Old Developer Won't Hand Over Your Domain or Code?

If your domain is registered in your own name, you can almost always get it back: ask the registrar for the authorization code and transfer it. Hosting, code and app store accounts are usually yours too if you paid for them and nothing in your contract says otherwise, but they are harder to recover because they sit inside accounts the agency or freelancer created. Start with a short, polite written request, move to the registrar or provider if that fails, and bring in a lawyer only if there is a real dispute about the contract or about money.

This guide lists every account a business should own itself, who should hold each one, and how to get it back. If the person has stopped answering altogether, read Developer disappeared? How to get your site and code back next, because that case has its own steps. If your site is down right now, our emergency help starts the same day at $85 an hour. This is general information, not legal advice.

Who owns what

Ownership is two questions: whose name is on the account, and what does the contract say. The first decides who can act today. The second decides who is right if you argue. Many disputes start because the developer registered everything under their own name for convenience, and nobody noticed for years.

• Domain. The legal holder is the registrant listed in the registry's records. The company that registered it for you is only the registrar, or a reseller of one. If the registrant is the agency, the domain is legally theirs until they change it.
• Hosting and servers. Whoever opened the account owns the account. You may own the data on it, but you can only reach it if you are the account holder or they add you.
• Code. Copyright in custom code usually belongs to the author unless a contract assigns it to you or the work was done as an employee. Check the contract for wording such as assignment, transfer of rights or work for hire. Open-source parts (WordPress core, plugins, frameworks) keep their own licences.
• Accounts such as analytics, ads, email and app stores. Same rule as hosting: the account holder controls them. These are often the most painful to lose, because your history lives there.

None of this replaces advice from a lawyer who has read your contract. We say that plainly: if the dispute is about unpaid invoices, rights in the code or a breach, get legal advice before you escalate.

The checklist: accounts you should own yourself

1. Domain registrar login, with you or your company as registrant, and a company email you control as the contact address.
2. DNS (at the registrar, Cloudflare or the host). Whoever controls DNS controls your website and email.
3. Hosting or cloud account (shared hosting, VPS, AWS, Vercel, Netlify, Supabase and similar), with you as owner and the developer added as a user.
4. Code repository (GitHub, GitLab, Bitbucket) in your own organisation.
5. Website admin accounts (WordPress, Shopify, the CMS), with at least one administrator that is you.
6. Google Analytics, Search Console and Tag Manager, with you as owner.
7. Ad accounts (Google Ads, Meta) and the payment method on them.
8. Email and transactional email services (Google Workspace, Microsoft 365, Mailgun and similar).
9. App store accounts (Apple Developer, Google Play Console) registered to your company.
10. Password manager entries, API keys and licences for paid plugins, themes and third-party services.
11. Backups stored somewhere you can reach without the developer.

Doing this check takes an hour and is the cheapest insurance in this article. Log in to each one and see what name it is under. If you cannot log in, that is your answer.

Asset, owner, recovery

Getting the domain back, step by step

Domains are the one asset with clear rules, so start here. ICANN's transfer policy, which covers generic domains such as .com, says the registrar must give the registered name holder the authorization code on request, within five calendar days if there is no self-service option, and that a payment dispute alone is not a reason to withhold it (ICANN). The same policy applies a 60-day lock after a change of registrant, so plan for that if you first have to change the holder.

1. Look up the domain (WHOIS or the registry's lookup). Note the registrar and, if shown, the registrant.
2. If the registrant is you, log in or recover the account through the registrar's support using your email address, then unlock the domain and request the code.
3. If the registrant is the agency or freelancer, send the written request below and ask for a registrant change to your company.
4. Start the transfer at the new registrar with the code. Before you do, copy all DNS records so the site and email keep working.
5. Check email and website after the move.

Country domains, per market

• .nl (Netherlands). The registrar must give you the transfer token within five days of your request. If it does not, SIDN has a reminder template, your new registrar can contact the old one for you (you need to prove you are the registrant, and a Trade Register extract if you act for a business), and SIDN can step in if that fails. Changing the registrant is a separate step through your registrar (SIDN).
• .be (Belgium). DNS Belgium emails the authorization code to the current registrant's address, and you can also request it yourself through the WHOIS lookup on their website. It is valid for 7 days and can be resent three times (DNS Belgium). That makes a working registrant email address essential.
• .de (Germany). The AuthInfo code comes from the current provider, is known to the domain holder or administrative contact, and is valid for a limited time (30 days according to Hetzner's guide). A provider change keeps the holder; a change of holder is a different procedure (Hetzner). Check the current rules with your registrar or DENIC.
• .fr (France). Registrar guides describe an AuthInfo code that is sent to the holder's email address in the records, and that may be invalidated if the holder details change (hosting.fr). Verify on Afnic's site before relying on this.
• .co.th (Thailand). A transfer needs the AuthCode from the current registrar, and registrars say it can take 5 to 7 days. The registrant must be a legal entity in Thailand, and changing the holder needs supporting documents (INWX, THNIC policy). Ask your registrar for the current THNIC procedure.

Hosting, code and app store accounts

Hosting. Ask the current account holder to transfer ownership, or to invite you as admin and then step back. If they will not, contact the hosting company. Most will not hand over an account to a stranger, but many have a process if you can show you are the paying customer: invoices in your name, payment records, and control of the domain.

Code. A repository on GitHub can be transferred by anyone with admin rights, and issues, pull requests, history and webhooks move with it (GitHub docs). So the request is simple: transfer it to our organisation, or add us as owner. If they refuse, ask at least for a complete export with history, plus the database dump and environment settings. If you paid for the work and have no signed assignment, a lawyer can tell you what rights you have.

App stores. Ask to be added as an administrator first. Moving an app between developer accounts is possible but has rules and checks on both sides, so start early.

A polite request you can send

Keep it factual and give a date. Most hand-overs fail because of delay, not hostility.

Hello [name], we are moving the maintenance of [website] in-house, and I would like to make sure our accounts are in our company's name. Could you please (1) send me the domain authorization code and set [company name] as registrant, (2) transfer or add us as owner on the hosting account, the code repository and the analytics account, and (3) send a list of any other accounts, licences and logins used for the site? I would appreciate it by [date, about 7 days]. I am happy to pay for time spent on the hand-over, and I will keep your access until the transfer is confirmed. Thank you.

Keep a copy of every message. If you get no answer, send the same text once more, then go to the registrar or provider with that paper trail.

When the person will not answer or refuses

If they are unreachable, our guide on a developer who disappeared covers the registrar and hosting-support route in detail. If they are reachable but refuse, usually because of an unpaid invoice or a dispute, separate the two issues. Under ICANN rules a payment dispute alone does not entitle a registrar to hold back an authorization code, but a developer who is not the registrar is not bound by that, so a lawyer's letter is often the quickest next step. For an expired domain, see domain or SSL expired.

When to call a developer

You can do the domain and the account checks yourself. Call a developer when:

• the site is down and you cannot find out where it is hosted;
• you have the files but nobody can rebuild the server, database or email setup;
• DNS needs to move without breaking email;
• you need a security review after someone you no longer trust had access (see what to do if your site is hacked);
• you want the project taken over into your own repository, with credentials rotated and a clean setup.

Have ready: the domain name, any invoices or contracts, the last known host, logins you do have, and a list of anything that is not working. We sign NDAs. For a quick look, EngineeringScore gives a free audit of security, performance, SEO, accessibility and reliability, which helps you see what you inherited.

What it costs

Subscriptions run at least 3 months, then 3 months' notice; unused hours do not roll over. A plain domain and DNS hand-over often needs only a couple of hours of help. A rebuild after losing the server is a bigger job, and we will give you an hour estimate before we go far. For rates compared, see what an emergency developer costs. We work in your repository, and you own the code.

How to decide

• Everything is under your name and you just need the logins: do it yourself with the request template.
• Domain is theirs, they are cooperative: send the request, then book a few hours for the move.
• They refuse or want money first: ask a lawyer about the contract, and in parallel have a developer secure a backup of what is reachable.
• Site is down or you cannot find the host: call a developer today.

Prevent it next time

Open every account in your company's name, add the developer as a user, store credentials in a shared password manager, and put an assignment of rights and a hand-over clause in the contract. Keep a one-page list of your assets and review it twice a year. A maintenance subscription with access in your own accounts also gives you monitoring, so problems show up before visitors see them. Compare options in retainer vs pay as you go.

Get help with the hand-over

If you are stuck, tell us what you have and what is missing. We can take over hosting, DNS and code into accounts you own, and keep it running afterwards. Start with emergency help, or contact us and we will tell you honestly whether it is a two-hour job or a bigger one.