WordPress takeover
Web developer disappeared? Get your WordPress site back
You paid someone to build your website. Maybe it went live, maybe it's half finished. Now they don't answer email, and they hold the logins. You can't change a page, renew anything or even tell whether the site is safe.
It is a common story. A freelancer was paid upfront and went quiet, or the build ran months late and the site still runs through the developer's own dashboard, so the owner can't edit it. In most cases you can get control back. It takes some paperwork, and you need to do the steps in the right order.
01
First, find out what you actually own
A website is three separate things, often with three separate companies:
The domain name. It's registered with a registrar (GoDaddy, Namecheap, a local .co.za registrar and so on). Whoever is listed as the registrant controls it.
The hosting. The server where the WordPress files and database live.
The WordPress admin. The login at yoursite.com/wp-admin.
Get the domain back first. If you control the domain, you can point it at a new host even if the old hosting account stays locked.
02
Getting the domain back
- Run a WHOIS or RDAP lookup on your domain. Many registrars hide personal details, but the lookup still shows which registrar holds it.
- Contact that registrar. Tell them you're the business owner and the domain was registered for you. They'll usually ask for proof: invoices, payments to the developer, emails where you asked for the site, business registration documents.
- For .co.za domains, the registry is ZARC, and changes go through your registrar. The process is the same idea: prove the domain is yours.
- Check the renewal date. If it expires while you're waiting, someone else can register it.
03
Getting the hosting back
- Look through your bank statements and email for hosting invoices. If you've been paying the host directly, the account is probably in your name and the host can reset the password.
- If the developer paid for hosting and billed you, the account is theirs. Ask the host for help anyway; some will move the account across with proof of ownership. If they won't, you may need to rebuild from a backup or from the live site.
04
Getting WordPress admin back
With hosting access you can get into WordPress even without a password. Through the host's file manager or phpMyAdmin you can reset the admin password or add a new admin user. Then delete or downgrade any admin accounts you don't recognise.
05
Check what the old developer left behind
Once you're in, don't assume the site is clean. Look for:
- Admin users you don't know about, including ones with generic names
- Plugins that are inactive, nulled (pirated premium plugins) or no longer updated
- Old copies of the site in subfolders, like /old/, /dev/ or /backup/
- Files in the hosting account that don't belong to WordPress
- FTP, SSH or database users that still have the developer's access
- A theme with custom code and no record of what it does
- Licence keys for paid plugins that are registered to the developer, not you
Then change every password: hosting, FTP, database, WordPress admin and the email accounts tied to them.
06
Finishing or rebuilding the site
If the build was never finished, someone has to decide whether to complete what's there or start again. That depends on how the site was built and how clean the code is. Our developers can look at it and tell you which makes sense.
Free scan
Start with a free scan
A free CrawlCare scan shows what the site runs, which plugins are out of date and what security problems are visible from outside. It's a good starting point before you take over. If you want help with the domain, hosting or the cleanup, have a chat with us.
Talk to us