The message you send does not get read. Not read at 3pm and ignored, just never read at all. Your website is still up, the contact form still works, and somewhere there is a person who holds the password to every part of it.
This is the ordinary version of the story. The developer did not vanish dramatically. They took a full-time job, or the freelance work dried up, or they quietly stopped replying to the client who pays the least. Nothing breaks immediately, because the services keeping your site alive were paid up in advance and have not come due yet.
The problem surfaces on the day you need something changed.
The gap between paying for something and controlling it
Paying the invoice buys you a website. It does not automatically put your name on the five areas of control that determine whether you can keep it: the domain registration, the DNS and email routing, the hosting account, the site files and database, and the CMS and third-party services sitting on top.
Those five live in different places, often under different companies, and a developer working quickly will often open all of them under their own account because it is faster. No bad intent required. Registering a domain on an account that is already open is quick. Walking a client through creating their own account, verifying an email and setting up billing is not.
The bill for that shortcut arrives later.
One thing worth separating early: account control and legal ownership are different questions. Holding the logins means you can run the site. Whether you own the copyright in a custom build, or hold valid licences for premium plugins and stock images, depends on what your contract says and what the licences allow. Get both, and do not assume one delivers the other.
Why the domain is the first thing to check
Hosting can be rebuilt. Code can be rewritten, expensively, but it can. A domain you do not control is the item most likely to be lost outright.
For .my domains, MYNIC Berhad, the official .MY registry, splits control across three contact roles that are nowhere near equal. MYNIC’s documentation sets out what each may do:
| Contact role | What it can do |
|---|---|
| Administrative | Change the registrant, transfer the domain, delete it, appoint every other contact |
| Technical | Change nameservers, update its own contact record |
| Billing | Submit a registrar transfer, view invoices, update its own contact record |
Read the first row again.
The Administrative Contact can change who the domain is registered to, or delete it. Note also that MYNIC treats two operations differently: changing the registrant requires the Administrative role, while moving the domain to a different registrar can be submitted by either the Administrative or Billing contact. If your developer holds Administrative and you hold Technical, you can point the domain at a different host and little else.
MYNIC expects the Administrative Contact for a company domain to be an authorised employee of the registrant organisation. In practice that means you, not your contractor.
What do you actually need to collect from them?
Five: the registrar account for the domain, wherever DNS and business email are actually managed, the hosting control panel, the site files and database, and the CMS plus any third-party services such as payment gateways. Alongside those, get the contract terms and licence details in writing.
Two of these deserve more detail, because this is where handovers usually go wrong.
DNS is the one people assume they already have. It is common for a domain to be registered in one place, its DNS served by another such as Cloudflare, business email running through Google Workspace or Microsoft 365, and the site itself sitting on a fourth provider. Getting the hosting login does not hand you any of the other three. Ask explicitly where the DNS records are edited and where email is delivered, because finding out later usually means finding out during an outage.
A WordPress administrator account is not the same as hosting access either. An admin can install a backup plugin and, on most hosts, produce a genuine copy of the database and files that is good enough to migrate with. What an admin account cannot reach is the layer underneath: server configuration, SSL, and the billing relationships keeping everything alive. Some managed hosts also restrict which plugins can run at all. Treat admin access as useful but partial.
Source code matters more than people expect on custom builds. For a standard WordPress site, the theme and plugins are recoverable from the server. For anything bespoke, find out where the repository lives and get it moved into an account your company controls, rather than being added as a member of the developer’s account. Permission models differ across GitHub, GitLab and Bitbucket, so the thing to confirm is not a job title but a capability: can you, today, transfer that repository without anyone else approving it?
The 60-day trap, and when it applies to you
This one catches people who do everything else right.
You finally get access. You immediately update the registrant details to your own name, feeling responsible about it. Then you try to move the domain to a registrar you actually like, and it will not move.
Under ICANN’s Change of Registrant policy, in force since 1 December 2016, registrars must apply a 60-day transfer lock after a material change to the registrant’s name, organisation or email address. Some let you opt out, but only if you ask before making the change, and none are obliged to offer it. This governs generic top-level domains such as .com and .org; a .my domain sits with MYNIC under its own rules, so check rather than assume.
Where the lock applies, reverse the order. Transfer the domain first, then update the registrant details once it has landed.
Confirming you really have it
Access that has never been tested is not access. Before treating a handover as finished, do these yourself, from your own machine, without asking the previous developer for anything:
- Log into the registrar and confirm the registrant is your business, that you can reach the renewal settings, and that you could start a transfer without asking anyone. Test for that capability rather than for a particular field name, since contact fields vary by extension and ICANN no longer requires an administrative contact to be displayed at all. On .my, check the Administrative Contact specifically
- Take a full backup, files and database together, and restore it somewhere separate such as a staging site or a local install, because an archive that opens is not the same as a backup that restores
- Check the recovery email and any two-factor authentication on the registrar, DNS, hosting and CMS accounts, since a password you changed still fails if password resets land in someone else’s inbox
- Send a test enquiry and confirm the notification reaches an address you control
That last one is worth doing even when everything else looks fine. Form notifications are set up once, during the build, and nobody revisits where they point.
If any step fails, you have not completed the handover. You have received a promise about one.
When they simply never reply
Everything above assumes cooperation. If the messages keep going unanswered, the work changes shape, because you are no longer collecting access. You are reconstructing it.
Start by writing down what you can already reach today, even partially. A CMS login, an invoice with an account number, an old email confirming a domain registration: each one is evidence of a relationship with a provider, and providers are the people who can actually help you.
Then take a copy of whatever you can, immediately, before anything lapses.
From there it becomes a series of account recovery requests rather than one conversation. Registrars and hosts all have a process for this, and they will ask you to prove the account belongs to your business. Company registration documents, payment records showing your business paid the invoices, and matching billing details are the kind of proof that works. What usually does not work is asserting that you paid someone who paid them.
Be realistic about the limit. If a domain is registered in the developer’s own name rather than your company’s, no support desk can simply reassign it to you, and the route runs through your contract or a formal dispute process instead. That is the single clearest reason to check the registrant field while the relationship is still friendly.
What it costs to skip this
The scenario people picture is a developer holding a site hostage. The one I have more often been called in to deal with is duller: nobody is refusing anything, the developer is just unreachable, and a domain renewal notice is sitting in an inbox no one monitors.
Expiry then runs through stages. There is usually a grace period during which you can still renew normally. After that a domain may enter a redemption period, where recovery is possible but carries a restoration fee well above a standard renewal. Only after the deletion process completes does the name return to general availability, at which point anyone can register it. Exact windows and fees vary by registrar and by extension, so the practical lesson is to control the renewal notice rather than to memorise the timeline.
Collecting the five items above can be done quickly when the developer cooperates. The transfers themselves have their own waiting periods that no amount of preparation removes, which is the argument for starting before you urgently need to. If you are choosing someone new at the same time, the questions worth asking a web developer cover what to settle before work starts, since agreeing on access from day one is far easier than reclaiming it afterwards.
Once you do hold everything, keeping a tested restore in place is the part that matters most. That is covered in more depth in what actually protects a business when a site goes down.
Questions people ask
Can a developer legally keep my domain name?
It depends on the contract, who is recorded as registrant, and the law that applies. If they are listed as the registrant, the registration is in their name and you may need to rely on contractual terms or a formal dispute process rather than a simple request. Being merely the Administrative Contact gives practical control without ownership, which is a different and usually easier problem.
My developer says the site is on their own hosting. Is that a problem?
It works while the relationship does and becomes a problem when it ends. Shared reseller hosting often has no way to give you independent, permanent access, so plan on migrating to an account billed in your own name.
I only have WordPress admin. What can I still do?
More than people assume. On most hosts you can install a backup plugin and take a real copy of the database and files. What you still lack are the accounts underneath, which may be spread across a registrar, a DNS provider, an email provider and a host, so treat this as protecting your content while you chase the rest.
Should I change all the passwords immediately?
Change them, but check the recovery email and two-factor settings first. A password change alone does not remove someone who can still trigger a reset.
Want a second pair of eyes on what you currently control? Drop me a WhatsApp at +60174272807 and I will tell you what is missing.