When a former web designer, freelancer or agency stops working with you, it is common to discover that key accounts were set up in their name, not yours. If you need to recover website access, start by treating each service separately. Your website may be live while the domain, hosting, DNS, email and analytics sit in accounts you cannot control.
This guide explains how to work out what you have actually lost, which systems to recover first, and what providers are likely to ask for before they will help. It also covers the point where a technical problem becomes a provider dispute or a legal matter, and how to lock everything down once control is back with your business.
Recovery is not always guaranteed, and timescales vary between providers. A calm, documented approach gives you the best chance of a clean outcome without making the situation harder.
What’s in This Post
- What you may have lost access to
- The recovery order at a glance
- Start with the domain and DNS
- Recover hosting and website administration
- Reclaim email, Google and other connected accounts
- What evidence providers may ask for
- If the former web designer will not cooperate
- Secure everything after access is restored
- When moving the website is the sensible option
- A website access handover checklist
What you may have lost access to
A business website is usually built from several separate services. Your domain might be registered with one company, the DNS (the settings that point your domain at your website and email) managed by another, and the website hosted by a third. Your former designer may also have set up email, analytics and Search Console under their own accounts.
Before contacting anyone, write down what you can and cannot currently access. This table can help you diagnose where the gaps are.
| System | What it controls | Who may manage it | Recovery route |
|---|---|---|---|
| Domain registration | Who holds the domain name, renewals and transfers | A registrar, sometimes via a reseller account held by the designer | Registrar account recovery or holder verification, then transfer if needed |
| DNS | Where the website, email and verification records point | The registrar, a DNS provider such as Cloudflare, or the host | Account recovery with the DNS provider, or change nameservers once the domain is under your control |
| Hosting | Website files, databases and server settings | A hosting company, often under the designer’s or agency’s account | Written request to the account holder, or provider support with evidence |
| CMS (for example WordPress) | Content, users, plugins and site settings | Whoever holds an administrator login | Password reset to an address you control, or a new admin created by the host |
| Business email | Mailboxes using your domain | Microsoft 365, Google Workspace or the host | Admin account recovery with domain verification |
| Analytics and Search Console | Traffic data and search performance | Google accounts owned by you or the designer | Request access, or verify ownership yourself |
| Source code and backups | The ability to rebuild or move the site | The designer, a code repository or the host | Written request, contract terms, or a fresh backup from hosting |
Seeing it laid out like this often reveals that the problem is narrower than it first felt. You might hold the domain but not the hosting, or have email but no website admin.
The recovery order at a glance
Working in a sensible order avoids wasted effort and reduces the risk of breaking something that currently works.
- Confirm who is the registered holder of the domain and where it is registered.
- Regain control of the domain registrar account, or start the holder verification process.
- Confirm where DNS is managed and secure that account.
- Recover or replace hosting access.
- Regain administrator access to the CMS.
- Secure business email administration.
- Reclaim Search Console, Analytics, Tag Manager and other connected services.
- Take fresh backups and tighten security across everything.
Start with the domain and DNS
The domain should be your first priority because it controls DNS, and DNS decides where your website and email go. Whoever controls the domain can, in practice, redirect both. If it lapses or sits in someone else’s account, everything else you recover remains fragile.
Start with a WHOIS or registry lookup to find the registrar and, where shown, the registered holder. For privacy reasons many holder details are hidden, but the registrar name is usually visible. Check old invoices and emails for renewal notices, as these often reveal which company and account were used.
The process then depends on the type of domain. Domains ending in .uk, such as .co.uk, are managed under rules set by Nominet, and you deal with them through the registrar. Nominet’s guide to UK domains explains how the registry works, and its published UK inter-registrar transfer policy sets out how .uk domains move between registrars.
Domains such as .com, .net and .org follow registrar terms and ICANN policies. ICANN’s page About Lost Domain Names is a useful starting point, and the ICANN transfer policy explains the rules around moving a domain. Neither route guarantees a particular outcome, and registrars will make their own checks.
It helps to separate three roles that are often confused:
- Registered holder: the person or organisation recorded as holding the domain.
- Account holder: the person whose login at the registrar manages it, which may be the designer.
- Business owner: you, who may need to prove authority if your details are not on record.
Once the domain is secure, find out where DNS is actually managed by checking the nameservers. If DNS sits with a separate provider, that account needs recovering too. If your site or email has stopped working during this process, our guide to diagnosing DNS problems that stop a website loading explains what to check.
Recover hosting and website administration
Hosting is where your website files and database live. If the hosting account belongs to your former designer or agency, the hosting company’s account holder may still be them, not you. Expect the provider to be cautious about giving you access to an account you do not hold, even if the website is about your business.
The most reliable route is usually a clear written request to the former designer asking for one of the following:
- Transfer of the hosting account into your name, where the provider supports it.
- A full backup of the website files and database, plus any licence keys for premium themes or plugins.
- Migration of the site to a hosting account you control.
For the CMS itself, try a password reset first. If an administrator account is linked to an email address you still control, this may be all you need. If every admin account belongs to the designer, someone with hosting access can create a new administrator for you, so this usually follows hosting recovery rather than coming before it.
If the designer has disappeared and the site is still live, do not try to guess passwords or use workarounds to get in. Unauthorised access can create legal problems and may damage the site. Our article on website rescue hosting for small businesses explains how a legitimate rescue usually works.
Reclaim email, Google and other connected accounts
Business email often runs through Microsoft 365, Google Workspace or the hosting package. The key question is who holds the administrator account. Both Microsoft and Google have admin recovery processes, and these generally rely on you proving control of the domain by adding a DNS record. This is another reason to secure the domain first.
If you are rebuilding email from scratch, our guide to setting up business email with your own domain covers the main options and records involved.
Google Search Console lets you prove you own a website without needing anyone else’s permission. According to Google’s guidance on verifying site ownership, available methods include:
- DNS record: adding a TXT record at your DNS provider, which verifies the whole domain.
- HTML file: uploading a small file to your website.
- HTML tag: adding a meta tag to your home page.
- Google Analytics or Tag Manager: using an existing tracking setup you can edit.
Once verified, you can see existing users and remove old owners where appropriate. Analytics and Tag Manager are different: if the property sits in the designer’s Google account, ask them to add you as an administrator. If that is not possible, you may need to create new properties, accepting that historic data may not carry over.
Also check social media pages, Google Business Profile, payment gateways, booking tools and any plugin licences. These are easy to forget until something stops working.
What evidence providers may ask for
Registrars and hosts have a duty to protect their customers, so they will check authority and evidence before changing account control. Being prepared speeds things up. Requirements differ between providers, but commonly requested items include:
- Companies House records showing you are a director, or other proof of business ownership.
- Invoices or receipts showing your business paid for the domain, hosting or design work.
- Contracts, proposals or emails setting out what the designer was engaged to do.
- Photo ID for the person making the request.
- Letterheaded correspondence or a signed authorisation from the business.
- Proof of address matching the business or holder records.
Keep copies of everything you send and receive, with dates. A tidy record is useful whether the matter is resolved in a week or ends up needing professional advice.
If the former web designer will not cooperate
Most handovers are resolved by a polite, specific written request. Explain which accounts you need, what you would like them to do, and give a reasonable deadline. Avoid emotive language, as these messages may later be read by a provider or adviser.
If there is no response, go to the providers directly with your evidence and ask what their process is. Some will contact the account holder for consent, while others have their own dispute procedures. For domains, registrar and registry policies may offer routes for the registered holder, but outcomes depend on the facts.
It is important to distinguish technical access from legal ownership. Having a login does not settle who owns the domain, the design or the code, and a designer may claim payment is outstanding or that they retain rights in their work. If there is a genuine contract or ownership dispute, keep records, do not take matters into your own hands, and seek qualified legal advice.
Throughout this stage, do not impersonate the designer, attempt to bypass logins or delete anything from shared accounts. These actions can weaken your position and may break the law.
Secure everything after access is restored
Getting back in is only half the job. Former contractors may still have saved passwords, active sessions or API keys, so treat every recovered account as needing a full clean-up.
- Change passwords on every account, using a password manager to store them.
- Turn on multi-factor authentication (MFA), which asks for a second code when logging in.
- Update recovery emails and phone numbers to ones your business controls.
- Remove old users from the registrar, hosting, CMS, email and Google services.
- Revoke active sessions so anyone still logged in is signed out.
- Rotate API keys, SFTP and database passwords, and any keys used by plugins or integrations.
- Turn on domain auto-renew and registrar lock where available.
- Take a fresh, complete backup and store a copy somewhere separate from the host.
Use a shared business email address, such as admin@yourdomain.co.uk, for account ownership rather than a personal inbox. That way access does not leave with an individual.
When moving the website is the sensible option
Sometimes the cleanest outcome is to move the website to new hosting you control from day one. This makes sense if the old hosting is tied up in a reseller account, the designer will only provide a backup, or the existing setup is outdated and insecure.
A planned migration involves copying the files and database, testing on the new server, and then switching DNS at a quiet time. If the move is managed well, visitors should notice little or no disruption. Our guide to cPanel migrations with no downtime walks through the steps.
If the site goes offline during the transition, our website down checklist for small businesses helps you narrow down the cause quickly.
A website access handover checklist
Use this checklist when ending any web relationship, or to confirm your position now. Each item should be in your business’s name, or at least accessible to you.
- Domain registrar account login, with your business as registered holder.
- DNS provider account login, if separate from the registrar.
- Hosting account login, or confirmation of who holds it.
- CMS administrator account in your name.
- SFTP, database and control panel details.
- Business email admin account.
- Search Console ownership and Analytics and Tag Manager admin access.
- Source code, theme files and licence keys for premium plugins.
- A recent full backup stored outside the hosting account.
- A written list of renewal dates and who pays for each service.
Keep this list with your contracts and review it once a year, or whenever a supplier changes.
Bringing it all together
Losing control of your website after a supplier relationship ends is stressful, but it is usually a solvable problem when you approach it in order. Secure the domain and DNS first, then hosting and the CMS, then email and connected services. Keep written evidence throughout, and seek legal advice if a genuine ownership dispute arises.
Once everything is back in your name, tidy security and keep a handover list so it does not happen again. If you would like a hand reviewing where your accounts sit or moving your site to hosting you control, the Webfort team is happy to talk it through with you.
