordPress:

# DNS records to keep: web, email and verification
dig +short NS example.com
dig +short A example.com
dig +short MX example.com
dig +short TXT example.com
dig +short TXT _dmarc.example.com

Save that output before any DNS move. Losing the MX or SPF records during a transfer is the most common way a takeover breaks the client's email.

Finally, close the old doors once the business has its own logins:

• Change the hosting, SFTP, database and WordPress passwords, and remove the previous developer's SSH keys and SFTP users.
• Run wp config shuffle-salts to log everyone out.
• Remove the former developer's WordPress account with wp user delete ID --reassign=NEWID so their posts move to a current user.
• Note every premium plugin and whose licence it runs on.

If the integrity checks show modified core files, PHP files in wp-content/uploads, or administrators nobody recognises, treat it as an incident and follow how to fix a hacked WordPress site. Our WordPress security audit checklist covers the full review.

What this situation does NOT mean

When to hand it over, and what to gather first

Bring in help when the domain is close to expiry, the hosting is in someone else's name, the developer has not replied in two weeks, or you simply want it done properly once. Before you contact anyone, gather:

• The ICANN Lookup result for your domain: registrar, expiry date, nameservers.
• Any invoices or emails from a host or registrar.
• Every login you do have, even partial ones.
• Your contract or quote with the previous developer.
• Copies of the handover request and any reply.
• A list of what the site must keep doing: forms, bookings, store, email.

If you are choosing someone new, our guide to hiring a WordPress developer covers what to put in the contract so you are never in this position again. The short version: every account in the business's name, every contractor on their own login, and a written list of what was handed over.