Who Hosts My Website? How to Find Out and Log Back In (October 2026)

A website usually depends on four services: the domain registrar, the DNS provider, the web host and the email provider. They can all be one company, but they're often four different ones.

My own domain shows how split it gets. When I checked on 24 October 2026, terris.sg was registered through Vodien, its nameservers were at SiteGround, the website was served by Vercel and email ran on Google. Four companies, one small website. A site a developer set up for an SME is often simpler, with everything at one host, but don't assume it.

Type your domain into lookup.icann.org. The result names the registrar, the registration and expiry dates and the nameservers. For a .sg or .com.sg address, SGNIC, the registry that runs .sg, has its own Whois search.

• For .com, .net, .org and the like, use lookup.icann.org. Personal details such as the owner's name and email are often hidden for privacy, which ICANN explains, but the registrar and dates always show.
• For .sg and .com.sg, use the Whois box on SGNIC's domain search.

A .sg lookup tells you more than most. When I ran one on 24 October 2026 it showed the registrar, the registrant's name, the administrative contact's name, the technical contact's name and email, the registration and expiry dates, the nameservers and the VerifiedID@SG status. It didn't show the registrant's email, phone or address, which SGNIC took out of public view in 2005 and 2012.

Two things to check while you're there. First, the registrar's name may not be the brand you remember: a .sg domain registered through Vodien shows the registrar as Dreamscape Networks International Pte Ltd, with vodien.com as its website. Second, look at the registrant name. If it's your company, good. If it's your old developer, that's the slow case, and the guide linked further down covers it.

Read the nameservers in the same lookup: the company named in them holds your DNS records, and that's the dashboard you need to move a site or fix email. Some patterns are easy to spot:

• Two first names followed by ns.cloudflare.com, like rocky.ns.cloudflare.com: Cloudflare. Vodien's own website uses that pair.
• Names ending in siteground.biz, like ns1.sm38.siteground.biz: SiteGround.
• Your host's or registrar's brand in the name: that company.

To double-check the live answer, open Google's free Admin Toolbox Dig, type your domain and choose NS. It reads the same public records, so it can't change anything.

Find the IP address your domain points to, then look up who owns that address. The owner is your web host, unless it turns out to be Cloudflare.

1. In Google's Dig tool, type your domain and choose A. The answer is a number like 216.150.1.1.
2. Paste that number into lookup.icann.org. ICANN's tool has looked up IP addresses as well as domains since August 2021.
3. Read the network owner's name. For terris.sg, the address comes back as Vercel, which is where the site runs.
4. Repeat with www in front of your domain. Now and then www points somewhere different.

Sometimes the owner is a cloud company rather than the brand you pay, because plenty of hosts rent their servers from Amazon Web Services or Google Cloud. If the name means nothing to you, search it with the word "hosting" and check your invoices for a match.

If your nameservers end in ns.cloudflare.com and the IP lookup says Cloudflare, Cloudflare stands in front of your site and hides the server behind it. You need the Cloudflare account, or other clues, to find the real host.

That's by design. When a record is "proxied", Cloudflare's documentation says DNS lookups are answered with Cloudflare's addresses instead of your server's. It's a good setup, and Cloudflare turned on rules against this month's PHP attacks for every plan, Free included, which my guide to web application firewalls covers. But the trail stops there. Ways round it:

• Get into the Cloudflare account. Its DNS page lists the real server address beside each proxied record. Whoever set Cloudflare up can add you as a member.
• Check the records that can't be proxied. Mail records point at your email provider, and an old record such as mail.yourdomain or ftp.yourdomain sometimes points straight at the server.
• Read an email the website sent you. Open a contact form notification and view the original message (in Gmail, "Show original"). The "Received" lines often name the server that sent it, which is usually the host.
• Follow the money, which is two sections down.

Look up your domain's MX records, the entries that tell other mail servers where to deliver your email. They name your email provider. In Google's Dig tool, choose MX:

• aspmx.l.google.com and its siblings mean Google Workspace.
• Anything ending in outlook.com, such as yourcompany-sg.mail.protection.outlook.com, means Microsoft 365.
• Your host's name or your own domain usually means mailboxes on your hosting account.

Email matters twice here. It's where every password reset will land, and it's what breaks when someone changes the DNS without copying these records. Screenshot them before anything moves.

Yes, and it's often the fastest route: search your inbox for renewal invoices and your card statements for a yearly charge you don't recognise. Try these searches in every company mailbox, including old staff accounts:

• "hosting renewal", "domain renewal" and "invoice" together with your domain name
• "cPanel", "nameserver", "welcome to your new hosting account"
• The names of hosts many Singapore businesses use: Vodien, Exabytes, SiteGround, Hostinger and GoDaddy
• For newer sites, Vercel, Netlify or Cloudflare, and for hosted builders, Wix, Squarespace or Shopify

Once you have a name, this is where you'll log in:

If the only hosting charge you can find is a yearly "hosting and maintenance" invoice from your old developer, the site probably sits inside their account rather than yours. If you're choosing a new host anyway, my comparison of web hosting for Singapore sites covers the options.

Try each company's "forgot password" page with every email the business has used. If the reset goes to an address you no longer control, open a support ticket and prove you're the account holder.

• Registrar and host: send the invoice number, the domain, the last four digits of the card that paid and your ACRA business profile. Ask them to move the login to a company email and switch on two-factor login.
• Cloudflare: if a developer set it up in their own account, they need to add you as a member or move the domain into an account you own.
• Google Workspace: Google can reset an admin password once you prove you own the domain with a DNS record, Google's recovery article explains. So get DNS access before email.
• WordPress: use the "Lost your password?" link, or reset it from your hosting account once you're in.

If an account turns out to be in your old developer's name, or the developer has simply stopped answering, it takes longer. My guide to what to do when your web developer disappeared covers domains in their name, a message to send them and who owns the site under Singapore law.

On WordPress, go to Tools, Site Health, the Info tab, then Server. In a hosting panel, find the PHP setting for your domain. You need the full number, like 8.3.36, because a panel showing "8.3" doesn't tell you if the fix is in.

PHP fixed two critical flaws, known as PHP2Shell, on 21 October 2026 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Sites on 8.1 or older got no release from the PHP project at all. Some hosts patch their own builds without changing the number, so the host has the final word. My guide to checking your PHP version shows every method and how to read the result, and if you need to switch to a newer branch, changing PHP version in cPanel has the click paths for each host above.

Ask for the exact PHP version on every site in your account, whether it includes the 21 October 2026 fix, and when PHP was last restarted. While you have them, ask two housekeeping questions too:

1. Which exact PHP version does each site and staging copy on my account run?
2. Does it include the fix for CVE-2026-109618 and CVE-2026-109619, and has PHP been restarted since?
3. Who is the account holder on record, and which email address do you have for us?
4. Is my domain registered with you, and when does it expire?

A good reply has a version number and a date. Some hosts have already answered publicly: SiteGround says it patched every server on 21 October and customers don't need to do anything. My guide to the PHP vulnerability has a fuller message to send and the 24-hour plan.

Yes. Registration, DNS and IP lookups only read public records, so they can't change or break anything on your site. What isn't safe is running a "PHP checker" script someone forwards on WhatsApp, or handing your hosting password to a stranger who messages offering to help. A fake scanner for last year's React2Shell bug turned out to carry malware.

The platform is the host, so the IP lookup will name it, and there's no PHP version for you to check or patch. You still have a registrar, and sometimes separate DNS, so the domain lookup is worth running. And check for an old WordPress blog or booking page on a subdomain, because that one does run PHP.