If your developer has disappeared, recover legitimate control of the website accounts before assuming the website itself must be rebuilt. Establish who can authorize the work, identify the hosting and domain providers, and ask each provider which account-recovery evidence it requires. Public archive captures can help replace missing pages, but they cannot grant access to an account you do not control.
Keep access recovery and content recovery as separate workstreams. A working site with an unavailable administrator needs a different response from a deleted site with no original files. Avoid commissioning a complete replacement until you know which situation applies.
Separate the accounts your website depends on
A website can involve several different accounts: domain registration, hosting, WordPress administration, email, paid themes, plugins and external integrations. Access to one does not prove access to the others. Make an inventory before requesting changes, especially when the former developer used an agency account for multiple clients.
For each service, record its provider, the organization named on available invoices, the business email associated with it, who currently controls access and the next legitimate contact route. Do not put passwords, recovery codes or identity documents into this shared inventory.
Use receipts, project correspondence and existing account notices to identify the provider. For a domain, ICANN’s registration-data lookup can help identify registration information. Public contact information may be limited. A lookup is a starting point for finding the registrar, not a method of obtaining credentials or proving rights to every website asset.
Ask the provider for its verified recovery route
Start with the normal account-recovery process for the actual service. Explain that the previous developer is unavailable and ask what the account holder or an authorized business representative must supply. Providers can have different requirements; an invoice or a visible company logo is not a universal entitlement to account access.
For example, WordPress.com’s account-ownership guidance describes recovery evidence such as a transaction ID, activation information or a two-step authentication code. That is a WordPress.com process, not an account-recovery service for every self-hosted WordPress installation. A WordPress site hosted elsewhere needs its own host and administrator routes.
Do not attempt to bypass another person’s account, ask a replacement developer to disable security checks, or impersonate the former developer. If the account is held by an agency, ask whether a site-specific transfer or export is available through an authorized handover rather than seeking access to the agency’s entire account.
A concise provider enquiry can say:
Our business operates the website at [domain]. The previous developer is unavailable. Please explain your process for verifying the authorized account holder or business representative, and whether the website can be transferred or exported separately. Which evidence must be submitted, through which secure channel, and what website data is currently available?
Keep the provider’s reply and reference number. Where ownership or contractual rights are disputed, obtain appropriate legal advice. This checklist does not determine who legally owns an account or require a provider to release it.
Request a usable handover, not just a login
If the developer, agency or provider responds, specify the components you need. A WordPress login may allow content editing while leaving the host, backups, domain and paid dependencies under someone else’s control. Conversely, hosting access may exist while the WordPress administrator account remains unavailable.
- Website data: dated files and database copies, or a documented platform export appropriate to the site.
- Content and media: original images, documents, copy and any separate content exports.
- Dependencies: a list of themes, plugins and integrations, including who holds their accounts and licences.
- Operating information: which account manages the domain, hosting, renewal notices and essential customer routes.
- Remaining gaps: unavailable source code, missing credentials, untransferable licences or unanswered ownership questions.
WordPress’s backup documentation distinguishes files from the database. Do not accept a folder of images and a theme as a complete copy without establishing whether the content database is included. Preserve received material unchanged and inspect copies rather than testing an unknown restore over a working site.
Assess archives only for the material still missing
When legitimate originals cannot be obtained, public captures may provide evidence of visible pages, layout and some assets. They will not recover the original hosting login, a private customer database or an integration’s credentials. An archived contact form can show its appearance without preserving its delivery system.
Check the pages that matter rather than the homepage alone. Record the capture date and whether the required content and media are actually present. The archive restoration guide explains that source-assessment and rebuilding process. Account recovery should remain open while you assess public material; the existence of a capture is not a reason to abandon a recoverable native copy.
Also distinguish authority for the project from rights to specific photographs, copy and licensed components. Our archived-content ownership checklist covers that separate review. A new domain account does not settle every content-permission question.
Define what control should look like after recovery
Before accepting a replacement or restored website, agree who will receive each account, where renewal notices go and how authorized people will obtain backups. Check access through the approved provider routes instead of recording “owner has access” because one login worked once.
Maintain a compact handover register with these fields: service, owner-approved responsible person, verified access date, renewal contact and unresolved dependency. Keep sensitive authentication material in an appropriate private credential system, not the register itself. Ask for a practical explanation of how to edit the delivered site; recovered appearance alone does not establish the editing experience.
If missing public content requires reconstruction, the website recovery service can assess that rebuilding scope. It does not replace a registrar’s identity checks, settle a contract dispute or promise access to someone else’s account.
Questions when a former developer is unavailable
Should I give the replacement developer the former agency’s password?
Do not share credentials for an account you are not authorized to use. Ask the provider or account holder about a legitimate site-specific handover. Where you control the account, arrange appropriate access for the work rather than circulating a shared password publicly.
Can the website be recovered while account ownership is unresolved?
You can record public source availability without representing that as permission to reuse it. Do not proceed with a disputed restoration or unauthorized account change. Resolve who can authorize the work and which content may be used before approving the rebuild.
What if the theme or plugin licence belongs to the agency?
Check the actual licence and provider terms. Do not assume that a copied theme folder transfers the licence, updates or support. Record whether the owner needs a separate licence or an approved replacement before describing the rebuilt website as ready for ongoing maintenance.
