Website Held Hostage: What to Do When Your Developer Won't Hand Over Access

You paid for a website. You own a business. But you can’t log in, can’t update anything, and the person who built it is either ignoring you or asking for more money before they’ll hand it over.

This is more common than most people realise. The developer registered the domain in their name. The hosting is on their server. Your CMS login only lets you edit blog posts, not manage the site. And now that you want to move on, they’re holding everything you paid for.

I’ve written about what you should receive at handover and what to do when a developer disappears. This article covers the harder situation: when they’re still around but won’t cooperate.

How This Happens

Three scenarios come up again and again.

The disappearing freelancer. They built your site, you paid in full, and they stopped responding. You don’t have the passwords, the hosting login, or the domain credentials. They’re not trying to hold you hostage. They’ve just moved on and can’t be bothered to hand things over properly.

The agency that owns everything. Your domain is registered under their account. Your hosting is on their server. Your CMS login gives you editor access, not admin. Everything seemed fine while you were a client. But now that you want to leave, they quote a “transfer fee” of several thousand pounds. Or they just drag their feet indefinitely.

The proprietary platform trap. They built your site on their own custom platform or a heavily modified CMS. Everything works while you’re paying. The moment you try to leave, you discover nothing is exportable. Your content, your design, your functionality: all locked inside their system.

Each of these situations has a different solution. But the first step is the same: find out what you actually own.

The Red Flags You Should Have Caught

Most of these are invisible when things are going well. You only notice them when you want to change something and discover you can’t.

The single biggest red flag is not having a written contract with an IP assignment clause. Without that, the law defaults to the creator owning the copyright. More on that below.

Your Legal Rights in the UK

This is where it gets specific, and where most business owners are surprised.

Copyright belongs to the creator by default. Under the Copyright, Designs and Patents Act 1988, if a contractor (not an employee) builds your website, they own the copyright to the code unless you have a written agreement transferring it. This catches most people off guard.

Employees are different. If an in-house employee built the site during their normal duties, the employer owns the copyright automatically. No written agreement needed.

You need a written assignment. A verbal agreement isn’t enough for copyright transfer in the UK. The assignment must be in writing and signed by the person assigning the rights. An email chain discussing ownership is not the same as a signed IP assignment.

Assignment is not the same as a licence. Assignment means you own the intellectual property outright. A licence just means you have permission to use it. Many developer contracts grant a licence rather than an assignment, and most clients don’t notice the difference until it matters.

Your domain is separate from your website. Domain disputes follow their own resolution process: UDRP for international domains, and Nominet’s Dispute Resolution Service for .uk domains. These are faster and cheaper than going to court.

How to Get Your Website Back

This is a graduated process. Start calm, escalate only if needed.

Step 1: Check What You Actually Own

Before you send any angry emails, establish the facts.

Domain ownership. Run a WHOIS lookup on your domain. For .uk domains, use Nominet’s WHOIS service. For .com and others, use any WHOIS tool. Look at the registrant name and email. If it’s your developer’s name, not yours, that’s the core problem.

Hosting access. Try to log into your hosting provider. If you don’t know who your host is, use a tool like BuiltWith or check your bank statements for recurring hosting charges.

CMS access level. Log into your website admin panel and check your user role. If you’re an “Editor” or “Contributor” rather than “Administrator,” you don’t have full control.

Analytics. Check whether you have owner-level access to Google Analytics and Google Search Console. If the developer set these up under their Google account, your data is in their hands.

Step 2: Try Talking First

Send a calm, specific email. Not “I want my website.” Instead, list exactly what you need:

• Domain transfer to your registrar account
• Hosting account credentials or migration assistance
• CMS administrator credentials
• Complete source code (all files, database)
• Google Analytics and Search Console ownership transfer

Set a clear deadline. Fourteen days is reasonable. Keep records of every communication.

Most disputes end here. The developer was lazy or disorganised, not malicious. A clear, professional request with a deadline usually gets results.

Step 3: Contact Providers Directly

If the developer doesn’t respond within your deadline, go around them.

Domain registrar. If you know which registrar holds your domain (GoDaddy, Namecheap, 123-Reg, etc.), contact them directly. Explain that you’re the business owner and the domain should be in your name. They’ll need proof: business registration, invoices showing you paid for the website, correspondence showing the domain was meant to be yours.

Hosting provider. Same approach. Contact them, prove you’re the legitimate business owner, and request account access or a migration path.

Providers deal with these situations regularly. They have processes for it. Being polite and having documentation ready makes this much smoother.

Step 4: Formal Demand Letter

If direct communication and provider contact both fail, get a solicitor involved.

A cease and desist letter costs between £200 and £500. It formally demands the transfer of your assets within a specified timeframe and outlines the legal consequences of refusal.

This works more often than you’d expect. Most developers aren’t prepared for legal correspondence and will cooperate rather than deal with the hassle.

Step 5: Domain Dispute Resolution

If the developer still won’t budge, formal dispute resolution is your next option.

For .uk domains: Nominet’s Dispute Resolution Service costs around £750 plus VAT. The process typically takes two to three months. You’ll need to demonstrate that you have rights in the domain name (your business name, trademark, or trading name) and that the current registration is abusive or unfair.

For .com and other international domains: The UDRP process through WIPO costs around $1,500 USD. Similar timeline of roughly two months. Success rates sit around 85-90% for legitimate business claimants.

Small Claims Court. For broader disputes (not just domain names), the UK Small Claims Court handles claims up to £10,000 without needing a solicitor. Filing costs £35-£455 depending on claim value.

Platform Lock-In Is a Different Problem

Not every “hostage” situation involves a bad developer. Sometimes the platform itself is the cage.

Wix is a closed system by design. Blog posts export via RSS (text only, no images or formatting). Pages have no export at all. Moving off Wix means rebuilding from scratch. Professional migration typically costs £1,000 to £5,000 depending on site size.

Squarespace is slightly better. XML export captures blog posts and basic pages. But your design, forms, integrations, and custom styling don’t transfer. You’ll still need significant rebuild work.

WordPress is an open platform with no lock-in at the software level. But managed WordPress hosts can make migration harder than it needs to be through proprietary features and non-standard configurations.

The difference matters because the solution is different. Developer hostage situations have legal remedies. Platform lock-in is a consequence of choosing a closed platform. The fix is to plan a migration, not file a dispute.

If you’re stuck on Wix or WordPress and want to move to something faster and more maintainable, that’s exactly what Site Swap is for.

When to Cut Your Losses and Rebuild

Sometimes recovery costs more than starting fresh. Consider rebuilding when:

• The developer owns the domain, the code, and the hosting, and won’t negotiate at any price
• The site was built on a truly proprietary platform with no export path
• Legal costs would exceed the cost of a new website
• The existing site is outdated and needs redesigning anyway
• You’ve spent more than four weeks trying to recover access with no progress

Rebuilding isn’t failure. It’s a fresh start with the right setup. And this time, you’ll know exactly what ownership looks like.

How to Prevent This Next Time

Here’s the checklist I give to every client before a project starts:

1. Register the domain yourself. Do it before the project begins. Namecheap, Google Domains, or any registrar. Your name, your email, your payment method. Then give the developer DNS access if they need it.

2. Set up hosting in your own account. Or at minimum, insist on full admin access with your email as the account owner. You should be the billing contact.

3. Get a written contract with an IP assignment clause. The key sentence: “All intellectual property created under this agreement transfers to the client upon final payment.” Without this, the developer owns the code by default under UK law.

4. Insist on admin-level CMS access from day one. Not after launch. Not after final payment. From the start. If the developer pushes back on this, that’s a red flag.

5. Own your analytics accounts. Create your own Google Analytics and Google Search Console properties. Add the developer as a user. Not the other way round.

6. Request source code at each milestone. Don’t wait until the end of the project. Ask for code delivery at each payment milestone. This protects you if the relationship breaks down mid-project.

7. Ask what platform they’re building on. Can you take it elsewhere? Can another developer maintain it? If the answer to either question is no, reconsider.

The Bottom Line

Getting your website back from an uncooperative developer is stressful, but it’s not impossible. Most disputes resolve through clear communication and documented ownership. Legal routes exist for the cases that don’t.

The real lesson is prevention. Own your domain from day one. Get IP assignment in writing. Maintain admin access to everything. These aren’t unreasonable demands. Any developer worth working with will agree to all of them without hesitation.

I build every site on open technology. You own the domain, the hosting, the code, and the content from day one. If you ever want to leave, you can take everything with you. No transfer fees, no lock-in, no hostage situations. Here’s how I approach web development.