Your developer disappeared.
How to get control of
your site back.

It rarely announces itself. A freelancer stops replying. An agency quietly closes. The staff member who "handled the website" leaves, and nobody thought to ask what they were handling. For a while nothing happens, because a website does not need anyone to be alive for it to keep serving pages.

Then something needs changing. Or a renewal notice goes to an inbox nobody reads. Or the site goes down and the only person with the login is gone. That is usually the week a Singapore business owner discovers they cannot get into their own website, and in some cases do not know who legally holds the domain their company email runs on.

Here is the reassuring part. This is almost never a rebuild. It is an access problem, and access problems have processes. What it needs is doing things in the correct order, because the wrong order can lock you out further.

Four things you need,
and they are not the same thing.

Most of the confusion comes from treating "the website" as one item. It is at least four, often held in four different places, sometimes by four different people.

The domain name. Your address, registered through a registrar and renewed annually. This is the only piece on the list you genuinely cannot rebuild. Everything else can be recreated with enough time and money. Your domain cannot.

The DNS. The instructions that say which server your domain points to, and where your email goes. DNS is often managed somewhere other than where the domain is registered, which is why people who "have the domain" can still find their site pointing at a server they cannot reach.

The hosting. The server where your files and database live. This may be an account in your company name, or it may be a slice of your developer's reseller account, which is a very different situation and worth establishing early.

The CMS admin. The login for WordPress or whatever platform runs the site. This is the one most business owners do have, and the one that matters least. An administrator login lets you edit pages. It does not let you keep your domain.

There is often a fifth. If your business email runs on the same domain, then whoever controls the DNS controls your email. For most businesses, losing the website for a week is survivable. Losing the email for a day is not.

An admin login lets you edit your pages. Only the domain decides whether the site is yours at all.

Find out what you
actually control.

Before contacting anyone, spend an hour establishing facts. You may hold more than you think, and you need to know which conversations you are about to have.

Look up your own domain. For a .sg address, use the WHOIS lookup at sgnic.sg. For .com and similar, any public WHOIS tool works. You are looking for three things: the registrant name, the registrar holding it, and the expiry date. If the registrant is your company, you are in a strong position. If it is your developer's name or their company, you have found your first task.

Note that .sg records are partially masked. Since 2005, SGNIC has hidden the contact email and phone on .sg WHOIS records to reduce spam. You will usually still see the registrant organisation and the registrar, which is what you need. Do not assume the domain is untraceable because no email is showing.

Check the expiry date first, not last. This is the single most urgent number on the page. Recovery takes time, and a domain that lapses mid-process turns an access problem into a genuine emergency. If expiry is close, renewing it beats everything else on this list, even if you have to renew through a party you are unhappy with.

Follow the money. Your bank or card statement is an ownership record that nobody can lock you out of. Look for annual charges to registrars and monthly or yearly charges to hosting companies. If you are paying a provider directly, you almost certainly have an account with them and can start a password reset today. If the charges go to your developer instead, that tells you the accounts sit with them.

Test the logins you believe you have. Not the ones you remember having. Actually log in, and check your CMS account is an administrator rather than an editor. An editor account feels like access right up to the moment you need to change anything that matters.

Take it back in the
right order.

Recovery has a sequence, and skipping ahead is how people lose things permanently. Work outside in: domain, then DNS, then hosting, then the CMS.

Secure the domain first. Whoever holds the domain can point your website and your email anywhere, at any time. Until it is in your name, in an account you control, nothing else you fix is safe. Everything else can be rebuilt. This cannot.

For .sg domains, know the actual process. Moving a domain between registrars needs a transfer password issued by the current registrar, which you then give to the new one. A change of registrant is separate, requires approval by email from the current registrant, and takes about seven days to complete. Both are ordinary administrative procedures, not favours.

There is a route when the current registrar goes quiet. This is the detail worth knowing. If a transfer request is submitted and the current registrar neither approves nor rejects it, SGNIC approves the transfer after seven days from the request date. Silence is not a permanent block. It is a delay with a defined end.

Then move DNS, then hosting. With the domain secure, point DNS at infrastructure you control, and make sure your email records move across intact and tested before anything is switched. Then get the files and database off the old server, or rebuilt on a new one. Do this in the wrong order and you can take your own site offline with no way to put it back.

Leave the CMS login until last. It is the least consequential item and the easiest to reset once you own the hosting underneath it.

Unreachable is not the
same as unwilling.

If they have simply vanished, this is paperwork. Registrars and hosting companies have account recovery processes and will generally work with a company that can prove who it is. Have your ACRA business profile, past invoices, payment records and correspondence ready before you call. Be patient and precise rather than urgent and vague, because the person on the other end is following a checklist and you want to satisfy it.

If they are reachable but holding on, separate the two questions. There is a commercial matter, perhaps an unpaid invoice or a disputed scope, and there is the operational matter of your business being able to function. Settle the first on its own terms and do not let the second be the leverage. Where genuine ownership is contested, that is a conversation for your lawyer, not your web developer, and any developer who tells you otherwise is out of their depth.

Rebuilding on a new domain is the last resort, not the shortcut. It is sometimes proposed as the quick fix. Understand what it costs before agreeing: every ranking you have built, every backlink pointing at you, your email addresses, and every business card, invoice and vehicle decal carrying the old address. Exhaust the recovery routes properly first. They work more often than people expect.

What you can do
with no logins at all.

Waiting on a registrar does not mean waiting idle. Some useful work needs no access whatsoever.

Take a copy of everything public. Your live site is visible to you like anyone else. Page text, images, product descriptions, testimonials, contact details, all of it can be captured now. If the worst happens, rebuilding from your own content is a completely different project from rebuilding from memory.

Save the structure, not just the words. Note every page and its URL. Your sitemap.xml, if it is published, lists them for you. That list is what protects your search visibility later, because it lets whoever rebuilds the site map old addresses to new ones instead of guessing.

Get your own accounts in order. Google Business Profile, analytics, social accounts, payment gateways. These are often separate from the website and easier to recover, and they are worth securing before you need them.

And renew the domain if it is close. It bears repeating because it is the one irreversible deadline in this whole process. Renewal is cheap. Recovering a lapsed domain that somebody else has picked up may not be possible at any price.

Then make sure it never
happens again.

Once you are back in control, the fix is structural rather than technical, and it takes an afternoon.

Own the accounts, delegate the work. The business holds the registrar and hosting accounts. Your developer gets their own user access within them. That is a normal professional arrangement and no competent developer will object to it.

Use a company mailbox, never a personal one. Accounts tied to a staff member's inbox leave with the staff member. A shared address such as admin@yourbusiness.com.sg outlives everyone who works there.

Treat offboarding as a task. When a working relationship ends, on good terms or bad, revoke the access that came with it. Most lockouts begin as a good relationship where nobody wrote anything down.

Where we come in.

The process is the same every time. We run the audit, tell you plainly what you hold and what you do not, and deal with the registrars and hosting companies on your behalf so you are not chasing support tickets between meetings.

When it is done, the accounts are in your company's name, with your billing and your recovery email, and you get the written record of where everything sits. That stays true whether or not you keep working with us afterwards. A client who cannot leave is not a client, they are a hostage. We do not work that way.