My WordPress developer has disappeared: how to take back control

First rule: don’t break anything

When a developer stops answering, the temptation is to change everything at once. It is often the worst idea: a website that still works must keep working while you take back control.

• Don’t cancel anything: not the hosting, not the domain name, not the subscriptions linked to the site, until you know who owns them.
• Check the renewal dates: a domain name that is not renewed in time can be lost. This is the absolute priority.
• Keep a written record of your messages to the developer: email first, then a registered letter if needed.
• Don’t reinstall WordPress or change the theme: you could lose settings or custom work.

Take stock: who holds what?

A WordPress website relies on several accounts, often opened at different times. For each one, the question is the same: is it in your name, or in the developer’s?

The principle to remember: the domain name and the hosting are the two master keys. With them, everything else can be recovered.

5 steps to take back control

1. Contact the developer, in writing. Ask for the list of logins and accounts linked to the site. Stay factual and polite: an amicable handover is still the fastest solution.
2. Secure the domain name. Check who owns it and when it expires. If it is in your name, change the password of your account with the registrar (the company where the domain is registered) and turn on two-factor authentication. If it is in the developer’s name, ask for a change of holder. For a .fr, Afnic provides a form signed by both parties when the usual email validation is impossible, and a dispute procedure called SYRELI.
3. Take over the hosting. If the account is in your name, change its password and turn on two-factor authentication. If it is in the developer’s name, contact the host, or prepare new hosting in your name from a backup.
4. Recover WordPress access. With access to the hosting, an administrator account can always be restored: WordPress provides several official methods for this. Then create your own administrator account, change every password and remove the accounts nobody uses.
5. Take stock of the site. Make a full backup right away, files and database, stored away from the server. Then check the versions of WordPress, plugins and PHP (the server’s language), the licences, unknown administrator accounts and changes made in the code.

The 6 most common unpleasant surprises

• The domain in the developer’s name

  The trickiest case. Afnic mentions this case in its own guide: a provider who registers a client’s domain in the provider’s own name, for convenience. Getting it back requires the holder’s agreement, or a procedure.

• Lost licences

  Paid plugins and themes bought on the developer’s account stop receiving updates when the licence expires. They then have to be bought again in your name.

• A theme modified directly

  If the theme was edited directly, without a child theme (the method that keeps such changes safe), its next update will erase those changes. They must be identified before any update.

• No recent backup

  Some sites have no recent backup, or only one on the same server. After a failure or a hack, there is nothing to restart from.

• Overdue updates

  A site that is no longer updated piles up known security holes. Updates are first done on a copy, to check nothing breaks.

• Accounts nobody knows

  Forgotten administrator accounts, access left to former providers: each one is a way in. Clean them up as soon as you are back in control.

What about your contract?

Read your contract, quotes and invoices again: they often state what belongs to you, whether it is the site, its code or the accounts. In case of disagreement, get advice from a lawyer before starting any procedure.

So it never happens again

• The domain name and the hosting are in your name, with your email address.
• You have your own WordPress administrator account, and each provider has theirs.
• Paid plugin licences are in your name.
• Your passwords are stored in a password manager.
• An automatic backup is stored away from the server, and you know how to restore it.
• Updates are done regularly, by you or by a provider.

The message to send your former developer

Polite, precise and dated, this message is often enough to get things moving. Send it by email and keep a copy:

Hello,

I am taking back control of our website and need to gather all the access details for it. Could you send me, or confirm, the following:

• the account with the domain name registrar, and the name it is registered under;
• access to the hosting account;
• an administrator account on WordPress;
• the list of paid plugins and themes, with their licences;
• recent backups, if there are any.

If some of these accounts are in your name, please tell me how to transfer them into the company’s name.

Thank you in advance for your help.

No answer after two weeks? Send it again by registered letter: you will keep a dated record of your request.

Prefer to hand it over?

Developer out of reach, an update that broke everything, a hacked site: I take over your website, put it back on its feet, then look after it. And all your accounts stay in your name.

Let’s talk about your site → See takeover and maintenance

Reply within one business day

Frequently asked questions

Sources

• Resetting your WordPress password (official documentation)
• Afnic’s practical guide for domain holders (.fr, in French)
• Afnic’s form for changing the holder of a .fr domain (in French)
• ICANN Lookup, the public directory of domain names
• UDRP, the dispute procedure for .com and other generic domains (ICANN)