The website works, but nobody answers your emails. A hosting invoice arrives from a company no one recognises. The SSL certificate expires in two weeks, and the only person who “knew how it all works” left a year ago.
We see this scenario regularly - and it almost always ends without disaster, on one condition: you act in the right order.
Rule number one: don’t touch what works
As long as the website and email are running, time is on your side. The most damage in these situations comes from nervous moves: changing DNS “just to try”, installing migration plugins, registering a new domain “next to” the old one because “it will be faster”.
Before you change anything, establish the facts. That is usually one day of work, not weeks.
Step 1: establish who formally controls what
Three questions you need answered:
- Domain - who is the registrant (owner), and who is merely an intermediary? You can check registrant data in the registrar’s WHOIS database. If your company is the registrant, you are in a good position. If the vendor is - that is the first problem to solve.
- Hosting - where does the site physically live? Invoices will tell you, and technically: the site’s IP address and DNS records. The more important question: whose name is on the hosting account?
- Email - does it run on the same hosting as the website, or separately (Google Workspace, Microsoft 365, a local provider)? Email is usually the most critical service - an email outage hurts more than an hour of website downtime.
Step 2: secure what you can already reach
Before you start recovering the rest, copy what is within reach:
- Content backup - if you can log in to the CMS, export the content and the database (most panels allow this without technical help).
- List of services and expiry dates - domain and certificate expiry, hosting plan, mailboxes. An expiring domain is the only piece of this puzzle that can be lost irreversibly.
- Correspondence and contracts - invoices and the vendor agreement will be the basis for recovering access with providers.
Step 3: recover in order of importance
The order is not accidental: domain → email → hosting → CMS → analytics.
The domain comes first because it controls everything else. If your company is the registrant, the registrar is obliged to let you manage the domain and issue a transfer code - even if an intermediary handled everything until now. Prepare your company documents: in practice the procedure comes down to confirming the registrant’s identity.
If the vendor is formally the registrant, the situation requires negotiation or a formal route - but even then, the contract and invoices for “domain maintenance” are a strong argument that the domain was purchased on your behalf.
Hosting is often easier than it looks: providers have procedures for losing contact with an account administrator, and a copy of the files and database can often be obtained faster than the account itself.
What not to do
The most expensive decisions in these situations are made in the first 48 hours - out of emotion, not analysis.
- Don’t register a “backup” domain and move communication to it - you dilute your brand and SEO without solving the problem.
- Don’t rebuild the website from scratch just because the author of the current one is unreachable. Those are two separate decisions.
- Don’t delete any accounts, mailboxes or services before everything is migrated and documented.
- Don’t agree to “buy back access” before checking what actually belongs to your company - you are often negotiating for something that is already yours.
How to hand over a website safely to a new vendor
Once access is back in the company’s hands - or when cooperation with a previous vendor ends calmly - comes the moment of handing the website over to a new team. We have taken over projects after agencies, freelancers and internal teams. Below is a checklist that works for us - and that you should expect from any solid vendor, in Poland or anywhere else.
Access: who holds the keys
The first step is not judging your predecessors’ code. It is establishing who has access to:
- the domain and DNS panel (the single most important access - it controls both the website and email),
- hosting / server (panel, SSH, FTP),
- the CMS and database,
- company email,
- analytics, Search Console and ad accounts,
- the code repository, if one exists.
If anything on this list cannot be established, that is not a formality - it is risk number one. A website nobody fully controls works fine only until the first outage.
Inventory, not a verdict
Only with access in hand can you answer what actually exists: which CMS version, which plugins, when the last update happened, whether backups exist and whether anyone has ever restored one, what is custom and what is standard.
At this stage, watch out for two extreme tones. “Everything is badly written, it must be rebuilt from scratch” is usually the opening line of the most expensive possible engagement, not a diagnosis. Equally risky is “everything works, let’s touch nothing”. A mature assessment almost always sounds less dramatic: some things should stay, some need updating, a few need fixing first.
A plan for the first 30 days
- Stabilization - backups, security updates, uptime monitoring, cleaning up accounts and passwords (every access owned by the company, not by a private person).
- Risk list - what can stop working and what it would cost; from outdated PHP to a domain registered to a former employee.
- Business priorities - only now the growth conversation: what blocks sales, what annoys users, what is worth improving first.
This order separates the decision “who takes care of the project” from the decision “do we rebuild the website”. These are two different conversations, and gluing them together rarely ends well.
What to expect from the new vendor
- access stays yours - the vendor gets accounts, but the company owns the services,
- handover documentation - what exists, where, and who is responsible,
- no rebuild decisions in the first week,
- a clear incident-reporting path and realistic response times.
How to avoid reading this article again in two years
Once you regain control, three rules are worth keeping: every service registered to the company (not to a private person or a vendor), access held by at least two people in the company, and one up-to-date list of services with renewal dates.
If you are in the middle of this situation and would rather go through it with someone who has done it many times - this is how project takeovers work at Invisio. And if you would first like to calmly check who controls what in your current setup, start with a free cost audit. WordPress sites - the most common case - are something we take over, repair and care for.