Blog

Your website is still online, but the only person with the passwords has stopped replying. That is stressful, especially when your business depends on contact forms, bookings or online orders, but it does not automatically mean you need to rebuild.

The safest approach is to recover control of the accounts behind the website, preserve what is already there, and make changes in a deliberate order. A WordPress login is only one piece of the puzzle: your domain, hosting, DNS and business email may each have separate owners and passwords.

Start by protecting what still works

If the website and email are working, resist the urge to cancel hosting, change nameservers or install a fresh copy of WordPress. Those actions can turn an access problem into an outage or permanent data loss.

Write down what is happening before changing anything. Record whether the site loads, whether you can receive business email, which accounts you can access, and any renewal or suspension notices you have received.

• Save contracts, invoices, payment receipts and correspondence with the developer.
• Check upcoming domain and hosting renewal dates.
• Take screenshots of important pages and any error messages.
• Look for existing backup files in business-controlled storage.
• Keep a dated record of recovery requests and provider responses.

A missing developer is not automatically evidence of a hack. Treat this as an account recovery problem unless you also see signs of unauthorized changes, suspicious users or malicious activity.

Understand the accounts you need to recover

“Access to the website” can mean several different things. Knowing which account controls what will save you from asking the wrong provider for help.

Domain registrar

The registrar manages the registration of your domain name. Its account typically controls renewals, registrant contact details, transfer settings and which nameservers the domain uses.

Control of a domain does not give you a copy of the website. It does, however, let an authorized account holder direct the domain to another hosting service once the replacement is ready.

DNS provider

DNS connects your domain to services such as your website and email. DNS management may be with the registrar, the hosting company or a separate provider such as Cloudflare.

A registrar login does not necessarily include access to the active DNS records. If another provider runs the nameservers, you need to identify and recover that account too.

Web hosting account

Hosting stores the website files and database. Depending on the setup, the account may also contain email mailboxes, backups, certificates and tools for managing WordPress.

Hosting access can often provide a legitimate recovery route when the WordPress password reset process is unavailable. It does not necessarily give you control of the domain registration.

WordPress administrator account

A WordPress administrator can normally manage site content, plugins, themes and users on a standard single-site installation. Multisite networks and customized permissions can work differently.

Being able to edit pages does not prove you have administrator access. Check your assigned role rather than assuming that any working WordPress login gives you full control.

Connected business services

Payment processors, booking systems, email delivery services, analytics and premium plugin subscriptions may sit outside WordPress entirely. Add these to your inventory, especially if losing one would interrupt sales or customer communication.

Find out who actually holds each account

Search your business inbox and accounting records for the domain name, “hosting,” “renewal,” “registration,” “cPanel” and “WordPress.” Check shared inboxes and ask authorized staff whether they have account invitations or credentials in a business password manager.

Public domain lookup tools can help identify the registrar and nameservers. For a .ca domain, CIRA’s domain lookup is a useful starting point, although privacy protections may limit the contact information shown.

Nameservers and public DNS records are clues, not definitive proof of who hosts the website. A CDN or proxy can hide the origin server, and a developer may have used a reseller account.

Create a simple inventory for each service:

• Provider name and account identifier, if known.
• Account holder and recovery email address.
• Whether your business has working access.
• Renewal date and payment responsibility.
• What evidence you have connecting the service to your business.

Send a clear handover request

Even if previous messages have gone unanswered, send one organized request through the developer’s usual business email or support channel. Ask for account ownership transfers or individual invitations rather than a bundle of shared passwords.

A practical request could say:

Please arrange a handover of our website accounts and files. We need business-controlled access to the domain registrar, DNS, hosting and WordPress, plus a complete website backup and details of any connected services or subscriptions required to keep the site working.

Please also identify upcoming renewals, developer-owned licences and any custom code or integrations that need special handling. Let us know what can be transferred and what needs to be replaced.

Give a reasonable response date and retain the message. If a domain is close to expiry or hosting is at risk of suspension, contact the relevant provider immediately rather than waiting for that date.

Recover WordPress access using the safest available route

If you control the administrator email address

Use the password reset option on the site’s normal WordPress login screen. Request the reset for your own authorized account and check spam or quarantine folders if the message does not arrive.

A missing reset email can be a delivery problem, not proof that the account is gone. Avoid repeated guesses, which can trigger security lockouts.

If another authorized administrator can still sign in

Ask that person to create a separate account for you using a business-controlled email address and the appropriate role. Avoid making a former developer’s personal account your permanent business login.

Once you have access, review the user list and confirm which accounts belong to current staff, contractors or integrations. Preserve relevant records before removing accounts, and take care when WordPress asks whether existing content should be reassigned or deleted.

If you control hosting but not WordPress

Ask the hosting provider about its supported WordPress access recovery options. Some hosting dashboards have WordPress management tools, while other situations require an authorized developer to reset access through server-side tools.

Take a complete backup before database-level changes. Avoid copying random SQL commands or uploading “emergency admin” scripts from forums, since they can damage the site or create a new security problem.

If two-factor authentication is blocking an otherwise valid login, use your saved recovery codes or the provider’s documented recovery process. Do not disable protection across the whole site just to solve one account problem.

Recover domain and hosting accounts through the providers

If your business is the account holder, use the provider’s official recovery process. Navigate to its official website yourself rather than trusting an unexpected recovery link in an email.

Providers may request identification, billing records, business registration documents or other evidence. Requirements vary, and an invoice from your developer alone may not establish ownership of the underlying provider account.

When everything is inside the developer’s account

A developer may host several clients under one account. The provider generally cannot give you access to that entire account because it could expose other customers’ websites and personal information.

Ask whether the provider has a process for verifying your entitlement to the specific site, arranging a separate account or preserving data while the issue is investigated. These are requests, not guaranteed remedies.

For a domain registered in the developer’s name, explain the circumstances to the registrar and ask which recovery or dispute process applies. A .ca domain is not automatically recoverable just because it matches your business name.

When ownership is disputed

Technical access and legal ownership are different questions. Your contract, payment status, intellectual property terms and account registration records may all matter.

If the developer is actively refusing a handover or claiming ownership, consider advice from a Canadian lawyer. Do not attempt to bypass access controls, impersonate the developer or use credentials you are not authorized to use.

Get a usable backup before moving anything

A complete WordPress recovery normally needs both the website files and the database. A dashboard content export alone does not recreate every plugin setting, theme customization, uploaded asset or integration.

Ask for a full backup that includes the files, database and any configuration information needed to restore the site. Keep backups in access-controlled storage because they may contain customer details, form submissions and sensitive credentials.

Have the backup restored in a private test environment before relying on it. Check key pages, images, forms, bookings and store functions, and prevent test copies from sending real customer notifications or processing live payments.

Our guide to How to Test WordPress Backups (and Why You Should) explains why a backup file is not the same thing as a verified recovery.

For WooCommerce, an older backup may omit recent orders and customer changes. Plan the final transfer around fresh data and a controlled cutover rather than overwriting a live store with an old copy.

Do not break business email while recovering the website

Website hosting and email hosting may share an account, but they do not have to. Moving the website does not automatically move mailboxes or preserve email routing.

Before changing DNS, save the existing records and identify which ones support email. That includes MX records and the relevant SPF, DKIM and DMARC records, along with any verification records used by connected services.

Changing nameservers without recreating the full DNS zone can interrupt email even when the new website works. Where appropriate, changing only the website’s address records can leave existing email routing untouched.

Use How to Point Your Domain to a New Website Without Breaking Your Email when planning that change. Keep the old hosting active until you have checked whether it still handles email or another required service.

Decide whether to stay, migrate or rebuild

Stay temporarily when the current setup is stable

If the site works and you can recover business-controlled access, there may be no immediate reason to move it. Recover ownership and backups first, then evaluate the hosting separately.

A rushed migration adds risk when the real problem is simply that one person held every password.

Migrate when access and a complete copy are available

A migration makes sense when the existing hosting arrangement remains dependent on an unavailable developer or cannot be transferred cleanly. Test the replacement before changing public DNS.

Ambrite’s Canadian cloud hosting includes free website migration. That does not bypass another provider’s ownership checks or recover data that nobody can lawfully access, so establish the available accounts and backups first.

Rebuild when recovery is not practical

If you control the domain but cannot obtain files, a database or a usable backup, rebuilding may be the realistic option. Public pages, original photographs and your own documents can help reconstruct the content, but they cannot recover private orders, users or application settings.

Check your rights to reuse designs, photographs and custom code. A public archive is not a complete backup, and it may not include everything you need.

Secure the handover without breaking integrations

Once control is restored, replace the single-person dependency with business-owned accounts and documented access. Rotate credentials deliberately, since changing a database password or API key without updating the connected application can take a working service offline.

• Use unique passwords stored in a business password manager.
• Enable two-factor authentication on hosting, domain, email and administrator accounts where supported.
• Store recovery codes somewhere authorized business owners can reach.
• Update account recovery details and remove obsolete delegated access.
• Review active sessions, application passwords and integration credentials.
• Confirm who pays for renewals and receives billing notices.
• Document developer-owned plugin licences that need replacement.

Do not immediately deactivate every unfamiliar plugin or cancel every subscription. A licence may belong to the developer, but the software may still be essential to forms, layouts or bookings while you arrange a replacement.

Use the WordPress Website Handover Checklist for Agencies to turn the recovered setup into a record your business can actually use.

Keep the next arrangement recoverable

Your business should hold the primary ownership account for essential services, with developers invited through separate accounts wherever possible. Keep an independent copy of critical backups and make sure another authorized person knows how to locate the access records.

Ongoing maintenance can handle updates, backups and monitoring, but it is not a substitute for account ownership. Ambrite’s WordPress maintenance plans work with other hosting providers, so changing hosts is not required just to arrange ongoing care.

If you need help assessing the situation, contact Ambrite by email with the website address, which accounts you control, and any urgent renewal dates. Do not put passwords in the initial message: first establish what access is needed and how to share it securely.

This article was written with the help of AI and reviewed by Ambrite. Pricing, features, and technical details may change, so always verify with official sources before making decisions.