The website works, but nobody answers your emails. A hosting invoice arrives from a company no one recognises. The SSL certificate expires in two weeks, and the only person who “knew how it all works” left a year ago.
We see this scenario regularly - and it almost always ends without disaster, on one condition: you act in the right order.
Rule number one: don’t touch what works
As long as the website and email are running, time is on your side. The most damage in these situations comes from nervous moves: changing DNS “just to try”, installing migration plugins, registering a new domain “next to” the old one because “it will be faster”.
Before you change anything, establish the facts. That is usually one day of work, not weeks.
Step 1: establish who formally controls what
Three questions you need answered:
- Domain - who is the registrant (owner), and who is merely an intermediary? You can check registrant data in the registrar’s WHOIS database. If your company is the registrant, you are in a good position. If the vendor is - that is the first problem to solve.
- Hosting - where does the site physically live? Invoices will tell you, and technically: the site’s IP address and DNS records. The more important question: whose name is on the hosting account?
- Email - does it run on the same hosting as the website, or separately (Google Workspace, Microsoft 365, a local provider)? Email is usually the most critical service - an email outage hurts more than an hour of website downtime.
Step 2: secure what you can already reach
Before you start recovering the rest, copy what is within reach:
- Content backup - if you can log in to the CMS, export the content and the database (most panels allow this without technical help).
- List of services and expiry dates - domain and certificate expiry, hosting plan, mailboxes. An expiring domain is the only piece of this puzzle that can be lost irreversibly.
- Correspondence and contracts - invoices and the vendor agreement will be the basis for recovering access with providers.
Step 3: recover in order of importance
The order is not accidental: domain → email → hosting → CMS → analytics.
The domain comes first because it controls everything else. If your company is the registrant, the registrar is obliged to let you manage the domain and issue a transfer code - even if an intermediary handled everything until now. Prepare your company documents: in practice the procedure comes down to confirming the registrant’s identity.
If the vendor is formally the registrant, the situation requires negotiation or a formal route - but even then, the contract and invoices for “domain maintenance” are a strong argument that the domain was purchased on your behalf.
Hosting is often easier than it looks: providers have procedures for losing contact with an account administrator, and a copy of the files and database can often be obtained faster than the account itself.
What not to do
The most expensive decisions in these situations are made in the first 48 hours - out of emotion, not analysis.
- Don’t register a “backup” domain and move communication to it - you dilute your brand and SEO without solving the problem.
- Don’t rebuild the website from scratch just because the author of the current one is unreachable. Those are two separate decisions.
- Don’t delete any accounts, mailboxes or services before everything is migrated and documented.
- Don’t agree to “buy back access” before checking what actually belongs to your company - you are often negotiating for something that is already yours.
How to avoid reading this article again in two years
Once you regain control, three rules are worth keeping: every service registered to the company (not to a private person or a vendor), access held by at least two people in the company, and one up-to-date list of services with renewal dates.
If you are in the middle of this situation and would rather go through it with someone who has done it many times - this is how project takeovers work at Invisio. And if you would first like to calmly check who controls what in your current setup, start with a free audit.