Summary: The developer who built your site has stopped answering, and you have discovered you cannot log in to your own website, change a phone number, or even work out who is hosting it. This is one of the most common calls we get, and it is almost always recoverable. This guide covers the three accounts that actually matter, how to find them when you have no passwords and no paperwork, how to prove a .ca or .com domain is yours, how to get the site running again without the old hosting, and how to close the door behind you so it never happens twice.
The emails stopped being answered. The phone number still rings but nobody picks up. And somewhere in the middle of trying to change your opening hours, you discovered something worse than an unhelpful developer: you cannot get into your own website at all.
The short answer
- You almost certainly still own everything. What you have lost is access, and that is an administrative problem, not a legal one.
- Three accounts matter: the domain, the hosting, and the website login. In that order of importance.
- You can usually find all three with a bank statement and a public WHOIS lookup, without the developer.
- The domain is the thing to fight for. You can put a site back online in a day; you cannot re-earn ten years of rankings.
- Check where your email lives before you change anything — it is often on the same hosting.
- Most of these are resolved in a few days. Registrars and hosts handle this every week.
What you own and what you only rent
The first thing worth saying, because it is the thing everyone in this situation gets wrong: a developer going quiet does not mean you have lost your website. It almost always means you have lost the keys to it.
Those are very different problems. One is a disaster. The other is paperwork.
A website is not a single thing you either have or do not have. We see this every few weeks with Toronto businesses whose site was set up years ago and never thought about since. It is four separate things, usually bought from four different companies, and a business owner who has never had to think about it often assumes the person who set it up holds all four on their behalf. Sometimes they do. That is exactly the problem.
| The piece | What it really is | Who usually holds it |
|---|---|---|
| The domain yourbusiness.ca |
A yearly registration. The single most valuable item on this list. | A registrar — sometimes in the developer’s name |
| The hosting | Rented space on a server. Replaceable in an afternoon. | A hosting company, or a reseller account the developer owns |
| The website files and database | The actual pages, images and content. | Sitting on the hosting |
| The admin login | How you edit it. WordPress, Joomla, Shopify. | Whoever was given an account |
Read that table again and notice something: only one row is genuinely hard to replace. Hosting can be swapped. Files can be rebuilt. A login can be reset. The domain is the one thing that carries your search rankings, your email addresses, your printed business cards and ten years of people typing it from memory.
Everything else on this list can be replaced in a week. The domain cannot be replaced at all. If you only have the energy for one fight, have that one.
The three accounts that actually matter
Before you contact anyone, work out which of these you can already reach. Most people discover they have more than they thought, usually because a confirmation email from years ago is still sitting in their inbox.
The domain registrar
Where the domain is registered and renewed — CIRA-accredited registrars for a .ca, or the likes of GoDaddy, Namecheap and Google for a .com. This is the account to recover first.
The hosting account
Where the site physically lives. In Toronto that is very often GoDaddy, HostPapa, Bluehost, SiteGround or a reseller account belonging to the developer.
The website admin
Your WordPress or Joomla login. The least important of the three, because if you hold the other two this one can always be reset from behind.
That last point surprises people, so it is worth being explicit: losing your website password is not serious if you control the hosting. Anyone with hosting access can reset a WordPress or Joomla administrator account directly in the database. It is a ten-minute job. The panic almost always belongs further up the chain.
Finding them with no passwords and no paperwork
Here is the part most guides skip, because it assumes you have records. You probably do not. So work backwards from the two trails every business leaves.
- Search your bank and credit card statements. Hosting and domains are billed on a card, yearly or monthly, and the merchant name is the company. Search two years back for the obvious names, and for anything you do not recognise that renews on the same date each year. This one step identifies the hosting company in most cases.
- Run a public WHOIS lookup on your domain. Owner details are usually hidden now, for privacy reasons, but the registrar is always shown. That tells you exactly which company to phone, which is the fact you actually need.
- Search your email for the domain name. Registration confirmations, renewal notices and invoices from years ago are almost always still there. Search the domain itself rather than company names, and search every inbox you have ever used for the business.
- Check who the renewal notices go to. If they arrive in your inbox, the account is yours and a password reset gets you in today. If they go to the developer, you have a recovery case to make instead.
- Write down what you find. Registrar, hosting company, the email address on each account, and the dates of the charges. That list is what you will be reading out on the phone.
Do this before you contact the developer again. Not because they are the enemy — most are simply overwhelmed or have quietly closed — but because knowing what you already control changes the conversation entirely. It is much easier to ask for one specific thing than to ask for “everything”.
Getting the domain back
Three situations, in descending order of how pleasant they are. We have worked through all three for Toronto clients.
The account is in your name. Reset the password and you are done. This is more common than people expect, because a lot of developers register domains in the client’s name and then simply never hand over the login.
The account is in the developer’s name and they are reachable. What you need is not the password to their account — it is a transfer. They unlock the domain and give you an authorisation code, you open an account in your own name, and you pull the domain across. It takes a few days. Ask for a transfer rather than a login; it is a smaller thing to ask for and it leaves them nothing to keep.
The account is in the developer’s name and nobody is answering. Now it is a case for the registrar, and the currency is evidence. Gather: invoices showing you paid for the domain or the site, your business registration with a name matching the domain, card statements for the renewals, and photo ID. Every registrar has a process for this because it happens constantly. For .ca domains it runs through CIRA’s rules, which also set out who is permitted to hold a Canadian domain in the first place.
Watch the renewal date. If the domain is in an abandoned account, nobody is paying to renew it. A lapsed domain can be bought by anyone, and that turns a recoverable problem into a permanent one. Find the expiry date early — WHOIS shows it — and treat it as your deadline.
Getting the site online again
Once the domain is yours, the site is a much smaller problem — and you may not need the old hosting at all.
A domain does not contain your website. It points at it. Change where it points, and traffic follows within hours. So if you can get a copy of the site from anywhere, you can put it on new hosting and be running the same day without ever recovering the old account.
Copies turn up in more places than most Toronto owners expect: a backup plugin’s storage, an old staging site, the developer’s own archive if they respond to one last polite email, or the hosting company itself, who will often restore from their backups for the account holder.
If there is genuinely nothing, the site has to be rebuilt — but rebuild it on your domain and the loss is mostly the design. Your rankings live with the domain and the URLs, not with the files. Keep the same page addresses where you can and most of what you built survives the move.
Where the old site is still up but broken, hacked, or on software so old it has stopped working, that is a repair job rather than a recovery one. We cover that separately for WordPress and for Joomla, which is the platform most often abandoned by Toronto developers who have moved on.
Locking the old access out
This is the step people skip because by now they are tired and the site is working again. Do it anyway. An account you forgot about is a key in a stranger’s pocket, and the person holding it has every password you never changed.
- Change the password on the domain registrar account, and the email address attached to it.
- Change the hosting password, and the account’s contact email.
- Open the website’s user list and remove every account that is not a current member of your team.
- Check for FTP and database users, which are created separately in the hosting panel and survive deleting a website account.
- Check for application passwords and API keys, which outlive the user that made them.
- Change the password on any email inbox the developer had access to — otherwise a reset link lands somewhere you cannot see.
One left-behind account is the usual cause of a “random” hack months later. Nothing was random about it. If you would like this checked properly rather than guessed at, that is what our security and clean-up service does.
The email trap
This one catches almost every Toronto business we help, so it gets its own section.
If your business email is
Before you change anything, find out where your mail actually lives. If it is on the hosting, it has to be moved deliberately and in the right order. If it is on Google Workspace or Microsoft 365, it is separate and safer, but the domain records that point to it still have to be copied across intact.
Quotes and orders arriving by email are usually worth more than the website. Losing a day of them costs more than the whole recovery. If you are not certain where your mail is handled, that is the question to answer first — before the domain moves, not after.
Never being here again
Whoever builds your next site in Toronto, the arrangement should look like this. None of it is unusual, and any honest developer will agree to all of it without being asked twice.
Everything in your name
Domain, hosting and website accounts registered to you and your business, with your email on them. Your developer gets an account on your accounts, not the other way round.
You hold the logins
Even if you never use them. Keep them somewhere you will still find them in five years, which is not a sticky note on the monitor.
A backup you can reach
Stored somewhere you control, not only on the server. A backup only the developer can restore is not a backup you own.
It written down
One page listing who holds what, which company each account is with, and what happens if you part ways. Boring to write, priceless later.
We have built websites in Toronto since 2006, we put that in writing on every project, and it is why our clients can leave. It sounds like a strange thing to advertise. It is also the reason a good number of them have stayed with us for more than ten years: nobody stays because they are stuck.
If you would rather not think about updates and backups at all, that is what monthly website maintenance is for — but the ownership rules above matter whoever does the work, including if that is nobody.
Thinking about what comes next rather than just getting unstuck? Our complete guide to website design in Toronto covers what to ask before hiring anyone, what a fair quote looks like, and how to tell a rebuild from a repair. Fixed prices are on the packages page.
Common questions
My web developer has disappeared. Do I still own my website?
Almost certainly yes, but ownership and access are two different things. You own the business the site represents, and you almost certainly paid for the domain, the hosting and the design. What you may not have is the logins. Recovering them is an administrative job with registrars and hosting companies rather than a legal fight, and in most cases it takes days rather than weeks. The exception is a developer who registered the domain in their own name and will not release it, which is a smaller problem than it feels but does take longer.
How do I find out who is hosting my website if I do not know?
Two places. First, your bank and credit card statements: hosting is billed monthly or yearly and the name on the charge tells you the company, whether that is GoDaddy, Bluehost, SiteGround, HostPapa or a reseller. Second, a public WHOIS lookup on your domain will show which registrar it sits with even when the owner details are hidden. Between the charge and the registrar you can almost always identify both accounts without the developer.
Can a web developer legally hold my domain name hostage?
If the domain is registered in their name they control it, and no amount of arguing changes that on its own. What does change it is evidence: invoices showing you paid for it, your business registration matching the name, and a clear paper trail. Registrars deal with this regularly and have a dispute process. For a .ca domain, CIRA sets the rules for who may hold one and how registrant changes work. Get the evidence together before you contact anyone, and take legal advice if the amount at stake is large.
Do I need the old hosting account to get my website back online?
Often not. If you control the domain and you have a copy of the site, you can point the domain at completely new hosting and be running again the same day. The old hosting only matters if it holds the only copy of the site, or if your business email runs through it. That second one catches people out, so check where your email actually lives before you change anything.
How do I stop my old developer getting back in?
Change every password on the accounts you keep, starting with the domain registrar and the hosting. Then look at the website's own user list and remove any account that is not yours. Administrator accounts leave things behind that outlive them, so also check for FTP users, database users, application passwords and API keys created by the old developer. Finally, check the email address attached to each account, because a password reset sent to an inbox they still read undoes all of it.
Should I rebuild the site instead of trying to recover it?
Usually recover first, rebuild later if you want to. Recovery is cheaper and it protects the thing that actually has value, which is your domain and your search rankings rather than the design. The honest exceptions are a site built on software so old it cannot be updated safely, and a site where nothing can be recovered at all. Even then, getting the domain back first matters more than the pages, because the domain is what your rankings and your email are attached to.
Locked out of your own website?
Tell us what you can and cannot get into. We have recovered domains and sites for Toronto businesses with no passwords, no paperwork and no developer — and we will tell you honestly what is recoverable before you spend anything.
