How to take over a website from an agency without losing access

First, find out what you still control

Before you write to anyone, spend half an hour finding out where you stand. You are looking for one thing per account: is your company the owner, or does someone else hold the keys?

Most owners know less than they think. The site was set up years ago, the person who did it has left, and invoices arrive from a company nobody remembers hiring. That's normal. This step tells you which situation you are in, and every later step depends on it. If you would rather hand this to a team, our takeover service starts with exactly this check.

A 30-minute self-check
Account	Where to look	What it tells you
Domain	Search your email for "renewal" or the domain name; run a WHOIS lookup	Which registrar holds it and whose card pays for it
Hosting	Bank statements and card payments to hosting or cloud companies	Whether your company is the paying customer
Code	Any invite from GitHub, GitLab or Bitbucket in your inbox	Whether a copy of the code exists outside the server
Site admin	Try the login page of your shop or CMS with your own address	Whether you can still edit content and see orders
Google accounts	Search Console and Analytics, signed in with a company address	Whether you are an owner, a guest or locked out

Write the answers down in one document. The rest of this guide refers to it.

If the agency still answers: the order to move things

A cooperative agency is the easy case. The risk is doing things out of order, for example ending the contract while the domain is still in their account. Ask for the steps below in writing, with a date for each.

Domain first. Ask for the domain to move to a registrar account owned by your company, or for the registrant to change to your company where it is. Transfers between registrars take several days, and many registrars lock a domain for 60 days after the owner details change, so this one sets the pace.
Admin invites for your company address on the hosting, the repository, the site admin, Search Console and Analytics, added next to the agency's own access.
Check each one yourself. Log in, open the billing page, look at the user list. "Done" from the agency is not the same as seeing your name there.
Move billing for hosting, licences and paid services to a company card.
Remove the agency's access, change passwords and replace API keys.
End the contract and settle the last invoice.

The full list of accounts, data and documents to collect is in our website handover checklist. This guide is about the order and the hard cases; the checklist is the inventory.

If your developer has disappeared

Emails go unanswered, the phone number is dead, or the agency has closed. Don't panic and don't start changing things. You can usually rebuild access one account at a time, starting from what you can prove you pay for.

Recovery routes when nobody answers
Account	If your company pays for it	If it's in the developer's name
Domain	Use the registrar's account recovery with company documents and payment records	The developer is the registrant on record. Ask the registrar what proof it accepts; failing that, it is a legal matter
Hosting	Ask support to reset the account to your company address; then download the files and database	The provider can't hand it to you. Get a copy of the site some other way before the plan lapses
Code repository	Ask the platform's support with proof that the organisation is yours	The copy on the live server may be your only one. Download it from the hosting
Search Console	Not paid, so no billing proof	Verify yourself as an owner with a DNS record, once you control the domain
Analytics	Not paid, so no billing proof	Without an administrator, you may have to start a new property. The old history stays where it is

Country domains such as .ee, .de or .fr have their own registry rules, so check that registry's process for proving a company owns a domain. And if your domain has already expired, act today. Registrars must offer a renewal window after expiry for generic domains like .com, but it is short, and after it the domain can be released to anyone.

Keep a log of what you tried and when. If it does end up with a lawyer, a dated record of polite requests helps.

Keep the site running while you take it over

A site with nobody looking after it tends to break in boring ways. These are the ones to watch in the first weeks:

Renewal datesDomain, hosting, SSL certificate, paid plugins. Put every date in a calendar and move the card to your company.
A backup you holdFiles and database, downloaded to storage your company owns. Do it before anyone changes anything.
Orders and form messagesPlace a test order or send the contact form. Notifications sometimes still go to the old developer's inbox.
Scheduled jobsStock imports, feeds and reminder emails that run on a timer. Ask your staff what "just happens" every night.

Hold off on updates and redesigns until you have a backup and someone has read the code. Updating the platform or its plugins on code nobody has read can break the site, and without a backup there is no way back.

Mistakes that lose access for good

Closing the hosting account to save money before downloading the files and database. Some providers delete the data soon after cancellation.
Changing DNS without exporting the old records. Your email and domain verifications live there too, and they stop quietly.
Settling for shared passwords. A login the agency gave you is still the agency's account. They can reset it.
Letting the domain lapse during the dispute. Make sure someone renews it, even while you argue about who owns it.

How we take a site over

We start with accounts, not code. We list every account the site depends on and who holds it, and help you move the ones that aren't in your company's name. Then we read and run the code and send a written review and plan: what to keep, what to fix, what to finish. You approve it before we start, and the site keeps running unchanged meanwhile.

The intro call is free, and so is an outside first look at a public site with XRay, our own audit tool. A deeper audit of the code and servers is scoped after the call. We have taken over and finished systems built by other teams; those projects are under NDA. You own the code, the data and every account, so if you leave us, there is nothing to take back.

What this guide doesn't cover

Legal advice. Who owns the code and the domain depends on your contract and your country. If the other side refuses, talk to a lawyer.
Hacked sites. If someone has broken in, cleaning up and closing the hole is a different job with its own urgency.
Moving to a new platform. That is a rebuild. See rebuilding a website so Google can follow the move.

Questions owners ask

My developer registered the domain in their own name. Is it still mine?

To the registrar, the domain belongs to whoever is listed as the registrant. If that is the developer, ask them in writing to change the registrant to your company. If they refuse or can't be reached, gather your invoices and contract and ask the registrar what proof it accepts. If that fails, it becomes a legal question.

Can I take over my website without the old developer's help?

Often, yes, as long as your company pays for the hosting or holds the domain. With either of those you can usually prove ownership to the provider, get a copy of the files and database, and rebuild access to everything else step by step. Expect some history, such as old analytics, to stay behind.

Should I pay the final invoice before the handover is done?

Agree in writing that the final payment is due once the accounts are in your company's name and you have checked each one. Many contracts tie ownership of the code to payment, so withholding money you owe can backfire. Tie the timing to the handover instead.

Do I have to rebuild the site after a takeover?

No. A takeover is about control, not a new site. Once the accounts are yours and the code has been reviewed, you can decide calmly what to keep, fix or replace.