Former Web Designer Has Your Domain or Logins? How to Get Control Back

The designer who built your website has stopped answering. Or they have closed their business, moved on, or told you they will only hand things over if you pay a bill you dispute. Meanwhile the domain is renewing in their account, the hosting is on their server, and you do not have a WordPress admin login. You may have only realized this because the site went down or a renewal is coming up.

This is one of the most common and least discussed website problems, and it is usually fixable. Most designers are not holding anything hostage on purpose: they are busy, unwell, or never set things up in your name because it was easier at the time. This guide helps you work out what you already control, what you can recover without them, how to prove you are the owner, and what your options are if they refuse. Stay calm and polite throughout. A friendly handover is faster and cheaper than any formal route.

The legal points here are general information, not legal advice. Contracts, copyright and consumer law vary by country and state. If money, a refusal or a threat is involved, talk to a lawyer licensed where you operate.

What is happening

A website depends on a handful of separate accounts, and the designer may hold some, all or none of them. Each has its own owner and its own recovery path.

Piece	Who legally or contractually controls it	Can you recover it without the designer?
Domain registration	The registrant named on the registration, regardless of who pays or whose account it sits in.	Often yes, if you are the registrant. Hard if the designer registered it in their own name.
Registrar account	Whoever opened the account. A reseller account belongs to the designer.	Not the account itself, but the registrar may help a registrant move the domain out.
DNS hosting	Whoever holds the DNS provider account (registrar, host or Cloudflare).	Yes, by moving DNS once you control the domain.
Web hosting	The hosting account holder.	Only if the account is in your name, or by rebuilding elsewhere.
WordPress admin	Anyone with an administrator login.	Yes, if you can reach the hosting, files or database. Otherwise only with a working admin login.
Email	The mail provider account holder.	Depends where mail is hosted. Risky if it is on the designer’s server.
Google Analytics, Search Console, Business Profile, social	Account owners on each platform.	Usually yes, through each platform’s ownership and verification process.
Theme and plugin licenses	Whoever bought them.	Usually you buy your own; the code you already have keeps working.

Your first job is to fill in this table for your own site. It turns a vague crisis into a short list of specific tasks.

Step 1: Find out what you already control

The domain

Run your domain through our domain lookup tool. It reads RDAP, the modern replacement for WHOIS, and shows the registrar, the expiry date, the status and the nameservers. Write all of these down. The expiry date is your real deadline: if the domain expires and nobody renews it, you can lose it, so a renewal coming up soon moves this to the top of the list. The domain lifecycle cheat sheet explains what happens after expiry.

The registrant name and email are usually redacted for privacy, so RDAP rarely tells you whose name the domain is in. You can still find out:

• Search your inbox, including spam, for the registrar’s name. Registrars send renewal reminders and contact verification emails to the registrant. If you have received them, the domain is very probably in your name.
• Look at any old invoice from the designer. A line for “domain registration” at a set price suggests they bought it, possibly in your name.
• Contact the registrar. Most will not reveal the registrant to a stranger, but many have a form to contact the registrant and will tell you how to prove you are the registrant if you are.

The hosting

Our who hosts this site tool shows which company runs the server and which runs DNS and email. Then check your email and bank statements for that host. If you have ever paid them directly, the account may be yours and you can use their password reset or account recovery process.

Email

Look up your mail servers with the DNS lookup tool (MX records), or run dig +short MX example.com on your own computer. If the MX points to Google Workspace or Microsoft 365 and you have an admin login there, your email is safe regardless of what happens to the website hosting. If it points to the designer’s server, your mail depends on their goodwill, so plan that move early (Step 5).

WordPress

Try https://example.com/wp-admin/ with any login you have ever been given, and use the “Lost your password?” link with every email address you might have been registered under. If any account works and has the Administrator role, you can create your own admin account and export the whole site.

Step 2: Ask, once, clearly and politely

Even if the relationship has gone sour, a written, specific, friendly request is the single most effective step. It also becomes evidence that you asked reasonably if you later need a formal route.

• List exactly what you need: the domain moved to your own registrar account (or the transfer code and the lock removed), the hosting account transferred to you or a full backup of files and database, WordPress admin access, and any license or account details.
• Offer to make it easy: you will open the accounts, they only need to push the domain or send the code.
• Give a reasonable deadline, for example ten business days, and say you will pay any genuinely outstanding invoice once handover is complete, or settle a disputed amount separately.
• Do not threaten, insult or post about it publicly. That rarely speeds things up and can make a later dispute harder.

Our client access request email template lists every account and file to ask for. If there is a disputed bill, it is worth weighing honestly: paying a modest amount to get everything handed over today is often far cheaper than any of the alternatives below.

Step 3: Recover the domain

How you get the domain back depends on whose name is on the registration.

If you are the registrant but it is in their account

This is the most common setup and the most fixable. Under ICANN’s Transfer Policy for generic domains such as .com, the registrant is the person with the right to transfer the domain. The registrar must give the registrant the transfer code (EPP or auth code) within five calendar days of the request, or let the registrant generate it themselves, and must not refuse solely because of a payment dispute between the registrant and the registrar. That rule is about the registrar, not the designer, but it means the registrar has a route to help you.

1. Contact the registrar’s support, explain that you are the registrant and the domain sits in a reseller or third party account you cannot access, and ask how they verify a registrant. Expect to provide photo ID, business documents matching the registrant organization, and access to the registrant email address.
2. Once verified, ask either for an internal move (often called an account push or change of account) into a new account in your name at the same registrar, or for the transfer code so you can transfer it to a registrar of your choice.
3. Follow the domain transfer guide so that the website and email keep working during the move, especially if DNS is hosted in the account you are leaving.

If the registrant email address is the designer’s or no longer works, tell the registrar. Updating the registrant email is a change of registrant at many registrars and can trigger a 60 day transfer lock under the current ICANN rules. ICANN has adopted changes to the Transfer Policy, including shorter locks, that registrars will apply from a future date, so check your registrar’s current terms. An internal account move usually avoids the lock problem entirely.

If the designer registered it in their own name

Then, as far as the registrar is concerned, the designer is the owner. The registrar will not move it without the designer’s consent or a binding order. Your options are:

• Agreement. Ask the designer to transfer it, or to change the registrant to you. A short written agreement that the domain is yours and will be handed over helps everyone.
• The contract. If your contract or invoices say the domain was bought for you, or that all project assets belong to you on payment, a lawyer can use that in a formal demand letter.
• UDRP. If you have trademark rights in the name (registered or, in some cases, unregistered) and the designer is holding the domain in bad faith, for example demanding an inflated payment, you can file a complaint under ICANN’s Uniform Domain Name Dispute Resolution Policy with a provider such as WIPO. You must show that the domain is identical or confusingly similar to your mark, the holder has no legitimate interest in it, and it was registered and is being used in bad faith. Disputes between businesses and their former designers can be finely balanced, so get advice before filing. Country code domains have their own dispute schemes.
• Court. A court order binds the registrar. This is the slowest and most expensive route. Small claims procedures may help for low value disputes in some places; the options vary by country and state, so ask a lawyer licensed where you operate.
• Move on. If the domain is new and has little search history, registering a better one and redirecting your marketing can be the pragmatic choice. It is a business decision, not a defeat.

If the domain is about to expire

Ask the registrar whether you, as the registrant, can pay the renewal directly, or ask the designer to renew it now while you sort out the handover. Renewing does not give you control, but it buys time. If it has already expired, act during the registrar’s grace period or the redemption period, which the expired domain guide explains.

Step 4: Recover or rebuild the hosting and the site

If the hosting account is in your name

Use the host’s password reset. If the account email is the designer’s, contact the host, explain you are the account holder, and ask how they verify identity (often a billing detail, ID or the payment card). Once in, change the password, turn on two-factor, and remove the designer’s user or SSH keys if they are no longer working for you.

If the hosting is the designer’s

The host will only deal with its customer, the designer. Ask the designer for a full backup: every file in the site folder and a database export. If they agree, a migration is straightforward; see moving WordPress to a new host by hand. Ask them to keep the old site running until DNS has moved.

If you have a WordPress admin login but no hosting

You can take a full copy from inside WordPress:

1. Create a new administrator account for yourself under Users, Add New, with your own email.
2. Install a reputable backup or migration plugin and create a full backup (files plus database), then download it to your computer. If a plugin backup fails, our guide to backup and migration plugin failures covers the common causes.
3. At minimum, use Tools, Export to download all content as an XML file and download the media library.

If you have nothing at all

You can still rebuild. The public site is visible to anyone, and older versions may be in the Internet Archive’s Wayback Machine. Our guide to recovering a WordPress site with no backup shows how to recover text and images from public copies. Copyright in the design, code and photos depends on your contract and local law, so check your contract, or ask a lawyer, before you copy anything you did not supply yourself.

Step 5: Rebuild access everywhere else

Once you control the domain, many other services can be recovered by proving control of DNS.

• DNS. Before you change nameservers, copy every existing record so email and verification records survive. See website and email at different providers.
• Email. If mail lives on the designer’s server, set up a mailbox provider in your own name and follow moving email to a new provider without losing mail. Ask the designer for a mailbox export if they will provide one.
• Google Search Console. Verify the domain yourself with a DNS TXT record. As a verified owner you can see every owner and user, remove users, and remove another verified owner once their verification token (their TXT record or uploaded file) is gone. Google rechecks verification, so an owner whose token has been removed loses access.
• Google Analytics and Tag Manager. These belong to whoever created the account. If you cannot be added, create new properties in your own account and replace the tracking code. Old data stays behind, so ask the designer to add you as an administrator first if possible.
• Google Business Profile and social accounts. Each platform has an ownership request or business verification process for the real business. Use the platform’s own help pages, not a third party “recovery service”.
• Licenses. Premium themes and plugins licensed to the designer keep working, but you will not get updates through their license. Buy your own licenses and enter your keys, especially for anything security sensitive. See the inherited site takeover playbook for licenses, nulled software and the full audit.
• WordPress users. Once you have admin access, remove or downgrade the designer’s account, change every admin password and check for application passwords under each user profile.

Step 6: If they refuse or threaten you

• Do not retaliate technically. Do not try to log in to accounts that are theirs, guess passwords or change things on their server. That can create legal problems for you.
• Keep everything in writing and keep a dated timeline of requests and replies.
• Check your contract and invoices for who owns the domain, the site files and the design, and whether payment was conditional.
• Get advice. A short letter from a lawyer often resolves a stalemate. Ask about the right route where you are: demand letter, small claims, a domain dispute, or consumer protection. The options differ by country and state.
• Report threats. If the designer threatens to deface the site, delete data or harm your business, keep the messages and report them to the police and to the hosting company’s abuse team.

If none of that worked

If the registrar will not help you as the registrant, ask them in writing to explain why, and if they are an ICANN accredited registrar that is not following the Transfer Policy, you can file a complaint with ICANN Contractual Compliance. If the designer’s host is hosting your site without any agreement with you, you cannot force the host to give you the files, but you can tell them you are the owner of the content and ask them not to delete it while you resolve the dispute.

When you contact a registrar or host, send the domain, your RDAP lookup, proof of identity and of the business, invoices showing you paid for the domain or site, and a short description of what you need. Then work through the site takeover access inventory so you never end up here again. If a domain was changed or moved without anyone’s consent, see domain hijacked: how to recover, and for lost WordPress access see locked out of WordPress admin.