Most business owners entrust their website operations to the parties that built their websites or to third-party service providers. While this may seem convenient, someone else holds the key to your brand’s online presence.
The best way to take control of your website is to start by finding out exactly who controls the accounts behind it. Your domain, hosting, CMS, and DNS may all be managed through different accounts, and you need access to each one to have full control. You also have to avoid nuking the existing SEO.
Here’s a guide for you if you’re searching, “I don’t have access, how do I take control right now?” It’s your recovery playbook for when an agency or old developer locks you out.
Who Actually Owns Your Website Right Now?
Your priority should be finding out who actually owns your website before you can take it over. Know who controls your website, whether it’s an agency or a previous developer.
Control of your website goes to whoever has access to the hosting account, domain registrar, and CMS. If you’re trapped, make sure you own your website before proceeding.
1. Check Who Controls Your Domain
Your domain name is the single most important part of your website, and if you were to lose everything else but one thing, it would be your domain name!
It’s your brand’s identity, and every other aspect of your website is built upon your domain name and brand identity.
Which registrar holds your domain name, and whose name and email address appear on the account? Who can renew or transfer the domain?
Does someone else own your brand’s digital identity?
2. Find Out Where Your Website Is Hosted
Your hosting account controls the server that stores your website files and database and lets you access them.
Your developer may have set this up under their own account, or your agency may manage hosting for several clients from one account.
On that note, I run the best WordPress hosting for agencies.
3. Check Your CMS Access
If your website runs on WordPress, check who has administrator access. Don’t assume the username and password you have give you full control without confirming whether it’s an administrator account and whether other secret accounts have the same administrator privileges.
Find all email addresses attached to administrator-level accounts.
4. Find Your DNS Provider
Full control includes access to your domain’s DNS records, which are managed by a DNS provider. Is the DNS managed through your domain registrar, hosting company, or a separate DNS provider?
If someone else controls it, they can control essential parts of how your domain connects to your website and other services.
5. Make a List of Who Controls What
Once you’ve checked these four areas, you should have a much clearer picture of who controls your website. You may discover that you control some accounts while your developer or agency controls others. This research is crucial and should come first to help you come up with a proper recovery plan.
The 4 Accounts You Need Access To
Now that you know who controls the different parts of your website, focus on the accounts you need to take control of.
1. Domain Registrar
Your domain registrar controls your domain name. You need access to renew the domain, update its information, change nameservers, and manage transfers.
Take control if your developer or agency registered it for you. You don’t have control unless you fully control the login and security credentials for the email address used to register the domain name account.
Otherwise, the one with access to that email could override your password to the domain name account and lock you out with a simple ‘forgot password’ button that resets the password and sends access to the email address we’ve discussed.
2. Hosting Account
A hosting account stores your website files and distributes them globally via your CMS.
You need this access to manage your website files, database, backups, server settings, and other hosting features.
If your developer or agency hosts multiple client websites under one account, ask how your website is managed and how you can get direct access to your own hosting environment.
On that note, here’s how to transfer a website without losing SEO.
3. CMS Administrator Account
The CMS lets you manage web content and structure, as well as publishing. Demand administrator-level access and refuse a basic user account.
You should also investigate which other users have administrator privileges and remove access that no longer belongs there.
Special resource for beginners: What is a CMS? Here’s What You Need to Know.
4 DNS Account
DNS controls how your domain connects to your website, email, and other online services.
You need to know where your DNS is managed and have access to that account. It may be your registrar, hosting provider, or a separate DNS service.
How to Request Access Without Burning the Bridge
It’s great that you want to take over your website, and even greater that you want to do it amicably without burning bridges with your developer or agency.
A clear and professional request can help you get the access you need without turning the situation into a confrontation.
1. Ask for Your Own Account
Ask your developer or agency to create an account for you with the appropriate level of access. It should give you access to the website while allowing them to maintain their own account if they continue working on the site.
2. Be Specific About What You Need
Be explicit about the level of access you need by asking for access to the domain registrar, hosting account, CMS, and DNS provider.
Specify other crucial services under their management, such as backups, analytics, or Search Console.
3. Put the Request in Writing
Email provides a clear record of your request and the accounts you asked to access.
Keep your message simple and professional. Explain that you want direct access to the accounts associated with your business website.
4. Give Them a Reasonable Deadline
Give your developer or agency a reasonable amount of time to provide the requested access. Give them time to find the login credentials and grant access. In most cases, this should not take more than a few days.
5. Confirm Your Access
Log into each account and check if you got the necessary permissions. Verify the:
- Account details,
- Recovery information,
- Administrator permissions.
You should access these accounts independently and cut off all other unauthorized parties from having your level of control.
What to Do If Your Developer Won’t Respond
The difference between requesting access and recovering your website lies with your developer. Let’s say communication breaks down irreparably.
1. Document Your Attempts to Get Access
Keep copies of your emails, messages, invoices, contracts, and other communication with the developer or agency.
A record of your attempts can become important if you need to contact a provider or take further action to recover your accounts.
2. Contact the Account Provider
Your developer may control the account, but a third-party provider owns it. If you kept your documents well, as we agreed in step one above, it will really come in handy when contacting these account providers.
Call or email the providers directly and ask about their recovery process. All providers have such processes, from domain registrars and hosting companies to CMS platforms and DNS services.
Be prepared to provide information that verifies your connection to the account or business.
3. Gather Your Account Information
The more information you have, the easier it becomes to establish your connection to the website.
Gather domain registration details, invoices, payment records, business information, previous account emails, and any other documentation showing your relationship with the website or account.
4. Recover Each Account Separately
You’ll likely regain access to one part of your website before another.
For example, you may recover the domain registrar account while your developer still controls the hosting account. Work through each account individually until you have access to the domain, hosting, CMS, and DNS.
5. Escalate When Necessary
Stubborn noncompliance from developers and agencies could escalate from simple inconveniences into huge criminal and civil issues.
Review the fine print on your agreement with the developer or agency and document all their infractions. Meet your contractual obligations so they don’t have an excuse for falling short.
If someone continues to withhold access to accounts or assets belonging to your business, sue them.
Secure Your Website After You Get Access
Getting access back is a major step, but you’re not finished yet. Once you have control of the accounts, secure them so you can manage your website independently.
1. Change Your Passwords
Passwords are a crucial tool for website security. Start with the accounts that control the website, including your domain registrar, hosting, CMS, and DNS provider.
Use unique, strong passwords for each account and store them somewhere secure that your business can access.
2. Turn On Two-Factor Authentication
Use your email or phone to set up two-factor authentication in case someone brute-forces past your password security.
3. Review Administrator Accounts
Check every user with administrator-level access across your website and related services.
Remove former employees, developers, contractors, or agencies who no longer need access. Keep access limited to the people who currently need it.
4. Update Recovery Information
Check the recovery email addresses, phone numbers, security settings, and other account recovery information.
These details should point only to people and accounts your business controls.
5. Confirm Your Backups
Do you have website backups? If yes, do they work, and are they up to date? Test your backups regularly to make sure they work.
Additionally, consider implementing a disaster recovery plan in case of a cyberattack or other unforeseen event. Store multiple backups in different locations and update them regularly.
Who Is Responsible for Website Security?
Getting control of your website also means taking responsibility for keeping it secure. Your developer, hosting provider, and other service providers may handle certain tasks, but the website owner is ultimately responsible.
1. Website Owner
It’s up to you to know and manage who can access your website. It’s your job to manage:
- Passwords,
- User permissions,
- 2FA,
- Backups,
- Domain renewals,
- Access to your registrar, hosting, CMS, and DNS accounts.
2. Developer or Agency
A developer or agency can handle technical security tasks when you hire them to do so, especially:
- Software updates,
- Plugin updates,
- Vulnerability monitoring,
- Backups,
- Other maintenance work.
Your agreement should clearly define their responsibilities.
3. Hosting Provider
Your hosting provider plays a role in website security, especially:
- Server security,
- Network protection,
- Infrastructure updates,
- Other protective measures.
Your hosting provider’s security measures don’t replace your responsibility for your website and account credentials.
4. Third-Party Services
Your website may depend on services outside your hosting account, including:
- Payment processors,
- Email platforms,
- Plugins,
- Analytics tools,
- Other applications.
Each service has its unique security responsibilities and account controls. Track who manages these accounts, and ensure you can access them.
Take Control of Your Website Before You Need It Back
We agreed that your first must-do is to investigate who controls all relevant accounts. You should have access to the hosting, domain, DNS, CMS, and all third-party services mentioned above.
Work through each account and request access from your developer or agency. You can reach out to the providers if your developer or agency goes awall.
Once you’re back in, secure the accounts, review administrator access, and make sure your business controls the recovery information.
