Developer disappeared: how to take back your site and hand it over to support

Your developer has not replied for three weeks, and you need to change the phone number on the website. Or you decided to change contractors and found out that only the previous one has the hosting password. Below, we explain how to check who owns the domain and hosting, what to do if the domain is registered to the developer (taking into account the rules of the .ua domain zones) and what the new team checks when you hand the website over for support.

Website access: what you should have

A website has more than a dozen separate access points. Before you talk to the developer, fill out the table and mark each row: have access, no access, do not know.

Separately, list the services connected to the website: payment processing, CRM, delivery services, SMS messaging. Each of them works through a key or an account that the developer may have registered in their own name.

If the domain and hosting are registered to your company, you get the admin panel, database, files and Search Console back through them. The hardest case is when the domain registrant is the developer.

Domain: who owns it and how to get it back

What WHOIS shows

Check domains in the .ua zones (.ua, com.ua, kiev.ua and others) with WHOIS on the Hostmaster website, the administrator of the .UA domain. For .com and other international zones, there is the official ICANN Lookup service (lookup.icann.org).

Three fields matter:

• registrar is the company that manages the domain;
• expires is the date until which the domain is paid for;
• nserver lists the DNS servers of the domain. They show where the domain records are edited: at the registrar, at the hosting provider or in Cloudflare.

The registrant data is hidden, and the field will say “not published.” Only the registrar can tell you who the registrant is, after you contact its support with your company documents.

Check the expiration date first

Look at the expires field before you start writing to the developer. An expired domain is more dangerous than a contractor who will not hand over a password: together with the domain, you lose email, links and search rankings.

In the zones of the Hostmaster registry (.UA, com.ua and others), a domain does not disappear on its expiration date. Under the registry rules, it stays in DNS for another 30 days with auto-renewal status. If the registrar has deleted the domain, it can be restored through the same registrar during the next 30 days, and then the domain is deleted for good. For .UA, a restoration request must be submitted no later than 14 days before the end of this period: requests are reviewed manually, and the domain may be deleted before the request is processed. Registrars have their own terms and prices at each stage, so do not count on this buffer.

Some providers accept payment without logging in to the account. At ukraine.com.ua, this is called anonymous payment. This lets you renew the domain while negotiations are underway.

If you are the registrant

The login and email for the registrar account stayed with the developer. Write to the registrar’s support team and attach the details of your FOP or legal entity and documents confirming your authority. The registrar will verify that the request comes from the real registrant and restore access to the account. Then change the account email to a corporate one and turn on two-factor authentication.

If the developer is the registrant

Without the developer’s cooperation, such a domain usually will not pass to you (the exceptions are a .UA domain that matches your trademark and a dispute under the UA-DRP procedure; more on them below). A voluntary transfer is possible in two ways.

1. Change of registrant at the same registrar. For .UA, Hostmaster describes domain redelegation: you need written applications from the current and future registrants and certified copies of documents on the transfer of trademark rights or on a trademark license.
2. Transfer to another registrar. The registrar issues a transfer code to the registrant (in the Hostmaster rules, it is the domain object password, also known as the EPP code). In the Hostmaster registry, the code is valid for 30 days, after which it has to be requested again. A transfer changes only the registrar, and the developer remains the registrant, so right after the transfer, change the registrant to your company (for .UA, with the trademark documents).

The specifics of the .UA zone

A short domain such as company.ua is delegated only to the owner or licensee of a trademark protected in Ukraine, and the domain spelling must match the trademark. For com.ua, kiev.ua and other public domains, there is no such requirement.

If the trademark belongs to your company, your position is strong. For example, to transfer a .UA domain, ukraine.com.ua asks for an application and a notarized copy of the trademark certificate, contacts the current owner and moves the domain to your account if the owner does not raise substantial objections. If the trademark is not registered to you and the .UA domain is registered to the developer, go to a lawyer: the matter will have to be settled based on the trademark documents.

For disputes over .UA, com.ua and a number of other .ua zones (kiev.ua, org.ua, many regional ones; the full list is on the Hostmaster website), there is an out-of-court UA-DRP procedure: disputes are handled by the WIPO Arbitration and Mediation Center, and the complainant must hold trademark rights. A lawyer will tell you whether it suits your case.

Developer-owned hosting: admin panel and code

A provider gives access only to the account owner. The ukraine.com.ua knowledge base states it plainly: only the owner of the services can get access to the hosting or domain, and outsiders will not get even a backup of the website. That is why, whenever you have any access to the hosting, make a backup right away. The same source says that when a domain is transferred to you, the hosting stays with the previous owner.

How to find out who holds the hosting:

• provider emails, invoices and payment records in your accounting department show who paid and where;
• the domain DNS records: the A record points to the server IP address, which tells you the provider;
• the contract with the developer: sometimes hosting is listed in it as a separate service.

If the hosting is yours but you have no access to the admin panel, you can reset the password without the developer. In WordPress, the “Lost your password?” link helps only if the administrator email is yours. Otherwise, the password is changed through the database, WP-CLI or FTP. These methods are listed in the official WordPress guide. On other CMSs, administrator access is also restored through the database and website files. Leave database edits to a specialist.

If the developer kept the project in Git, the repository may hold things that are not on the server: style and script sources before the build, the change history, deployment settings. On GitHub, only a repository administrator can transfer a repository; the history and issue discussions are kept, and old links redirect to the new address. If the developer has disappeared completely but the hosting is accessible, the code is taken from the server, without the change history.

A website on a website builder (Tilda, Wix and the like) is stored inside the builder account, and only someone who can log in to that account can transfer it. In Tilda, a website is transferred from its settings with the “Transfer site to another account” action, and only to a paid account. If the account owner does not respond, the only option is to copy the texts and images from the published website and build it again, on a website builder or a CMS.

What to do if the developer has the access

We recommend this order of steps even if the developer will most likely turn up in a week.

1. Fill out the table from the first section. Write down what you know about each access point, with dates.
2. Check the domain and hosting expiration dates. If less than a month is left, renewal matters more than negotiations.
3. Do not change DNS. Changing the domain DNS servers (the nserver field) without a copy of the old records breaks email, ownership verification in Google services and the SPF record, without which emails from your domain land in spam more often.
4. Back up everything you have access to. Files, the database, an export of orders and customers from the admin panel, texts and images. Store the backup outside the hosting.
5. Send the developer a written request. What to include is described in the next section.
6. If there is no reply, contact the registrar and the hosting provider with your documents, but only for the services registered to you. The contract, signed acceptance certificates, invoices, payments from your account, correspondence about the work and company details will be useful. The provider will not give you access to the developer’s account, so negotiations and a lawyer are the only options left.
7. Bring in a lawyer if the developer refuses or sets conditions. A demand to “pay extra first” is already a dispute, and it should not be handled in a messaging app. Do not pay “for returning access” right away: check your table and find out what the developer actually has. Sometimes they only have an old hosting password, and the domain is registered to you.
8. Change passwords and delete other people’s accounts only after making a backup. After a failed password change, the provider or the previous account owner may lock you out, and there will be nothing to copy from.

If you have nothing at all (no domain, no hosting, no backup), the website will have to be rebuilt. The public part (texts, images, URL structure) can be taken from the live website or from the archive.org web archive. Orders, customers and settings from the back end cannot be recovered this way. Keep the URL structure: without redirects from the old pages to the new ones, search rankings will be lost.

How to request a handover from the developer

A developer often disappears without any ill intent: they changed jobs, moved away, took offense at a late payment or forgot that they hold your domain. So write the first email calmly and specifically. Instead of “give us access,” list what you need:

• domain: the registrar and the login to the registrar account; if they are the registrant, consent to change the registrant or a transfer code;
• hosting: the provider, access to the hosting control panel, FTP/SFTP, SSH; if the account is theirs, a recent full backup of the website and database;
• admin panel: the login URL and an administrator account tied to your email;
• Google Search Console, Analytics, Tag Manager, Merchant Center: owner or administrator rights for your Google account;
• ad accounts: administrator rights for your account;
• repository: a transfer to the company account or an archive with the history;
• licenses for paid plugins, themes and modules;
• a list of custom modifications, scheduled tasks (cron) and connected services with their keys;
• a response deadline, for example, five business days.

Send the request by email, even if you usually communicate on Telegram: the registrar or a lawyer will need the correspondence. Ask for the database with customer data to be sent as an archive over a secure channel, not as an attachment in a messaging app.

We deliberately give no legal advice here: who owns the rights to the code and design is determined by your contract and the law. If you cannot reach an agreement, show the contract to a lawyer before sending any claims to the developer.

Search Console and Analytics without the developer

Search Console. Anyone who verifies ownership becomes an owner of the property. A domain-level property is verified only through a DNS record, so first get your DNS access back. Google states this explicitly: once you have verified ownership, you can remove the previous owners. Removing the previous owner from the list is not enough: as long as their verification code (an HTML file in the website root, a meta tag in the page code, a TXT record in DNS), their Google Analytics tag or their Tag Manager container remains on the website or in DNS, they can verify ownership again. Delete their codes and replace the third-party tag and container with your own.

Google Analytics 4. Only an administrator can add users. If no administrator has access, Google describes a recovery procedure: you upload an analytics.txt file to the website with the specified text, an email address, the measurement ID (in the G-XXXXXXX format) and a date, and then contact support through a form. You need to prove ownership of all websites and apps that send data to the Analytics account and of the linked Google Ads accounts; partial verification is not enough. You can create a new property in your own account, but the history will stay in the old one.

Google Tag Manager. The same page notes that Tag Manager has no such procedure. If the container belongs to a developer who does not respond, create a new one in your own account, set up the tags again and replace the container code on the website.

Taking over a website for support: what is checked

A website that nobody has maintained for years can break on the first update. That is why nothing is updated on the first day: the check comes first.

Access and backups

The team makes sure that all access points from the table work and are registered to you, and then checks the backups: where they are stored, when the latest ones were made and whether they can be restored. An archive that has never been test-restored on a staging copy may turn out to be empty or corrupted. A backup plugin that saves archives to a folder on the same server will not help either: if the server fails, both the website and the archives will be lost.

CMS, PHP and database versions

Benchmarks at the time of publication:

• WordPress. The current release is 7.1.4; in the 7.1 branch, wordpress.org supports only the latest version. The recommended environment is PHP 8.3 or higher, MySQL 8.0+ or MariaDB 10.11+.
• PHP. The 8.1 branch stopped receiving security fixes on December 31, 2025, and the 8.2 branch will stop on December 31, 2026. For details on dates and steps, see the article “PHP 8.1/8.2 end of support”.

A website on PHP 7.4 with an old CMS is not moved to new versions on the first day: the update plan is drawn up right away, and the update is carried out after a backup and a check on a staging copy of the website.

Plugins, modules and third-party edits

The team looks for:

• plugins and modules that have not been updated for a long time or have been removed from the directory;
• “nulled” paid plugins, which are cracked copies without a license: they do not receive updates and are often infected;
• edits made directly in the core files or the parent theme.

WordPress recommends making changes through a child theme. If the developer edited the parent theme directly, the first theme update will wipe out those edits, so they are found and moved first.

Security

The team checks the list of administrators (unknown accounts are common), suspicious files and strange redirects. The debug log gets separate attention: WordPress writes it to the wp-content/debug.log file, and the documentation advises against enabling debugging on a live website. The log can contain file paths and fragments of data that outsiders should not see. If there are clear signs of hacking, order a full website security audit.

Then, as in step 8, the team changes the administrator, database and FTP passwords, deletes the previous contractor’s accounts and revokes their SSH keys and API keys in the connected services.

Server, email and SEO basics

• Who owns the server, whether there is enough disk space, what tasks are scheduled in cron and when the SSL certificate expires.
• Whether SPF and DKIM are set up for the domain email. Without them, emails from the website land in spam more often.
• Where form submissions go. Sometimes a copy of every request has been going to the developer’s email for years.
• Whether the website is blocked from indexing. In WordPress, this is the “Discourage search engines from indexing this site” checkbox under “Settings → Reading”, and people sometimes forget to clear it after launch.
• robots.txt, the sitemap, redirects and indexing errors in Search Console.
• The payment module: whether it was left in test mode after launch.
• A test request and a test order from a phone: whether the email arrives, whether the payment goes through and whether the mobile version breaks. Loading speed is measured in Google PageSpeed Insights.

As a result, you should get a short document: where the website is hosted, who has which access, what was found, what to fix urgently and what to plan.

Improve or rebuild

We recommend improving the website if it runs on a common CMS (for example, WordPress), the problems are local and the website brings in leads and holds its search rankings. A rebuild is worth discussing in three cases:

• the website runs on a custom-built system, and there is no source code or no one can figure it out without its author;
• the CMS and PHP are so old that the update would take as much work as new development;
• the structure and design no longer fit the business.

If you rebuild, keep the page URLs or set up redirects from the old URLs to the new ones, otherwise search rankings will be lost.

How to avoid this situation in the future

There is one rule: everything that costs money or affects business operations is registered to the company, and the contractor gets access as a user.

• Register the domain to your company or FOP, and the registrar account to a corporate email that stays with you after any employee leaves.
• Rent hosting or a server under your own account; give the developer a separate user or key, not your password.
• In the admin panel, each person has their own account. With one shared admin account, you cannot tell who changed what or disable one person without changing the password for everyone.
• Create Search Console, Analytics and Tag Manager from your own Google account, and give the contractor user rights.
• Buy paid plugins and modules with your own email.
• Store passwords in a password manager, and turn on two-factor authentication at the registrar and the hosting provider.
• Once a quarter, check that a backup exists, is recent and is not stored on the same server.
• In the contract, list what the contractor hands over when the work is finished: code, access, documentation, backups. Agree on the wording about code ownership with a lawyer.

If the contractor objects to this setup, ask why: they have no technical reason to keep the domain and hosting in their own name.

FAQ

Can I take back the domain if the developer does not respond? If the registrant is your company or FOP, yes: the registrar will restore access to the account based on your documents. If the registrant is the developer, their participation is usually needed; the exceptions are a .UA domain that matches your trademark and the UA-DRP procedure. While you are corresponding, watch the expires date and, if possible, renew the domain with an anonymous payment.

How long should I wait for a reply before taking action? Do not wait at all. Check the domain expiration date and make a backup on the very first day, in parallel with sending the email.

Will we lose search rankings when changing contractors? Changing contractors in itself does not affect rankings as long as the domain and page URLs stay the same. The risk appears when the website is rebuilt or the domain changes, and then you need redirects from the old URLs to the new ones.

How RIVERIT can help

We provide technical support for WordPress websites, as well as Laravel and Django projects. Servers (VPS or dedicated) are rented under your account: the account and payments stay with you, and we handle server administration. Support includes CMS and plugin updates (usually once a month), backups, website and domain monitoring and technical SEO; for clients on support, the response time is within one hour during business hours. Domain and hosting renewal is not included in support: these services are registered to your company, and you pay for them. If we find traces of hacking during the handover, we will handle hacked website recovery and offer a security audit.