Your Web Developer Left: Who Maintains Your Website Now?

If your web developer left, nobody maintains your website until you decide who will, and in the meantime the domain, hosting and security updates are still running on whatever the developer set up. The first job is not finding a replacement. It is finding out which accounts you control, taking back the ones you don't, and making sure nothing lapses while you do.

This guide walks through that in order: what to check in the first week, how to recover each account, and how to choose who maintains the site from here.

Why a developer leaving puts your website at risk

A website is not one thing. It is a handful of separate accounts that a developer often set up in their own name because it was quicker at the time:

• The domain name, held at a registrar. If it isn't renewed, the site and your email stop working.
• The hosting, where the website's files and database live.
• The code and content, which may sit only on the developer's computer or in their own code repository.
• The website admin, such as a WordPress or Shopify login.
• Google accounts, including Search Console, Analytics and your Google Business Profile.
• Email and DNS settings, which decide where your email is delivered.

While the developer was around, they quietly handled renewals, updates and fixes. When they leave, those jobs stop. Card payments fail, plugins go out of date, and a renewal notice goes to an inbox nobody reads. If you are not sure whether you legally own the site in the first place, read who owns your website after a developer builds it alongside this one. This article is about getting practical control back.

What to do in the first week

Start with the things that can break without warning.

1. Check the domain renewal date. Look your domain up on ICANN Lookup. It shows the registrar and the expiry date. If the domain expires in the next few months, renewing it comes before everything else.
2. Check who pays for hosting. Find the last invoice or card payment. If it went on the developer's card, it may stop when they leave.
3. Write down every login you have. Note which email address each one is tied to. An account recovery email going to the developer's address is the most common problem.
4. Take a copy of the site. If you have any access to the hosting or admin, download a full backup of the files and database now, before anything changes.
5. Ask the developer for a handover. Many departures are friendly. A polite written request listing exactly what you need, sent while they are still easy to reach, solves most cases in a day.

How to take back each part of your website

The domain name

The domain matters most, because your email and website both depend on it. Two names matter at the registrar: the registrant (the legal holder) and the account holder (whoever can log in).

• If you are the registrant but the developer holds the account, ask the registrar to move the domain into an account in your name. Registrars handle this often and will ask you to prove you are the business named on the domain.
• If the developer is the registrant, the domain needs a change of registrant. Under ICANN's rules for registrants, your registrar must give you the transfer code (the AuthInfo code) within five calendar days of your request. Changing the registrant can also put a 60-day lock on moving the domain to another registrar, so do one change at a time.
• For .uk domains the registry is Nominet, and the change of registrant goes through Nominet rather than the registrar's control panel. The process for a .uk registrant transfer needs the new registrant to accept within five days.

Keep invoices, bank statements and emails that show your business paid for the domain. If the developer won't cooperate, that paper trail is what the registrar will look at.

The hosting account

Contact the hosting company directly. Explain that the site belongs to your business, and ask whether they can move it into an account you control or add you as the account owner. If the hosting sits inside the developer's reseller account, the simplest route is often to move the site to new hosting in your own name, using the backup you took in week one.

The code and the website admin

For a WordPress, Shopify or similar site, ask for an administrator login on your own email address, then remove the developer's accounts once you have checked yours works.

For a custom-built site or web app, ask for the full source code, the database, and access to the code repository if there is one. Ask, too, for the notes a new developer would need: how the site is deployed, which services it connects to, and where any passwords or API keys are kept.

Google Search Console, Analytics and your Business Profile

These hold years of data about your visitors and your search rankings, and they are easy to forget. In Search Console, Google's own guidance on managing owners and permissions says that if the only verified owner leaves, you should verify ownership yourself to keep or regain access. Once you are verified, you can remove the previous owner by deleting their verification token from the site.

Do the same for Google Analytics and your Google Business Profile. Add your own business email as an owner first, then remove the developer.

Email and DNS

DNS records decide where your email goes. Before anyone changes nameservers or moves the domain, make a note of the current DNS records, especially the MX records for email. Moving a domain without copying those records is a common way to lose email for a day or more.

When the developer won't hand things over

Most handovers are straightforward, but not all. If the developer has gone quiet or refuses:

• Put the request in writing, listing each item, and keep a copy.
• Go to the providers directly. Registrars and hosting companies can transfer accounts to the rightful business once you prove who you are.
• Check your contract or invoices for what was agreed about ownership of the code, domain and design.
• As a last resort, rebuild. If the code can't be recovered, the public content (text and images you supplied) can usually be moved to a new site. It costs more than a handover, but it ends the dependency for good.

If your country's rules on contracts or copyright apply to the dispute, get legal advice. They differ between the UK, Pakistan, Saudi Arabia and elsewhere.

Who should maintain your website now?

Once you have control again, decide who looks after the site from here. There are three common choices.

Whichever you choose, the rule that would have prevented this is simple: every account stays in your business's name, and other people get their own logins. That way, when someone leaves, you remove one user instead of chasing a whole website.

Good ongoing care should cover security and software updates, regular backups, uptime checks, domain and certificate renewals, and small content changes, with a named person to call when something breaks.

Make sure it doesn't happen again

• Keep a simple access list: each account, its login email, who has access, and when it renews.
• Use a business email address that you control, not a personal one, as the owner of every account.
• Turn on two-step verification or passkeys. The UK's National Cyber Security Centre lists your company website and domain hosting among the accounts to secure first, and advises removing accounts that people who have left no longer need.
• Review who has access every few months, and after anyone leaves.
• Keep regular backups stored somewhere other than the hosting itself.

Frequently asked questions

If your developer has left and you aren't sure what you control, we can help. We start by checking your domain, hosting and Google accounts, recover anything that is out of your hands, and then keep the site updated and backed up. See our managed website maintenance service, or book a free consultation to talk it through.