My Web Developer Disappeared: The Recovery Playbook (What to Do Tonight, In Order)

Key takeaways

• You almost certainly still own your website — you've lost access, not ownership. That's paperwork, not a disaster.
• "Your website" is four separate things: the domain, the hosting, the files, and the admin login. Recover them in that order of importance.
• The domain is the one piece you cannot replace. Check its expiry date today — that date is your real deadline.
• Most recoveries finish in days with a bank statement, a WHOIS lookup, and a few phone calls. No lawyer required.
• Finishing a half-built site should cost 40–70% of a fresh build — never a full rebuild price. Get that in writing.

Your last three messages show as delivered, not read. The phone rings out. The website is half-built, half your money went with them, and when you tried to log in and check on things yourself, nothing worked — wrong password, unknown email, an account you never created.

Here's the honest version of what happens next: this is recoverable. Almost all of it. And the recovery is mostly phone calls and paperwork, not code. Rescue work — taking over abandoned builds and vanished-developer sites — is a steady part of what we do. This is the playbook we wish every one of those clients had read before the panic set in.

You didn't lose the website. You lost the keys.

A developer going silent does not mean your website is gone. It means you can't reach the accounts that control it. Those are very different problems. A lost website is a disaster; lost keys are an administrative errand — annoying, time-sensitive, but solvable. Every registrar and hosting company handles "I can't get into my account" cases every single week.

Nobody loses a business over a forgotten WordPress password. People lose businesses over a domain registered in someone else's name that nobody renews.

"Your website" is four separate things

Most owners think of their website as one thing. It's actually four, usually bought from different companies — and the person who set it up often holds all four on your behalf. That's the trap.

Only the domain is genuinely hard to replace. If you only have energy for one fight, have the domain fight.

What to do tonight, in order

The sequence matters — step 3 before step 1 changes the whole negotiation.

1. Send one last message, then stop chasing. Frantic follow-ups make you feel worse with every unread tick and don't bring anyone back. Send one calm, final note: "Hi [name], I haven't heard from you in [X] days. I need a status update by [date, 3–5 days out] or a clean handover of all access and code. I'll pay for genuine work delivered. After [date], I'll move forward without you." Then stop. You now have a paper trail with a deadline — more useful than fourteen "???" messages.
2. Write down everything you DO have. Registrar login, hosting login, GitHub access, screenshots of promises, bank transfer records, designs in a shared Drive folder. Search your email for the domain name — confirmations and renewal notices from years ago are usually still there. Most people discover they hold more than they thought.
3. Secure the domain registrar account — today. If the developer ever had that login, assume they still do. New password, recovery email only you control, two-factor on. The domain is the one asset here that can be stolen permanently.
4. Don't threaten what you can't enforce. "I'll sue you" rarely works on a solo developer with no assets — it just tells them silence is safer. Your real leverage is an honest public review, spent after recovery, never as a threat during it.
5. Check where your email lives before touching anything. If your mail is you@yourbusiness.com (not Gmail), it likely runs through the same hosting or DNS as the site. Moving hosting without a plan can silently kill your email — no bounce, no warning, just lost quotes and orders. Find out where mail is handled first; fix the website second.
6. Get a second opinion on what's salvageable. Send whatever you have to one or two reputable developers and ask: how much is salvageable, and what does it cost to finish? The number is almost always lower than "start over" — and now you have a baseline before anyone quotes a rescue price.

Finding the accounts with no passwords and no paperwork

Work backwards from the two trails every business leaves:

1. Search bank and card statements. Domains and hosting bill a card yearly or monthly, and the merchant name is the company. Search two years back for GoDaddy, Namecheap, Bluehost, SiteGround, Hostinger — plus any unfamiliar charge renewing on the same date yearly. This one step identifies the hosting company in most cases.
2. Run a public WHOIS lookup. Owner details are usually privacy-hidden now, but the registrar is always shown — which tells you exactly which company to call.
3. Search every inbox you've ever used. Search the domain name itself, not company names. Old registration confirmations and invoices are usually still sitting there.
4. Check who gets the renewal notices. Your inbox means the account is effectively yours — password reset gets you in today. The developer's inbox means you have a recovery case to make.

Do all of this before contacting the developer again. It's much easier to ask for one specific thing than for "everything."

Getting the domain back: three situations

1. The account is in your name. Reset the password; done. More common than you'd think — developers often register in the client's name and never hand over the login.

2. The account is in the developer's name and they're reachable. Don't ask for their password — ask for a transfer. They unlock the domain and hand you an authorization code; you open your own account and pull it across. A transfer is a smaller, cleaner ask than a login, and it leaves them holding nothing.

3. The account is in the developer's name and nobody answers. Now it's a registrar case, and the currency is evidence: invoices showing you paid for the domain or site, business registration matching the domain name, card statements showing renewals, photo ID. Every registrar has a formal process because this happens constantly.

GoDaddy's Account Recovery page, for instance, has a "Domain Access" path for people listed as the registrant who can't reach the account holding the domain — you submit the request with a color copy of government photo ID plus business documentation if a company is on the account. The honest catch: it only works if you are the registrant of record. If the developer registered it in their own name, it's a dispute, not a recovery — slower, but still winnable with payment evidence. Namecheap has no self-service path here; you'll work through their support team with the same evidence file.

Watch the renewal date. A domain in an abandoned account isn't being renewed. A lapsed domain can be bought by anyone — turning a recoverable problem into a permanent one. Find the expiry date in WHOIS early and treat it as your real deadline.

Getting the site back online

Once the domain is yours, the site is a smaller problem — you may never need the old hosting at all. A domain doesn't contain your website; it points at it. Change where it points and traffic follows within hours.

Copies of your site hide in more places than owners expect:

• Backup plugins — UpdraftPlus or Jetpack backups may sit in a Dropbox or Drive you control. Check.
• Staging sites — search email for staging.yoursite.com and similar. A staging copy is often a full working backup.
• The Wayback Machine — web.archive.org can recover every page's text and structure. Enough to rebuild fast.
• Hosted platforms — on Shopify, Squarespace, or Wix, your data lives in your platform account. The developer never held it.
• GitHub — check whether code was ever pushed to a repo you can see.

The mid-build problem: if the site was never deployed, be honest about what exists. Code that only lived on the developer's laptop is gone — accept that fast, because denial turns a two-week recovery into a three-month one. What usually survives: designs in Figma or Drive (30+ days of version history even after "deletion"), any staged database, and your own content. Finishing the gap costs far less than people fear, because you're completing a project, not starting one.

And repeat after me: if mail runs through the old hosting, move it deliberately — or better, move it to Google Workspace or Microsoft 365 during recovery so your email never again depends on whoever hosts your website.

Lock the old access out

Everyone skips this because they're exhausted and the site works again. Do it anyway — a forgotten account is a key in a stranger's pocket.

• Change the password and contact email on the domain registrar account.
• Change the hosting password and its account email.
• Remove every non-team account from the website's user list.
• Check FTP and database users — created separately in the hosting panel, they survive deleting a website account.
• Check application passwords and API keys, which outlive the user that created them.
• Change any email inbox password the developer could reach.

One left-behind account is the usual cause of a "random" hack six months later. Nothing about it was random.

The legal reality check

• Chargebacks. Paid by credit card? You can typically dispute charges going back ~120 days. Bank transfer, wire, or cash? Gone. This is the strongest argument for always paying developers by credit card.
• Small claims court. Cheap to file, no lawyer needed. The problem isn't winning — it's collecting from a solo developer with no assets. Worth doing on principle for larger amounts; don't expect it to fund the rebuild.
• Domain disputes (UDRP). The nuclear option: a WIPO filing costs $1,500 for a single-panelist case and takes two to three months (a $4,000 expedited track cuts it to about a month). But UDRP targets cybersquatting — bad-faith registration of someone else's trademark. A developer holding your domain after you paid them is a contract dispute, not cybersquatting. Usually the wrong tool: slow, expensive, aimed at the wrong problem.
• Reviews. Your real leverage, and it's free. One detailed, factual, calm review where you found them warns the next business owner. Write it after recovery — never as a threat during it.

What a rescue should actually cost

Rescue pricing is where burned clients get burned twice — panic-accepting an inflated quote, or hiring the cheapest bidder and repeating the cycle. From the rescue work we do, honest ranges:

Two rules. Never pay a large upfront deposit to a rescue developer — milestone payments tied to working features, or don't sign. And beware the instant fixed quote: nobody can price finishing a half-built project without seeing the code. A flat quote before looking is a guess you'll pay for later.

Never again: the handover checklist

Whoever builds your next site, the arrangement should look like this. Any honest developer agrees to all of it without being asked twice:

• Everything in your name. Domain, hosting, and platform accounts registered to you, with your email on them. Your developer gets an account on your accounts — never the reverse.
• You hold the logins. Even if you never use them. A password manager, not a sticky note, not "the developer has them."
• Code in a repository you can see. GitHub, GitLab, Bitbucket — if you can open it in a browser, it can't vanish with a laptop.
• A backup you can reach. Stored somewhere you control. A backup only the developer can restore is not a backup you own. Test the restore once.
• It's written down. One page: who holds what, which company each account is with, what happens if you part ways. Boring to write. Priceless later.
• Milestone payments, always. Deposit, then payments tied to visible, working deliverables. Nobody reputable needs 100% upfront.

Vetting the next developer (rescue edition)

• "Show me how I'll access everything on day one." Right answer: a screen share setting up your accounts. Wrong answer: "don't worry, I'll handle all that."
• "What happens to the code if you get hit by a bus?" You want to hear: "it's in your GitHub from the first commit."
• "Can I talk to two past clients?" Actual conversations, not website testimonials. Ghosters don't have clients who'll take that call.
• Red flag: they trash the previous developer instead of assessing the work. Green flag: they tell you what's salvageable before quoting, in writing.

If you're reading this with a half-built site and a silent developer, you don't need another month of stress — you need someone to look at what exists and tell you the truth. That's our free rescue audit: send us whatever you have — links, logins, screenshots, even just the domain — and we'll send back a written report on what's salvageable and what it costs to finish. No obligation; you keep the report either way.

Or start with a second opinion on the site as it stands via our free site audit. When you're ready to talk it through, book a call — we'll tell you straight whether we can help or whether you'd be better off elsewhere.