How to (Without Losing It) Move Your Website Away From Your Web Designer
Here is the most common phone call we get from a business owner who wants a new website: "My designer built my site four years ago, and I think they still have the only login. How do I get it?"
Usually there is no bad faith involved. The site was built in year one, the designer paid for hosting on their own account because it was easier, the domain was registered with a card that expired, and nobody ever wrote down who controlled what. Four years later the owner wants changes made, stops getting responses, and realizes they cannot even log in to their own website.
Sometimes it is worse than that. Sometimes the agency says it flatly: we own the site, you licensed it. And a business owner who never got a written assignment of ownership has a real problem.
The good news is that in the vast majority of cases, the website is recoverable. But you have to understand that "my website" is not one thing. It is five separate assets, held by up to five different parties, and you need to reclaim each one individually.
First: Your "Website" Is Actually Five Different Things
Before you ask anyone for "the login," know what you are asking for. Confusing these is how people accidentally take down their own email.
- 1. The domain name.
yourbusiness.comitself. Registered through a registrar (GoDaddy, Namecheap, Cloudflare Registrar, Google Domains' successor). The registrant is the owner. If your designer's name or email is the registrant, they legally control it until that changes. - 2. The DNS zone. The set of records that point your domain at a host, your email provider, and third-party services. Whoever's nameservers are listed on the domain controls this. This is the piece people forget, and it is the one that breaks email.
- 3. The site files. The actual code, themes, images, and plugins sitting on a hosting server. You get these via SFTP, a control-panel file manager, a Git repository, or a backup archive.
- 4. The database. Every page, post, product, customer record, and form submission. On WordPress this is MySQL: exported as an
.sqlfile or a full backup plugin archive. This is where your content actually lives, not in the files. - 5. Email. Your MX records, your mailbox provider (Google Workspace, Microsoft 365), and often the SMTP credentials baked into the site's contact form. Email is usually not part of the website, but it is very frequently pointed at the wrong place during a migration.
Ask for "the website" and you will get a WordPress admin password, which is asset number six and helps you with none of the above. Ask for each item by name.
Map Who Controls What Before You Ask for Anything
15 minutes, no logins neededRun four free lookups and you will know more than most agencies expect you to know. Use who.is or your registrar's WHOIS lookup to see the domain's registrant and expiration date. Use MXToolbox to look up your MX records (that tells you where email lives) and your NS records (that tells you whose DNS you are on). Use BuiltWith or WhatCMS to identify the host and platform. Then try logging in to your domain registrar using "forgot password" with your business email: if a reset email arrives, you own the domain and simply forgot. If it goes to your designer's address, you know exactly who to call.
Send the Written Handover Request
Specific beats vagueEmail your designer with an itemized list, not "can I have my website?" Request: the registrar authorization (EPP) code and confirmation that the registrant email is yours; full nameserver access or an export of all DNS records; SFTP or control-panel credentials to the hosting account; a complete site backup including the database; admin logins for the CMS, analytics, Google Search Console, ad accounts, and any paid theme or plugin licenses; and the hosting account owner email. Give a deadline and ask them to confirm in writing that your business holds the rights to the work product. A reasonable professional will do this without drama. The request itself is the test of whether you are dealing with a reasonable professional.
Take the Domain First (It Is the Cheapest and Most Permanent Win)
$0 to unlock, ~$12 to transferAn authorization code is not a paid service: ICANN rules mean the registrar must give it to the domain holder, and a legitimate agency cannot charge you for it. Unlock the domain, disable registrar lock, get the EPP code, and start a transfer into a registrar you control with a billing contact in your name. If the designer refuses or invoices you for the code, skip the argument and do a registrar-level transfer: prove you are the registrant of record with a government-issued ID and the registrar can move the domain without the current account holder's cooperation. That single move converts every future negotiation from hostage situation to business transaction.
Move DNS and Email Separately, in the Right Order
The step that breaks businessesDo not point nameservers at a new host until your MX records match your email provider exactly, or your email stops the moment propagation finishes. The safe order: (1) confirm where mail is actually hosted; (2) if mail lives on the old host, migrate mailboxes first and set up the new provider; (3) build the new DNS zone with the A/CNAME records for the site plus the correct MX, SPF, DKIM, and DMARC records; (4) drop the source zone's TTL to 300 seconds a day ahead of time so changes propagate fast; (5) switch nameservers. Then watch both the site and a test email for 72 hours before cancelling anything. Never cancel the old host while email still routes through it.
Rebuild Content From the Database, Not the Screens
Your real leverage if they stonewallIf you get the database export, you have your content: even with no files, no theme, and no cooperation. Pages, posts, product data, and form submissions are all in there, and a developer can lift text and images out of a SQL dump. If you get nothing at all, the Wayback Machine (web.archive.org) holds archived copies of most public sites, and a surprising amount of a site can be reconstructed from it plus your own image folders and any PDFs or marketing materials you have on file. This is not the fast path, but it is the reason no agency actually owns your business's words.
Close the Door Behind You: The Four Things to Fix So This Never Recurs
Do this on every projectOnce you are back in control: put the domain, hosting, and email accounts under an owner-controlled email address (not a freelancer's, not a former employee's). Pay for them on your own credit card so ownership follows the billing. Get a written assignment of intellectual property for any site you commission: without it, under US copyright law the builder may own the creative work and you own only a license to use it. And set a calendar reminder every 12 months to confirm you can still log in to all five assets while everything is calm, not the week you need a change.
Frequently Asked Questions
Does my web designer own my website?
What do I do if my web designer will not give me my website?
Will I lose my email if I change web hosts?
How long does moving a website take?
Can I move my website without any downtime?
What should I never sign in a web design agreement?
Quick Reference: Which Asset, Which Party, Which Fix
The Five Assets and How to Reclaim Each One
| Asset | Who Usually Holds It | How You Get It Back | If They Refuse |
|---|---|---|---|
| Domain | Registrar account (often the designer's email) | EPP auth code + transfer | Registrar-level transfer with ID proof |
| DNS zone | Whoever's nameservers are listed | Export records, rebuild at new provider | Rebuild from public lookups (MXToolbox) |
| Site files | Hosting account owner | SFTP / control-panel credentials | Rebuild from backup or archive.org |
| Database | Same host, usually | SQL export or backup plugin archive | Lift content from cached copies |
| Google Workspace / M365 / old host | Admin console + correct MX/SPF/DKIM | Reset via your own recovery domain |
Should You Do This Yourself or Hire It Out?
Be honest about which of these you can do comfortably. Reclaiming the domain is genuinely a DIY task: it is a support ticket, an authorization code, and a transfer confirmation. Do that yourself this week, because it costs nothing and removes the leverage anyone else has over you.
The DNS and email cutover is where business owners get hurt. One wrong MX record and your quotes, your customer replies, and your invoice notifications silently stop arriving: sometimes for days before anyone notices. If your business runs on email, pay someone to do the cutover and to verify it with you on the phone while it happens.
The rebuild is a separate decision. Moving a site somewhere safe is a migration. Making it good enough to generate leads is a design project, and it involves redirect mapping so you do not torch the rankings you spent years earning. Those two get sold together constantly, which is why owners assume a migration is cheap or a redesign is risky. They are different jobs with different failure modes.
The Bottom Line
Take the domain. Get the database. Move the DNS carefully, with email verified before you cancel anything. Then put every account in your name with your card on file, get the IP assignment in writing, and set a yearly reminder to test your own logins.
A website you cannot access is not an asset; it is a liability with a nice homepage. Reclaiming it is one of the highest-leverage hours you will spend on your business this year.
Related Services & Guides
Related Articles
We migrate websites for a living. Including away from the people who built them.
If you cannot log in to your own domain, or your host is a black box, or you have been quoted a "transfer fee" for an authorization code: we will audit what you actually control, tell you exactly which of the five assets you are missing, and move the site without taking your email down. No ransom, no lock-in, and every account handed over in your name with written documentation.
Co-Founder & COO · Austin Web Services