How to get your website back from a web designer.

Why the order matters

Your domain is the key to everything else. It decides where the website lives, where your email is delivered and how you prove to Google that the site is yours. With the domain in your hands you can verify Search Console yourself, point the domain at a new site and keep email running, even if the designer never answers again. Without it, every other login is borrowed.

So work in this order:

• The domain.
• The DNS settings, where the domain's records live.
• Email.
• The hosting and the website's own login.
• The site files, and the licences for anything paid.
• Your Google Business Profile.
• Search Console, analytics, ad accounts and social media pages.

Most of these situations are not malice. The designer has retired, moved on, or set everything up in their own account years ago because it was quicker, and nobody has asked since. Sometimes there is an unpaid invoice behind it. Start by assuming the friendly version, because it is usually true and it gets things done fastest.

Find out who holds the domain

For .com, .net, .org and the other generic domains, look the domain up on ICANN Lookup, ICANN's free public search. It shows the registrar, the company the domain is registered through, along with the expiry date and status. The owner's name and email are usually hidden. For a country domain, such as .de, .fr, .nl, .co.uk or .eu, use the lookup of that country's registry, because each one has its own rules.

Then check your own records: invoices from the designer, renewal emails, and your card statements for charges from a registrar. Two situations are common, and they need different steps:

• The domain is registered to your business, but it sits in the designer's account, because they bought it for you. You are the registrant, and the registrar's rules are on your side.
• The domain is registered to the designer personally or to their company. Then they are the registrant, and you need them to hand it over.

Under ICANN's transfer policy for generic domains, the registrant is the only party with authority to approve or deny a transfer to another registrar. Which situation you are in decides how hard this is.

Ask in writing, with a list and a date

Send one email with everything you need, so nothing gets missed and you have a record. Keep it friendly. For a two-van roofing firm, it might read:

"Hi Sam, we are moving all our accounts into the business's name. Could you, by the end of next week: move the domain into an account in our name, or remove its transfer lock and send the transfer code; make us owner of the Google Business Profile, Search Console and analytics; send a full backup of the website, files and database; and either move the hosting to our own account or send it across with the site. If anything is unpaid, please send the invoice and we will settle it. Thanks for everything you set up for us."

Then follow up by phone. If there is a real unpaid invoice, pay it or agree a plan. Holding back a fair bill rarely speeds things up.

Ask for access to be given as an invitation to your own account wherever the service allows it, rather than a password sent by email. Google and Microsoft accounts, and many registrars and hosting companies, let an owner add another person without sharing a login.

Get the domain into your name

There are two ways to do it, and the first is usually quicker:

• A move between accounts at the same registrar. The designer moves the domain into an account you open there. Many registrars have a button for this, and nothing about the domain changes.
• A transfer to a registrar you choose. The transfer lock is removed, the current registrar gives the registrant a transfer code, often called an auth code or EPP code, and you enter it at the new registrar.

For generic domains, ICANN's rules set the limits:

• The registrar must give the registrant the transfer code. If you cannot remove the transfer lock yourself in the control panel, the registrar must remove it within five calendar days of your request.
• A registrar may refuse a transfer to another registrar within 60 days of the domain's registration or of a previous transfer.
• Changing the registrant's name, organisation or email address starts a 60-day lock on moving to another registrar, unless you opt out before the change, where the registrar offers that. Plan the order: move registrars first, then change the details, or ask about the opt-out.
• Not paying for a future period is not a valid reason to refuse a transfer.

ICANN has been reviewing these rules, so check your registrar's current help page before you start. Country domains follow their own registry's rules.

Once the domain is yours, set it up properly: the business as registrant, a business email address you control as the contact, automatic renewal on a card the business holds, two-step verification on the registrar account and the transfer lock switched back on.

Take over the DNS without breaking email

The DNS settings may sit at the registrar, at the old host or with a service such as Cloudflare, possibly in the designer's account. Wherever they are, the records hold your email delivery, the proof that your email is genuine and the verification for your Google and Microsoft accounts.

Before you move anything, export or photograph every DNS record. If the domain moves to a new DNS host without its MX records, all email on the domain stops, and nobody gets an error until customers say their messages bounced.

Recreate every record at the new DNS host before you switch: MX, SPF, DKIM, DMARC, the verification records and any CNAME records your tools use. Then send an email to the business from outside, and one from the business to a Gmail address. If email starts landing in spam after the move, see why your business emails go to spam.

Secure your email early

Whoever controls your email can reset the password of almost every other account registered with it. Get it under your control before the rest:

• If your mailboxes are on Google Workspace or Microsoft 365 and the designer is the administrator, ask for full administrator rights for someone in the business, then remove theirs.
• Change the recovery email and phone number on the admin account to the business's own.
• If your email is included with the designer's hosting, export the mailboxes and move them to a provider in the business's name before that hosting can end.
• Check where the domain's contact email and the accounts' recovery emails point. An address at the designer's company sends every reset link to them.

Get the hosting and the website login

What you can get depends on where the site lives:

• Hosting in your own account, with the designer as a user. Change the passwords, remove their access and you are done.
• Hosting in the designer's own account, often shared with their other clients. They will not hand over an account that holds other clients' sites, so ask for a full backup and a move to hosting in your name, or for the files and database so another developer can do it.
• A site builder such as Wix, Squarespace or Shopify, in the designer's account. Ask whether the platform lets them transfer the site to an account in your name. If it does not, you keep the domain and the content is rebuilt elsewhere.

For a WordPress site, ask for an administrator login in your own name rather than the designer's. Once you are in, look at the list of users, remove anyone you do not recognise and check that you receive the site's admin emails.

Get the files, and know what you own

Check that the backup holds everything another developer needs to run the site:

• The site's files and, for WordPress and similar systems, the database.
• The theme and every plugin, with a note of which are paid. Paid licences are often in the designer's name, and you will need your own.
• Font licences, and the original photos and logo files at full size.
• Any custom code, and notes on how forms and connections to your booking tool or CRM are set up.

Ownership of the design and the code depends on your contract and the law where you are, not on who has the files. Content you supplied yourself, such as your text and your own photos, is normally yours to reuse, but stock photos may have been licensed to the designer, not to you. If ownership matters, read the contract first and ask an adviser before you rely on anything here.

Take back your Business Profile, Search Console and analytics

Your Google Business Profile is often the most valuable account of all, because customers find and call you from it. If the designer owns it, ask them to make the business the primary owner. If they do not respond, request access through Google: search for the business at business.google.com/add and choose the option to request access. Google emails the current owner, who has three days to respond, and if they do not, you may be able to verify the profile yourself. Service-area businesses without a shop front contact Google support instead.

Search Console you can recover without anyone's help once you control the DNS. Add a Domain property and verify it with the TXT record Search Console gives you. Verifying the domain covers every subdomain and both http and https. Then remove old owners by deleting their verification record or file, and unverify them in the settings.

For analytics, ask to be made an administrator of the property, or ask the designer to move it into an account in your name. Do the same for ad accounts, the Meta business account that holds your Facebook and Instagram pages, any tracking pixel and any automation the designer built, such as a Zapier or Make account that copies enquiries into your CRM. Each one should list a person from the business as an administrator, with the supplier added as a user if you still work with them.

When the designer will not answer or will not help

Give it two weeks and two tries: the email, then a phone call and a second email with a firm date. Then move on:

• If the business is the registrant, contact the registrar's support with proof: company documents, invoices for the domain and photo ID for the person named. ICANN's compliance team accepts complaints about registrars that do not follow the transfer rules.
• Recover Search Console through DNS and the Business Profile through Google's access request, as above. Neither needs the designer.
• If the site sits on the designer's hosting and they will not send it, a copy of the public pages can rescue the text and photos, but not the database behind them.

If the designer is the registrant and refuses, the registrar treats the domain as theirs. A letter from a solicitor can settle it, but ask an adviser before you threaten anything.

The last resort is a new domain. It costs you the email addresses, the search history and every printed card and van, so treat it as a real cost, not an easy way out. Do not cancel the old hosting, or stop paying for anything, until the domain, the email and a full backup are in your hands.

Once you have it back

• Change every password and switch on two-step verification everywhere it is offered.
• Remove old users and administrators from every account.
• Keep a list of every account, who owns it and where the logins live, in a password manager the business controls.
• Put each renewal on a card the business holds, with reminders going to an address someone reads.
• Add a second administrator from the business to each account, so one person leaving does not lock you out again.

Then make sure the next supplier works through invitations to your accounts, never their own. The full ownership checklist is in what a small business website needs, and what a monthly plan should cover once the site is back is in what website maintenance covers.

We can usually take over a site someone else built. We look at what is there first, and suggest fixes or a rebuild only when it makes sense; a rebuild follows the same steps as a website redesign. Domains, hosting and accounts are set up in your name or handed over at launch, as websites describes, and the monthly plans on the prices page keep them that way.