Agony and Anger: When a web developer holds your website hostage
Picture it. The phone rings, I answer, and there’s panic, anger and a lot of frustration on the other end of the line. You lost access to your website because your web developer won’t give you access.
High Drama. And it ain’t Shakespeare.
Imagine, desperately seeking to gain back control of your website from a webmaster who holds your website hostage. Or a web developer who’s gone missing.
Your entire business hangs in the balance.
Panic sets in.
You need help.
You’re desperate.
I understand. I sympathize. We all agree it’s not fair you may lose it all, or may have to spend money to fix the situation. I get it. It’s not my fault, but I do get it.
I also understand it’s uncomfortable calling that web developer and getting the answers to important questions. So people call me hoping I can help.
I’ve got questions. And I’ve got answers. But this enraged, desperate, panicky business owner doesn’t want to hear what I’ve got to say. It’s that traumatic.
Is the domain name in your name? Do you have access to the hosting account? Did you get the login to your website?
I can help in a situation like this. Maybe. But a lot depends on very important information. Some only the current web developer can answer. If he answers the phone or email. And I know that giving a web developer the heads up you’re about to leave his services can also be tricky.
He may be vindictive. She may decide to delete your account. They may make the transition complete and utter hell. The web developer holds the power in his hands and he may not be afraid to use it.
Or he may be a professional and will hand it right over. How well did you vet him when you hired him?
Did you pay your bill?
This question will come up if you’re coming to me for a rescue. I start by assuming the other web developer is a professional. We’ll know soon enough if he isn’t, but I also need to find out about you. I need to know if you’re locked out simply because of non-payment. As you can imagine, the answer to that question changes a story and its villain dramatically.
The fine print of your contract
Let’s start at the beginning.
You have a contract. Right? What does it say about your domain name, hosting, and website access? Does it mention who owns the files, images, and access when the web developer is done and the site is launched? I’ve seen contracts that state the web developer owns the files, the layout, the theme, the whole look (and sometimes the content) of a website. These contracts are not in the best interest of the client. When the relationship ends, you walk away with nothing.
If you’re paying for your website on a month-to-month basis and don’t own the assets, walking away can mean losing everything.
Know who is going to own what if you decide to part ways with your web designer.
Ask the web designer before you sign a contract what happens if you do want to walk away someday. It may be uncomfortable when you’re first forming a relationship with a web developer or agency, but it’s a valid question. And one you want to talk about before you need to do it.
How Not to be held hostage by a Bad Web Developer
There are bad web developers out there. But there are three simple, but vital, things you can do to prevent someone from stealing your business by holding it hostage.
1. Put Domain Names in Your Name
Buy your own domain name. It may be easier for the web developer to do it, but when all is said and done – get access. You want the login and password for that domain registrar, and you want to check that your name is the administrator and billing contact with your web developer listed as the technical contact. To be super safe, if he creates it for you, change the password after he no longer needs access.
Under no circumstances should your web developer use his account to buy your domain name. It’s a right pain in the keister to change if you decide to part ways.
Best advice? Buy it yourself and give him technical access.
2. Get access to your Website Hosting
Do you need access to your hosting account? While I always make sure my clients have appropriate access, there’s rarely a need for direct server credentials. Hosting credentials give you direct access to the server and if you don’t know what you’re doing can result in catastrophic consequences. Many web developers resell hosting or group many of their clients onto a single account. Completely normal.
Don’t be alarmed if your web developer doesn’t want you fiddling around on the server, but always ask if there’s a client portal or cPanel that you can have the login credentials for. With direct promises you won’t crash anything. If you have a WordPress website, having access to the server isn’t always critical.
Buying your own hosting without consulting your web developer isn’t a good idea either.
Best advice? Talk it over with your developer first to see which one to use, then buy your own account and give the developer access. Or make sure you have your own access to the cPanel for your slice of the server.
3. Insist on having your Website logins and administrative privileges
No matter who you are or your level of experience with your website, it is mandatory you have access to the site. With a WordPress website, that means a user account has been created with your name and email address, and designated as an administrator.
Administrator access allows you full control of the website. If we are trying to recover or move your website, this administrator access is vital.
No matter what, there’s no excuse a developer can give you for not providing you this level of access. Insist on it. If they balk, cease working with them immediately.
Some of my web developer friends may not agree with me on this point, because there are many clients with clicky fingers. Testing, moving things around, trying out doodads. You can break your site if you’re in there fiddling around. Just remember if you’re the clicky sort, if you break it … cha-ching.
How to recover from a website hostage situation
So what should you do if you find yourself being held hostage by a bad web developer? Before you alert him, check your access information for the domain name, and website. If it’s not a WordPress website, you’ll also want to have server/hosting access.
Don’t have any of this? Dig through your emails and verify. He may have sent it and you just don’t remember.
Send him an email requesting all the usernames and passwords. Be nice, but frank. You need this information for your records. And really, you do. Bottom line, you paid for that information. It should be provided. Do this before you make another move. He may surprise you.
If he doesn’t cooperate, you have yourself a problem. You need to find a reputable web developer who can give you a hand because there’s no way you can do this yourself. It’s a nightmare even for those of us who know the system well.
Two of the trickiest pieces to overcome is the recovery of your domain name, and gaining access to the website if you’ve never been given access. If you do not have login credentials for either one, you’re in for a very long process.
Recovering a domain name
You can file a claim with the domain name registrar (Go Daddy, Dotster, etc) to prove that you own your business. This is a lengthy process but one that is well worth the trouble.
Without filing the claim, your only other alternative is to buy a new name. You’ll have no way of telling your customers your name has changed, and if the web developer doesn’t take the site down, you’ll wind up competing with yourself and confusing your customers. This is bad.
You need your domain name.
You’ll need patience to get it back.
Recovering access to your WordPress website
Gaining control of a WordPress website purely relies on a couple of key factors:
- Did you ever have access? Can you reset your password?
- Do you have access to the hosting account?
There are two ways to get control, but they rely purely on some form of access to either the database (via the hosting cPanel) or by having a user account.
You may not remember your username or password, but WordPress is set up to also respond to your email address. Click the password reset link, and use your email address as the user name. See if you have a user profile.
If you have access to the server and can get into the database, a new administrator account can be created straight on the database. This requires access to the hosting account. Do you have that access?
If you have never been given access, and you don’t have access to the server, our buck stops here.
You’ve just landed yourself in a situation of no return.
Take a deep breath. Breathe.
Can you repair the relationship with your web developer long enough to get this access? Whatever you need to do, you need to do it. If you want to recover your website exactly as it is, you need the access. Beg him if you have to. Seriously. Your business depends on it. This isn’t fair — but fairness won’t get your site back. You can cuss him later.
After you get your access.
If you can’t gain access and your website developer won’t give you the access, you’re facing the unenviable position of having your site rebuilt.
This is going to hurt.
It’s going to hurt your feelings. It’s going to hurt your ego. And most importantly, it’s going to hurt your wallet. Again.
Take a deep breath. And breathe.
There is nothing worse than being ripped off. I know. Been there, done that. It’s devastating. It takes time and money to rebuild and it hurts your business.
An Ounce of Prevention
Today, before you do anything else, go talk to your web developer.
The one you know and love.
The one that holds your business in their hands.
Get your logins and passwords. Put everything that needs to be, in your name. Do it now. Don’t wait.
If you wait until things go sour, this is going to be much more difficult.
Has your website been taken hostage by a bad web developer?
First of all, let me say I’m sorry. I’m sorry someone in my industry has taken advantage of your trust. We’re not all like that, I promise. But there might be something I can do to help. Give me a shout and let’s see what we can do.
Just remember. It’s not my fault.
One Last Note:
I do get contacted about situations like this — usually with a lot of panic and very little information. Everything I’m going to ask you is already outlined above. If you need help beyond that, including recovering access or untangling a mess left by someone else, that’s paid work. I can’t provide ongoing, unpaid consulting by email. If that works for you, we can talk. If not, I truly wish you luck — you’re going to need it.
