If your developer has disappeared, recover the project in this order: confirm what you already control, secure the domain through your registrar, regain the hosting account through the host’s ownership verification, then get a copy of the code from the repository or the server. Do it through each provider’s official recovery process, using evidence that the business is the account holder or paying customer. Once you hold those four things, any competent developer can pick the work up.
Before any of that, give it a fair chance. People get sick, change jobs or simply let email pile up. Send one clear message by email and one by another channel you have used before, saying what you need and by when. Keep it calm and keep a copy. If the relationship does end badly, a polite written record helps.
Step 1: Write down what you know
Before contacting anyone, gather what you already have. It is usually more than you think.
- Invoices and receipts, including any for domain renewals or hosting paid through the developer.
- The contract, quote or emails that set out the work and who owns what.
- Any login emails or welcome messages from hosts, registrars or platforms.
- Bank or card statements showing who is billed for hosting and domain renewal.
- Your business details as registered: legal name, ABN or ACN, and registered address.
Then check which accounts you can already get into. You may be an owner on more than you realise, especially if the developer set things up using your email. The checklist in who owns your website is a good way to map it out.
Step 2: Secure the domain
The domain matters most, because it controls both your website and your email. Look it up on a WHOIS service to find the registrar and the registrant. For .au names, auDA’s WHOIS shows the registrant’s name.
If your business is the registrant, contact the registrar directly. They have a process for the registrant to regain control, usually involving identity and business verification. Once in, update the contact email to one you control, turn on two-factor authentication and check the renewal date.
If the developer or their business is the registrant, the registrar generally cannot hand it to you without their agreement, because legally the licence is theirs. For .au names, auDA publishes complaints and dispute resolution processes, and its current guidance explains which applies to your situation. This is the point to get legal advice if the domain is important. Do not try to log in to the developer’s accounts or guess their passwords. Apart from being unlawful, it can wreck a legitimate claim.
Watch the renewal date closely. A domain registered to a developer who has stopped responding may simply not be renewed. Ask the registrar what their expiry and grace periods are so you know how long you have.
Step 3: Regain the hosting account
Hosts deal with ownership disputes regularly. Contact their support and explain that the account holder is unreachable. Most will ask for evidence: who pays the invoices, the business name on the account, ID, and sometimes a statutory declaration. If the account is in your business’s name or billed to your card, you are usually in a strong position.
If the site sits on the developer’s own reseller or agency account, the host’s customer is the developer, not you. The host may still help, but expect them to be cautious. In that case, your fallback is getting a copy of the site rather than the account itself, which is the next step.
Step 4: Get the code and data
Where the code lives depends on how the site was built.
- Repository. If the code is on GitHub, GitLab or Bitbucket and you have any access, download a full copy now. If the repository sits under an organisation your business owns, you can manage collaborators yourself.
- Hosted platforms. For Shopify, Webflow, Squarespace and similar, the theme and content live in the platform account. Once you control that account, you control the site. Shopify themes can be downloaded from the theme library.
- WordPress and similar. The code and uploads are files on the server, and the content is in a database. With hosting access, a developer can take a full backup of both. Many hosts also have a built-in backup tool you can run yourself.
- Custom apps. You need the code, the database and the environment settings, such as API keys and service accounts. Secret keys that only the developer knew should be rotated anyway once you are back in control.
If you cannot get access to the code at all, the live site itself can sometimes be copied or rebuilt, but this is a last resort. Talk to the developer you bring in about what is realistic for your platform.
Step 5: Lock everything down
Once you have control, close the doors behind you. Remove the old developer’s user accounts on every platform. Rotate API keys, payment provider keys such as Stripe secret keys, and any shared passwords. Turn on two-factor authentication for every owner account. Check the domain’s DNS records and the CMS user list for anything you do not recognise.
This is not about assuming bad intent. It is basic hygiene whenever someone with high-level access leaves. The guide to giving access without sharing passwords explains how to set up access properly for whoever comes next.
Step 6: Get an honest assessment
Half-finished projects are hard to judge from the outside. Before paying anyone to keep building, have a developer look at what is there: does it run, what state is it in, what is missing, and is it built on something worth continuing? Sometimes the answer is a few days of focused work. Sometimes it is cheaper to start again on a simpler platform. Fix or rebuild covers how to make that call.
If the project was built with an AI app builder such as Lovable, Bolt or Cursor, the same steps apply, but also check the accounts behind it: the builder workspace, the database project and any AI API keys.
A recovery checklist
- Send a final clear request to the developer and keep a copy.
- Gather invoices, contracts and business identification.
- Confirm the domain registrant, then contact the registrar.
- Contact the host with evidence of ownership or payment.
- Download the code, database and uploads.
- Remove old access and rotate all keys and passwords.
- Get a written assessment before committing to more work.
If you only do three things
Secure the domain before it lapses, get a full copy of the code and data, and rotate every key once you are back in control. Everything else can wait a week.
Once you have access back, we can review what is there and tell you plainly what it would take to finish. Our help with your build service starts with a fixed-price code review. Pairing sessions and code reviews from $300. Most help jobs land between $300 and $1,500.
