Six signs tell you the leverage sits with someone else, and the most reliable is simple: you have never logged in to anything. Recover access before there’s any dispute — the same request that gets answered on a good Tuesday gets ignored during an argument.
The six signs
1. You’ve never logged in to your hosting. Not “you forgot the password” — you were never given one. This is the clearest sign, and it’s very common on low-cost builds.
2. Your domain’s WHOIS shows an email that isn’t yours. Two-minute check: search “whois” plus your domain. If the registrant email is theirs, renewal notices go to them and transfers need their approval.
3. You pay the developer for hosting rather than a hosting company. Meaning your site sits inside their reseller account. Their arrangement lapsing takes your site down with it.
4. Small changes must go through them. Not because it’s technical — because you have no admin login. You can’t correct a phone number yourself.
5. Renewal invoices come from the developer with no provider named. A “renewal” charge with no itemisation is a charge you can’t verify against a public price.
6. Deflection on the ownership question. “We manage all that for our clients.” “It’s technical, don’t worry.” “It’s in your name, in our account” — the last is the most misleading, because the registrant name and the account are different things and the account is what decides outcomes.
| Sign | What it lets them do |
|---|---|
| No hosting login | Take the site offline; withhold the files |
| WHOIS email isn’t yours | Block transfers; receive renewal notices you never see |
| You pay them for hosting | Their lapse becomes your outage |
| No admin login | Charge for every small edit |
| Unitemised renewals | Bill above public prices |
| Deflection on ownership | All of the above, indefinitely |
What can actually happen
This isn’t hypothetical. Complaint records include a live site taken offline during a payment dispute, and buyers unable to move a website because the domain sat in a developer’s account.
Note what makes those situations possible: not a contract, and not any legal right. Just the fact that nobody else could act.
The recovery order
Do this now, while things are amicable. Framing decides the outcome.
1. The domain first. It’s worth more than everything else combined — it’s your business name, your email, and every link pointing at you.
Run a WHOIS lookup. Then search your own inbox for a registrar welcome email — GoDaddy, BigRock, Namecheap, Hostinger. If one exists, the account may already be yours and just needs a password reset via your own address. That single step resolves more cases than people expect.
If it’s genuinely theirs, request the transfer as routine records-keeping. If that fails, registrars have ownership-claim processes and will weigh GST registration, invoices and payment records.
2. Hosting. Contact the hosting company directly as the account owner. Where the plan sits inside a reseller account, ask the host what recovery requires.
3. A backup. Once you have hosting, generate and download one — files and database. Keep your own copy off the server. With a backup and your domain, almost any developer can restore you quickly.
4. Admin access. Recoverable through hosting, without them.
Steps two to four collapse into one if you can reach the hosting account.
The message to send
No grievance, specific items, and a reason for them to reply:
Hi [name]. For my records, could you send the domain registrar login, the hosting login and the website admin login, plus a full backup as a zip? Also, please confirm whether anything — Google Business Profile, analytics, business email, payment gateway — is registered under your account for my business. Happy to settle anything pending.
The last question is the one most people forget, and it’s often where the real dependency sits.
If there’s a genuine unpaid balance, pay it. A few thousand rupees to end a hostage situation is the cheapest option on the table.
Timing matters more than wording
The same request has very different odds depending on when it’s sent.
Now, with no dispute: it reads as housekeeping and usually gets answered.
During a payment disagreement: it reads as a threat and gets ignored, because the access is the leverage.
So don’t wait for a reason. If you can’t name your registrar and your host today, send the message this week.
Preventing it entirely
For your next project, or if you’re recovering from this one:
- Register the domain yourself, in your own account, with your own email — before hiring anyone.
- Buy hosting in your own name, on your own card.
- Give the developer access, not ownership. Registrars and hosts both support adding a user or sharing DNS access without handing over the account. Most buyers don’t know this is possible.
- Get all three logins in writing at launch, plus a backup.
What to do this week
- Run a WHOIS lookup and read the registrant email.
- Search your inbox for a registrar welcome email and try a password reset.
- Contact your hosting company directly as the account owner.
- Send the records-keeping message today, not during a dispute.
- Download a backup and keep your own copy.
If you want it done the certain way
Send us your domain and we’ll tell you where control actually sits and what recovery involves — including when it’s simpler than you expect. Where we take over, domain and hosting go in your accounts and we take access rather than ownership. WhatsApp us; we reply in about five minutes between 9am and 7pm.
Related reading
- Can a developer take your website offline?
- Whose name is your domain registered in?
- You don’t have a single password to your own website
- How to keep your website in your own name
FAQ
How do I know if my developer controls my website?
Six signs: you’ve never logged in to hosting, the WHOIS registrant email isn’t yours, you pay them rather than a hosting company for hosting, you can’t make small edits yourself, renewal invoices name no provider, and they deflect on the ownership question.
Can a developer take my website offline?
If they hold the hosting or domain account, yes — complaint records include exactly that during a payment dispute. Recovering access before any disagreement is the only reliable protection.
What should I do first to recover control?
The domain. Run a WHOIS lookup, check your inbox for a registrar welcome email in case the account is already yours, then request a transfer framed as routine records-keeping rather than as a departure.
