It usually starts slowly. A change request goes unanswered for a week. Then the invoice you were expecting doesn’t arrive, which is oddly worse. Then the phone number goes to voicemail that nobody clears.
We get these calls regularly, and the first thing worth saying is that it is almost never as bad as it feels in the first hour. The second thing worth saying is that the damage depends almost entirely on one question, and it is probably not the question you would guess.
The question is not “where is the code”
It’s who controls the domain name.
Everything else can be rebuilt. The site can be redesigned, the content can be rewritten, the database can be reconstructed from what’s public. Painful, but survivable.
Your domain is different. It is the address of your business, it is where your email is delivered, and it is what a decade of customers have typed into their browser. If it is registered in your developer’s name, in their registrar account, on their credit card, and it comes up for renewal next month — that is the emergency. Everything else is a project.
So before anything else, find out where your domain lives.
Take stock of what you actually control
Work through this list and be honest about which ones you have and which ones you have only ever seen someone else use:
- Domain registrar — the account where the domain is registered, not the hosting.
- DNS — sometimes at the registrar, often somewhere else entirely.
- Hosting account — the control panel login, not FTP into the site.
- Email — where your mailboxes actually live, and who is the admin.
- The code — a repository you can access, or only whatever is on the server.
- The database — and whether you have ever seen a backup of it.
- TLS certificate — usually easy to replace, occasionally tied to their account.
- Analytics and Search Console — often owned by a personal Google account.
- App store accounts, if you have an app. These are the hardest to recover.
Most people who call us have two or three of these. Almost nobody has all of them.
How to find out where things are
You can do a surprising amount of this yourself in twenty minutes.
A public WHOIS lookup on your domain will tell you the registrar and the expiry date. The contact details may be masked by privacy protection, but the registrar name won’t be. That tells you which company to call.
Registrars have account-recovery processes for exactly this situation. They will generally want proof that the business is who it says it is. Having your LLC paperwork and a matching billing record is what makes that conversation short.
Your hosting provider has a similar process. If you have ever paid an invoice directly to the host, you are in a much stronger position than if the developer resold you hosting on their own account.
Getting the code without them
More often than not, this is easier than clients expect.
If it’s a PHP site — WordPress or otherwise — the code that runs the site is on the server. With hosting access, you have it. Download everything, export the database, and you have a complete, working copy. That covers a large majority of small business sites.
It gets harder when there was a build step. If the site was compiled from source that lived only on the developer’s laptop, what’s on the server is the output, not the source. You can keep running it, and you can change content, but you cannot easily change how it works. Same problem with mobile apps: the binary in the store is not the source code.
That’s the situation where a rebuild is often genuinely cheaper than an excavation. We will tell you which one you’re in after looking, and we will tell you plainly if the honest answer is “start over.”
Two things worth doing today, before any of this happens
Register your own domain, in your own account, with your own card. If a developer offers to handle it, thank them and do it yourself anyway. It costs about fifteen dollars a year and it is the single highest-value administrative act available to a small business online.
Ask for a copy of everything, once a year. Source code, a database export, a list of where things live. Any competent developer will hand it over without hesitating, because they are not relying on lock-in for retention. Hesitation is itself the answer to a question you were probably too polite to ask.
If you are already in this
Call somebody. This is a routine job, not an exotic one — we take these on regularly, and so do other decent shops.
Come with whatever access you do have, plus the domain name and any invoices you can find. That’s enough to start. And if what you have is nothing but the domain and a website you can see in a browser, that is still enough to work from.
We do legacy rescues and PHP takeovers as a normal part of the job, and if the right answer turns out to be a rebuild rather than a recovery, we’ll say so before you spend money finding out.