Your Web Developer Has Vanished: Getting Your Domain and Access Back

The emails go unanswered, the phone number is dead, and the agency that built your site three years ago may not exist any more. Then it hits you: you cannot get into your own company website.

This is far more common than people assume, and it is rarely a reason to panic — but always a reason to move. As long as nothing needs changing, the site keeps serving. It becomes urgent the day a hosting invoice goes unpaid, a security patch is due, or a legally required page needs correcting.

If your site sits on a German .de domain, the rules below apply directly. If it is a .com or another generic domain, the principles are the same but the registry procedures differ — ICANN's transfer and dispute rules replace DENIC's.

One caveat before we start: I am a developer, not a lawyer. What follows is the technical and organisational side. The moment this turns into a contractual claim, you want a solicitor who handles IT law in the relevant jurisdiction.

A website is four separate things

The most common misconception is treating "my website" as one object. It is actually four independent things, often held by four different providers — and you can easily own three of them and not the fourth.

The domain. The address itself. This is the one that matters, because everything else is replaceable. A site can be rebuilt and copy rewritten, but the address your customers know and Google has indexed is unique.

The hosting. The server holding the files. The contract is either in your name or your provider's.

The website itself. Code, design, content. Ownership is whatever the contract says — and if there is no written contract, it gets murky.

The mailboxes. Remembered last, and usually the most painful. If your business address runs through the same provider, your entire customer correspondence hangs off that domain.

Start with an audit of your invoices. Who bills you for the domain? For the hosting? If an invoice arrives directly from IONOS, Strato or another provider, you are most likely the contracting party yourself — which puts you in a far better position.

The check that decides everything: who holds the domain?

Before doing anything else, settle this one question.

For .de domains, the registry is DENIC in Frankfurt. A whois lookup at denic.de will tell you whether a domain is registered, though full holder details are no longer shown publicly for data protection reasons.

If you need those details, DENIC provides a request form. You have to demonstrate a legitimate interest — the conditions follow from the GDPR and are set out in the form itself.

Two roles get confused constantly, and the distinction is the whole ballgame:

The domain holder (Domaininhaber) is DENIC's contracting party and the party with substantive entitlement to the domain. This can be a company.

The admin contact (Admin-C) is the administrative contact and, under DENIC's rules, must be a natural person. The admin contact may make changes to the domain — but may not change the holder.

That is the crucial point. A change of holder is only permitted with the express consent of the current holder. So if your former developer is listed only as admin contact while you are the holder, you are in a strong position even if you currently have no credentials at all.

Case one: you are the registered holder

This is the good outcome, and it happens more often than people fear.

Go directly to the provider where the domain sits. Hosting companies and registrars have established procedures for exactly this situation: lost access, change of holder, vanished contractor. They will ask for proof of entitlement — typically a commercial register extract, a business registration, or ID for the managing director.

It takes a few days and some patience, but it works. The outcome is a new password and control of your domain.

If the provider itself is the vanished contractor, you can initiate a provider transfer. The new provider handles it, and the old one's consent is not required for a holder change as long as you genuinely are the holder.

A note on working across borders. If you commissioned the site from outside Germany, expect the correspondence to be in German and the forms to be formal. Do not run legally meaningful documents through a machine translator and send them — ambiguity in a proof-of-entitlement letter costs you weeks. Get someone who works in the language to handle it.

Case two: the developer is the registered holder

Unpleasant, but not hopeless.

Legally, the registered holder is the party with substantive entitlement. That does not automatically mean they get to keep the domain — but it does mean you have to assert a claim for its release rather than simply switching providers.

The first step is always an attempt at an out-of-court settlement: a businesslike letter with a deadline, drafted by a solicitor if needed.

Resist the urge to assume bad faith. In most cases there is none — the domain was registered in the developer's name out of convenience, and they have no interest in keeping it. A properly worded letter often does the job.

It gets harder when unpaid invoices are involved, or the developer invokes a right of retention. That is the point to bring in a lawyer.

One argument worth knowing: if the domain contains your company name, you are touching name rights, which is frequently a stronger lever than contract law. It is also the basis for the next section.

What a DISPUTE entry does — and doesn't

This is where most of the confusion lives, so let's take it in order.

DENIC does not settle disputes. It carries out no substantive or legal assessment of a domain; responsibility rests entirely with the holder. DENIC only intervenes once the matter is finally concluded — normally through a final, binding judgment against the holder.

So you cannot call DENIC and have your domain handed back. That is the single most common misconception.

What DENIC does offer is the DISPUTE entry. It is aimed at holders of name or trademark rights and works alongside a legal dispute. Its function is narrow: the registered holder may carry on using the domain for now, but cannot transfer it to a third party while the dispute is running.

The reasoning is practical. Without it, your opponent could transfer the domain mid-proceedings and leave you facing an entirely new counterparty, starting over. The entry closes that door.

The terms: a DISPUTE entry is free and initially valid for one year from confirmation. If the dispute runs longer and you can evidence that to DENIC, it can be extended on separate application. Otherwise it lapses without notice and the domain becomes transferable again.

A detail few people know: if the disputed domain is deleted by its holder while a DISPUTE entry is active, the applicant automatically succeeds as the new holder. You do not have to be watching for the moment it drops.

And a limitation: granting a DISPUTE application is expressly not a legal pre-assessment in your favour and does not recognise your claim. It preserves the status quo, nothing more.

The conditions and procedure are set out in the application form DENIC publishes.

Hosting, content and email

While the domain question is being resolved, salvage what can still be salvaged.

Download the content. As long as the site is online, you can pull it. Copy, images, service descriptions — someone paid for all of it, and it can be recovered with a site downloader or, failing that, by hand through the browser. Do this now, not when the site goes dark.

Email first. If your business address runs through the domain, this is the most urgent item after the domain itself. If it drops, you cannot reach your customers and they cannot reach you. Find out where the mailboxes live and archive them locally before anything is switched over.

Google Business Profile. A separate account that often sits with the developer. Ownership can be reclaimed through Google, but the process takes weeks. Start it early.

Legal responsibility stays with you. Easy to overlook: while your site is live, you are responsible for its legal notice and privacy policy, whether or not you have access. What German law requires there is covered in a separate article on Impressum and GDPR.

The same applies if the site is compromised while you are locked out: the duty to report falls on you, not on the developer who disappeared. What to do in the first hours is covered in the article on a hacked website.

When starting over is the better call

Sometimes fighting for the old code is not worth the effort.

If the site runs on an outdated CMS, has had no updates in years and no longer reflects what you do, then the domain is the only thing genuinely worth fighting for. Everything else is faster and better rebuilt than reconstructed.

The criteria and what a rebuild costs are covered in the articles on website relaunches and what a website costs.

How to avoid this next time

Three rules that remove the problem entirely:

Register the domain yourself. In your name, your company, your card, at a provider you chose. Ten euros a year is the cheapest insurance available. Your developer can be listed as admin contact and manage everything technically, without ever being able to change the holder.

Insist on an access inventory. A simple table: which service, which provider, which account. No passwords, just the structure. A developer who refuses to provide it is telling you something.

Put code ownership in writing. Who owns what you paid for? Do you receive the files when the engagement ends? One paragraph in the proposal is enough. What that paragraph should say is set out in the article on who owns the website.

Frequently asked questions

Can DENIC give me my domain back? No. DENIC stays out of domain disputes and performs no legal assessment. It only intervenes after a final, binding judgment against the domain holder. What it offers is the DISPUTE entry, which preserves the status quo but decides nothing.

What does a DISPUTE entry cost? Nothing. It is free and initially valid for one year from DENIC's confirmation. If the dispute continues beyond that and you can evidence it, the entry can be extended on application.

My developer is listed as admin contact. Can they transfer the domain to themselves? No. The admin contact may make changes to the domain but may not change the holder. A holder change requires the express consent of the current holder. While you are registered, the domain is under your control.

How do I find out who holds my domain? A whois lookup at DENIC shows whether a domain is registered, but full holder data is no longer published for data protection reasons. To obtain it, DENIC provides a request form requiring proof of legitimate interest.

The site is still up. How urgent is this really? While nothing needs changing, it keeps running. It becomes critical when an invoice goes unpaid, a security issue appears, or a legally required detail needs correcting. Until then you have time — but it is time to spend on archiving the content and settling the ownership question.

Do I need a lawyer? If you are the registered holder, usually not — the provider resolves it through its proof-of-entitlement process. If the developer is the holder and does not respond to a businesslike letter with a deadline, then yes.

Does any of this apply to .com domains? The principles do: ownership is what matters, and the admin contact cannot transfer it. The procedures differ. Generic domains follow ICANN's transfer policy and the UDRP dispute process rather than DENIC's rules, and there is no direct equivalent of the free DISPUTE entry.

In short

Everything hangs on one question: who is registered as the domain holder.

If it is you, the rest is paperwork through the provider. If it is the developer, a process begins — a letter, a lawyer if needed, and alongside it a DISPUTE entry that stops the domain moving on while the claim runs.

Either way: archive the content while the site is still up.