Take a full backup first, then collect access in this order: domain registrar, DNS, hosting, CMS admin, analytics. The domain is the only piece that is genuinely hard to replace, so start there. Most cases are disorganisation rather than hostage taking, and a dated written request resolves them.
Two different situations get described with the same sentence. In the first, your designer is busy, disorganised or has moved on, and nobody ever wrote down who holds what. In the second, someone is deliberately using your website as leverage. The first is common and the second is rare, and the steps below work for both, because they start with the parts you can do without anyone’s cooperation.
What you are actually trying to get back
A website is not one thing you either have or do not have. It is five separate assets, usually held in five different accounts, and they have very different recovery stories.
| Asset | How to check | If you cannot get it back |
|---|---|---|
| The domain name | Run a WHOIS or RDAP lookup and read the registrar name | Serious. The one piece with no workaround, because it is your address. |
| DNS | Same lookup, read the name servers | Recoverable once you control the domain. DNS follows the registrar. |
| Hosting, files and database | Ask who the host is, or look up the site’s IP | Annoying but survivable. A site can be rebuilt from a backup or from the live pages. |
| CMS admin login | Try the login page and a password reset to your own email | Recoverable if you have hosting or database access. |
| Analytics, Search Console, listings | Check whether your own email has owner access | Historic data may be lost. New accounts can be created. |
Notice the ranking. Everything except the domain can be rebuilt with time and money. The domain cannot, which is why every step below is ordered around it.
How do I check who holds my domain?
This takes about two minutes and it decides how the rest of this goes.
- Run a WHOIS or RDAP lookup on your domain. Any of the free public ones will do.
- Read the registrar name. That is the company the domain actually lives with, and the company that can help you later.
- Read the registrant, if it is shown. Many domains use privacy protection, which hides the name. That is normal and does not mean anything has been taken from you.
- Try a password reset at that registrar using your own email address. If a reset email arrives, the account is probably already yours.
If that reset email arrives, you are in a much better position than you think, and most of what follows is unnecessary.
What order should I do this in?
The sequence matters more than any individual step. Ask for things in the wrong order and you can end up locked out of a site you could still read yesterday.
- Take a backup before you say anything. If you can still log in anywhere, export it now: files, database, or at minimum save every page. Do this first, every time.
- Write one dated email listing exactly what you need. Not a complaint. A list: registrar access, hosting access, CMS admin, a full backup, and owner access on analytics.
- Secure the domain. Once you have registrar access, change the password, turn on two factor authentication, and check the registrant email is one you control.
- Then move hosting if you want to. There is no rush once the domain is yours, and moving hosting while someone else holds the domain solves nothing.
- Rebuild access to analytics last. It is the least urgent and the most often forgotten.
Take the backup before the conversation, not after it. That is the one piece of advice on this page I would not budge on.
Almost nobody deletes a site out of spite. What actually happens is duller: an unpaid invoice triggers an automatic suspension, or a hosting account lapses in a month when nobody is talking, and the files go with it. A backup taken while you still had access costs ten minutes and removes the worst outcome from the table entirely.
What does a domain transfer actually involve?
If the domain sits in someone else’s registrar account, moving it to yours follows rules set by ICANN, and they apply to every registrar. Knowing them stops you being told that something impossible is happening.
| Step or rule | What it means for you |
|---|---|
| Unlock the domain | The current registrar has to remove the transfer lock. It is a setting, not a negotiation. |
| The AuthInfo code | A one time authorisation code from the current registrar. No transfer happens without it. |
| 60 days after a change of registrant | Changing the registered owner triggers a 60 day transfer lock, though some registrars let you opt out beforehand. |
| 60 days after registration or a previous transfer | A newly registered or recently transferred domain cannot move again yet. |
| Approval | The transfer is confirmed by email to the registrant address on file, which is why that address matters so much. |
Rules as published by ICANN: five things registrants should know about the Transfer Policy and the registrant transfer FAQs.
There is a useful shortcut here. You do not have to move registrars at all. If the domain sits in an account you can be given access to, being made the account holder is faster than a transfer and avoids every lock above.
What if they will not respond?
Work down this list in order. Most situations end at step one or two, and each step costs more time than the one before it.
| Step | What it is | Realistic outcome |
|---|---|---|
| 1. A dated written request | One email, a specific list, a reasonable deadline such as ten working days | Resolves most cases, and creates the paper trail everything later depends on. |
| 2. Contact the registrar directly | Phone the registrar named in your WHOIS lookup and explain the situation | They will tell you what proof of ownership they accept, often a company document and billing records. |
| 3. File a complaint with ICANN | ICANN’s transfer complaint form, which covers registrar conduct only | Useful when a registrar is refusing a valid request. It does not settle a dispute with your designer. |
| 4. Take legal advice | A solicitor’s letter, or a small claims action depending on the amounts | Sometimes the only route when there is a contract dispute underneath. |
| 5. Rebuild on a new domain | Start again and redirect whatever you can | The last resort, and worse than it sounds. You lose the search history attached to the old address. |
ICANN’s transfer complaint form is at forms.icann.org. It covers registrars, not web designers.
Step five is not a real alternative to step one. Moving to a new domain throws away every link and every year of search history pointing at the old one. Treat it as the thing you are avoiding, not as your backup plan.
What not to do
- Do not threaten before you have a backup. The moment a relationship turns, access has a habit of disappearing.
- Do not cancel the hosting payment to force the issue. That usually takes your own site down, and the files with it.
- Do not start a chargeback on the domain registration while the domain is still under their control. It can get the domain suspended rather than released.
- Do not accept a verbal promise. Ask for the account, not the assurance. An account you can log into is the only thing that settles this.
How do I stop this happening again?
Whoever builds your next site, four lines in writing prevent this entire situation, and none of them are unreasonable to ask for.
- The domain is registered in your name, in an account you control, from day one.
- You hold owner level access to hosting, Analytics and Search Console.
- On final payment, rights in the design, code and content transfer to you.
- A full backup of files and database is provided on request, within a stated number of working days.
The longer version, including what to ask before hiring anyone, is in questions to ask a web designer and who owns your website.
In ten years I have seen this go badly perhaps a dozen times, and in only two of those was anyone being malicious. The rest were people who had stopped replying because the relationship had gone quiet and the conversation felt awkward.
That is worth remembering when you write the first email, because tone decides how fast this moves. A short, warm, specific message asking for five things by a date tends to get answered. A message that opens with the word legal gets forwarded to someone slower than the person you were already talking to.
Common questions
How do I find out who owns my domain name?
Run a WHOIS or RDAP lookup on your domain and read the registrar name. The registrant name is often hidden by privacy protection, which is normal. Trying a password reset at that registrar with your own email tells you whether the account is already yours.
Can a web designer legally hold my website hostage?
It depends on what was agreed and what has been paid. If a designer registered the domain in their own name and nothing was signed, they may hold it legitimately even though it carries your business name. That is why the registrant field matters more than who paid the invoice.
How long does it take to transfer a domain to a new registrar?
Usually a few days once it is unlocked and you have the AuthInfo code. It can be blocked entirely for 60 days after a change of registrant, or after a recent registration or transfer. Being added to the existing account avoids those locks.
What if I never signed a contract?
Then invoices, emails and payment records become your evidence, which is exactly what a registrar will ask to see. It also makes a negotiated handover more attractive than a formal dispute, because the legal position is usually less clear than either side expects.
Should I just rebuild on a new domain instead?
Only as a last resort. A new domain starts from nothing in search terms, and every existing link points somewhere you no longer control. It is usually cheaper to keep negotiating for the old one, even for several more weeks.
Once you have it back
Check what a machine can actually read on the site you have just recovered. Nine checks on your homepage, ten seconds, no email.