My WordPress developer has disappeared : how to take back control

First reflex: don’t break anything

When a developer stops answering, the temptation is to change everything at once. It is often the worst idea: a website that still works must keep working while you take back control.

• Don’t cancel anything: not the hosting, not the domain name, not the subscriptions linked to the site, until you know who owns them.
• Check the renewal dates: a domain name that is not renewed in time can be lost. This is the absolute priority.
• Keep a written record of your messages to the developer: e-mail first, then a registered letter if needed.
• Don’t reinstall WordPress or change the theme: you could lose settings or custom developments.

Take stock: who holds what?

A WordPress website relies on several accounts, often opened at different times. For each one, the question is the same: is it in your name, or in the developer’s?

The principle to remember: the domain name and the hosting are the two master keys. With them, everything else can be recovered.

5 steps to take back control

1. Contact the developer, in writing. Ask for the list of accesses and accounts linked to the site. Stay factual and polite: an amicable handover is still the fastest solution.
2. Secure the domain name. Check who owns it and when it expires. If it is in your name, change the password of the registrar account, the company where the domain is registered, and turn on two-factor authentication. If it is in the developer’s name, ask for a change of holder.
3. Take over the hosting. If the account is in your name, change its password and turn on two-factor authentication. If it is in the developer’s name, contact the host, or prepare new hosting in your name from a backup.
4. Recover WordPress access. With access to the hosting, an administrator account can always be restored: WordPress provides several official methods for this. Then create your own administrator account, change every password and remove the accounts nobody uses.
5. Take stock of the site. Make a full backup right away, files and database, stored away from the server. Then check the versions of WordPress, plugins and PHP, the licences, unknown administrator accounts and changes made in the code.

The 6 most common unpleasant surprises

• The domain in the developer’s name

  The trickiest case. Registering a client’s domain in their own name, for convenience, is a known practice. Getting it back requires the holder’s agreement, or a procedure.

• Lost licences

  Paid plugins and themes bought on the developer’s account stop receiving updates when the licence expires. They then have to be bought again in your name.

• A theme modified directly

  If the theme was changed without a child theme, the method that keeps changes safe, its next update will erase them. They must be identified before any update.

• No recent backup

  Some sites have no recent backup, or only one on the same server. After a failure or a hack, there is nothing to restart from.

• Overdue updates

  A site that is no longer updated piles up known security holes. Updates are first done on a copy, to check nothing breaks.

• Accounts nobody knows

  Forgotten administrator accounts, access left to former providers: each one is a way in. Clean them up as soon as you are back in control.

What about your contract?

Read your contract, quotes and invoices again: they often state what belongs to you, whether it is the site, its code or the accounts. In case of disagreement, get advice from a lawyer before starting any procedure.

So it never happens again

• The domain name and the hosting are in your name, with your e-mail address.
• You have your own WordPress administrator account, and each provider has theirs.
• Paid plugin licences are in your name.
• Your passwords are stored in a password manager.
• An automatic backup is stored away from the server, and you know how to restore it.
• Updates are done regularly, by you or by a provider.

The message to send your former developer

Polite, precise and dated, this message is often enough to unblock the situation. Send it by e-mail and keep a copy:

Hello,

I am taking back control of our website and I need to gather all the accesses related to it. Could you send me, or confirm:

• the account with the domain name registrar, and the name it is registered under;
• access to the hosting;
• an administrator account on WordPress;
• the list of paid plugins and themes, with their licences;
• recent backups, if there are any.

If some of these accounts are in your name, please tell me how to transfer them to the company’s name.

Thank you in advance for your help.

No answer after two weeks? Send it again by registered letter: you will keep a dated record of your request.

Prefer to hand it over?

Developer out of reach, an update that broke everything, a hacked site: I take over your website, put it back on its feet, then look after it. And all your accesses stay in your name.

Let’s talk about your site → See takeover and maintenance

Reply within one business dayFree quote

Frequently asked questions

Sources

• Resetting your WordPress password (official documentation)
• Afnic’s practical guide for domain holders (.fr, in French)
• Afnic’s form for changing the holder of a .fr domain (in French)
• Example of a holder change with a registrar (OVHcloud, in French)
• ICANN Lookup, the public directory of domain names
• Supported PHP versions (php.net)
• UDRP, the dispute procedure for .com and other generic domains (ICANN)