Web Developer Disappeared? Take Back Your Website (October 2026)

Your text, photos, logo and customer data are yours, and usually the domain and hosting are too, or can be moved to you. What decides it is whose name is on each account.

Don't panic. A developer going silent doesn't switch your site off, and nothing changes until something expires. So check two dates first: when the domain expires and when the hosting renews. A free registration lookup shows the domain's expiry in a minute, and my guide to finding out who hosts your website shows how to run one.

Then sort what you find into three piles:

• In your company's name, login lost. A password reset or a support ticket gets you in.
• In your company's name, login email is the developer's. The company will change the email once you prove who you are.
• In the developer's own name. The slow pile, covered below.

In my experience most sites land in the first two piles.

You need four things: the domain registrar account, the hosting account, the website's admin login, and control of the DNS that also runs your email. Get those four and the old developer stops mattering.

Email is the one people forget. If it runs on Google Workspace or Microsoft 365, its admin account is a fifth login, often held by the developer too.

Contact the registrar directly, show that your business is the registrant named on the domain, and ask them to move the account login to a company email. If you're the registrant, the registrar answers to you.

1. Try the registrar's "forgot password" page with every email the account might use. If the reset would go to the developer, move to step 2.
2. Open a support ticket saying your company is the registrant and the account email belongs to a developer who no longer responds. Ask what they need.
3. Have your proof ready: your ACRA business profile from Bizfile (it shows your UEN and directors), a director's ID, and any invoice or card statement showing your company paid.
4. Once you're in, change the account email to a company address, switch on two-factor login and turn on auto-renew.

For .com and other generic domains, a change to the registrant's details can put a 60-day lock on moving to another registrar. ICANN's rules let registrars offer an opt-out, so ask first if you plan to move.

For a .sg domain, the change of registrant goes through your registrar, the current registrant has to approve it from an email SGNIC sends, and the administrative contact then verifies the new details with Singpass or Corppass. SGNIC is the registry that runs .sg, and its FAQ sends you back to your registrar: "Please consult your registrar on its transfer procedures."

• The current registrant must approve. The current registrant gets an email from SGNIC that must be approved, and the change takes about 7 days, according to registrar CentralNic's .sg notes. If the developer is the registrant, that email goes to them.
• Verification follows. Under SGNIC's VerifiedID@SG rules, the administrative contact must verify the new details through Singpass or Corppass. Until then the domain can't be renewed.
• Check the administrative contact too. If it's your old developer, ask the registrar to change it to one of your directors in the same request.

When I checked on 24 October 2026, a .sg lookup showed the registrant's name, the administrative contact's name and the VerifiedID status. Check all three before you ring anyone.

If the domain is in the developer's own name, they are the registrant, and the registrar can't simply hand it to you. You need their approval, a formal dispute, or a new domain. Start this one first.

1. Ask in writing, with the message further down. Developers who've gone quiet are usually busy or embarrassed rather than hostile.
2. Make sure the renewal gets paid. Don't let a business domain lapse and hope to grab it back. Once an expired name is released, anyone can register it.
3. Gather evidence: the contract, invoices that mention the domain, payment records.
4. Send a lawyer's letter if that fails. It costs far less than a dispute.
5. Use the dispute process last. For .sg, that's the SDRP, run by the Singapore Mediation Centre. You must show the domain matches a name or trademark you have rights in, that the registrant has no legitimate interest in it, and bad faith. The fee is SGD 2,997.50 including GST for one panellist and up to five domains, and the panel can order the domain transferred to you. For .com, the equivalent is the UDRP, which WIPO administers.

Sometimes the honest answer is a new domain. If the old address gets little Google traffic, registering a new one in your company's name and rebuilding can cost less than the fight. It's also the moment to get off PHP: in August I moved MET Interior's 176-page site from WordPress to Astro, which leaves no PHP on the server for a bug like this month's to reach.

If the hosting is billed to your company, the host will reset the login once you prove you're the account holder. If your site sits inside the developer's own account, you need them to move it out.

Look for the host's invoices first. A yearly charge to your company card from a hosting company means the account is very likely yours. Send the host's support the invoice number, the domain, the card's last four digits and your ACRA business profile, and ask them to change the login email.

The harder version is common. Plenty of developers host clients inside one big reseller account of their own. You'll know because you never got a hosting bill, only a yearly "hosting and maintenance" invoice from the developer. Then you aren't the host's customer. Ask the developer for a full backup (files and database) or a move into an account in your company's name. If neither happens, rebuilding from the live site is the fallback.

Try the "Lost your password?" link on the login page first. If the reset email goes to the developer, change the password through phpMyAdmin in your hosting account, a method in WordPress's own documentation.

1. Go to yourcompany.com.sg/wp-login.php and click "Lost your password?". If an admin email on the site is yours, you're done.
2. If not, log in to your hosting panel, take a backup, and open phpMyAdmin, the panel's database editor.
3. Open the WordPress database, then the users table (usually wp_users).
4. Edit the admin user, type a new password into user_pass, choose MD5 from the function menu and save. WordPress's password reset guide shows each screen.
5. Log in, create a new administrator with a company email address, then change the old developer account's password or delete it.

While you're in Users, look for any administrator you don't recognise. That can be a sign of a break-in, and my guide to the first 24 hours after a WordPress hack covers what to do.

Find out where your email runs before anyone touches the DNS, because changing nameservers without copying the email records is the quickest way to lose company email.

A lookup of your domain's mail records (MX records) tells you whether email runs on Google Workspace, Microsoft 365 or your host. Screenshot every record in the current DNS before anything moves.

If email runs on Google Workspace and the only administrator was the developer, Google has a route for exactly this. You prove you own the domain by adding a CNAME or TXT record to your DNS, and Google can then reset the admin password, Google's recovery article explains. The record can take up to 24 hours to show up. You need the DNS for this, which is why I recover it before email. For Microsoft 365, start with Microsoft's support.

The domain belongs to whoever is named as registrant, your own text, photos and logo stay yours, and the code and design depend on your contract, because under Singapore's Copyright Act 2021 the author is the default first owner. This is general information, not legal advice.

• The author owns it first. Section 133 of the Copyright Act 2021 makes the author the default first owner of a work.
• Employees are the exception. Section 134 makes the employer the first owner of work an employee creates in the course of employment. An outside developer isn't your employee.
• A written agreement can change the default. Plenty of web contracts say copyright passes to the client on final payment, so find yours and read that clause.
• Commissioned photos and films belong to the photographer or filmmaker by default since 21 November 2021, IPOS says, though you can keep using them for the purpose you commissioned them for.

In practice, access is the sticking point far more often than copyright. WordPress itself and many plugins are open source under the GPL licence, so nobody owns those over you. Ownership matters with custom work, like a bespoke theme or a booking system, and if the contract says nothing, ask a lawyer.

Send a short, polite message that lists what you need, gives a date and offers to settle anything genuinely owed, by email and WhatsApp. Copy this and fill in the brackets:

Hi [name],

Hope you're well. After the PHP security alert of 21 October 2026, we're taking over the accounts for [yourcompany.com.sg] ourselves.

Could you please send or arrange the following by [date, 7 days from today]:

1. Domain: change the registrant and admin contact to [company name, UEN], or tell us the registrar and the account so we can request it.
2. Hosting: access to the account, or a full backup (files and database) and help moving it to an account in our name.
3. Website: an administrator login for [company email].
4. Anything else you set up for us: DNS or Cloudflare, Google Workspace or Microsoft 365, Google Analytics and any plugin licences.

If there's an outstanding invoice for work on our site, please send it and we'll settle it. If we haven't heard from you by [date], we'll contact the registrar and the host directly.

Thanks,
[your name], [company]

Keep it friendly. A developer who feels accused goes quieter. If the date passes, you have a dated record to show the registrar or a lawyer.

Put every account in your company's name with a company email, keep the logins in a shared password manager, and get a one-page handover document from whoever builds or looks after your site. This is the setup I hand clients:

• Accounts in the company's name, on an address like admin@yourcompany.sg that survives staff changes.
• Your developer as a guest. Add them as a user on your accounts. Never the other way round.
• A shared password manager. A business plan from Bitwarden or 1Password lets you share a vault and remove someone in one click.
• Auto-renew on a company card, with the domain's expiry date in your calendar as a backup.
• A contract clause saying copyright in the work passes to you on final payment.
• A handover document listing the registrar, DNS, host, email provider, plugin licences, where backups go and every renewal date.

And someone has to own the upkeep. My content retainer covers updates, backups and security plus 5 hours of changes for SGD 550 a month, month to month, through my website maintenance service.

That depends on the PHP version it runs, which can be checked from outside without any login. If it's on PHP 8.1 or older, or nobody can tell you, treat it as urgent.

PHP fixed two critical flaws, known as PHP2Shell, on 21 October 2026 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and released nothing for 8.1 and older. Most shared hosts patch their own servers, so a site on ordinary shared hosting may already be fixed. My guide to the PHP vulnerability has the full 24-hour plan, and how to check your PHP version shows you how to read the number once you're back in.