The website is still online, but the person who built it no longer replies. This is stressful because the visible website is only one part of what the business may depend on: the domain, DNS, hosting, source code, database, email delivery, licences and third-party accounts can all have different owners.

Do not begin by changing everything. Begin by establishing what the organisation already controls.

First: protect the business records you have

Collect invoices, contracts, renewal emails, project handover documents and messages that mention the domain, hosting or website accounts. Save them somewhere controlled by the company.

Search company email for terms such as:

  • domain, registrar, DNS or nameserver;
  • hosting, server, cloud or cPanel;
  • WordPress, Drupal, Laravel, Strapi or CMS;
  • GitHub, GitLab, Bitbucket or repository;
  • SSL, CDN, Cloudflare, analytics, payment or SMTP.

These records often reveal the providers even when nobody remembers the setup.

Identify the ownership layers

Build a simple table with four columns: asset, provider, current owner and access status. Include at least:

  1. Domain registration
  2. DNS
  3. Hosting or cloud account
  4. CMS administrator access
  5. Source-code repository
  6. Database and file backups
  7. Analytics and search tools
  8. Forms, email delivery and CRM
  9. Payment, maps and other third-party integrations

“The website login works” does not mean the company controls the domain or hosting. Each layer needs its own answer.

Use provider recovery processes

If access is missing, contact the relevant provider using an authorised company email and the evidence it requests. Avoid asking a new developer to “break into” an account or work around ownership checks. Legitimate providers have recovery and verification processes precisely because these services are valuable assets.

If an account belongs to a former employee or vendor, ask the provider what documentation is needed to transfer control. Keep the communication in company records.

Do not share passwords in a general enquiry

A website specialist can begin with the public URL and your ownership map. When access is needed, use individual accounts, provider invitations or a secure credential-sharing method. Do not paste administrator or hosting passwords into an ordinary contact form or email thread.

Establish a backup before routine changes

Once authorised access is recovered, create or verify a backup before updating plugins, dependencies or configuration. An undocumented website may contain custom code that does not tolerate a rushed “update everything” action.

The first technical review should identify:

  • the platform and current version;
  • custom themes, modules, plugins or packages;
  • available environments and deployment method;
  • forms and business-critical journeys;
  • known errors or compromise indicators;
  • whether the website is on a supported software branch.

Separate takeover work from ongoing maintenance

The site may be ready for routine care, but it may first need stabilisation. Typical one-off work includes access transfer, overdue updates, backup setup, unsupported component replacement, malware recovery, repository reconstruction or hosting changes.

Ask a new support team to label these separately. That prevents an apparently simple maintenance arrangement from hiding an unknown recovery project.

If the site shows signs of compromise

Treat suspicious redirects, unknown administrators, spam pages or browser warnings as an incident. Preserve the available evidence, contact the host if containment is urgent, and avoid installing random cleanup tools.

WordPress’s hacked-site guidance recommends documenting symptoms, checking the host and local computers, resetting access, creating a backup or snapshot, removing the compromise, updating software and changing passwords again afterwards. The details vary by platform, but the sequence matters: understand, contain, recover and harden.

The outcome you want

A successful takeover is not merely “the new developer can log in.” The organisation should know what it owns, where it is hosted, how it is backed up, how changes are released and who is accountable next time something goes wrong.

Sources