Skip to content
Up To Code

Manual 5 · Vendor Defense · 5.15 · Emergencies shelf

Your web guy vanished.
Here is how to get your site back.

Passed final Your helper — login work Takes: The lookup is tonight · transfers run about two weeks

He stopped answering, and your website feels gone. Tonight, for free, you can find out exactly who controls your website's name. Step 2 then sorts you into one of two roads. If your name is on the record, the way back is a short, known sequence. If his name is on it, the road runs on paperwork and patience.

Your helper takes the login and screen work on a laptop. You gather the paper — invoices, filings — and make the decisions. The first lookup is tonight, in a couple of minutes. On the quick road, budget two weeks of short sessions, not one — it runs on two clocks back to back, and Step 3 lays out both. On the harder road, nobody can promise a timeline. The failure box at the bottom tells you which road you're on and when to change tactics.

This has happened before. Here is the worst version.

In 2011, an owner went to log into his business email and found it dead. His website was down too. Every phone number he had for his web company rang disconnected. He did not know who hosted his site, who held the name, or what he actually owned. He was looking at years of paid work with no idea how much of it was still his.

That is the exact spot this page is written for. Here is the part that owner did not know yet: the system that runs website names has real rules, written down, and they side with whoever is named as the domain's owner on the record — which is why Step 2, whose name is on it, decides everything. If that's you, the rules are your crowbar. If the vendor filed it in his own name, the same rules protect him, and the path changes.

One definition before we start. Your domain is the name people type to find you (yourcompany.com). The rules for domains come from ICANN, the nonprofit that oversees domain names worldwide. Those rules are what this whole recovery leans on.

Steps 1 through 4 go after the name. Step 5 changes where the name points, once you have registrar-account access. Step 6 goes after the files.

Think of it like a lien release. A sub who will not sign off the paperwork on a job you already paid for does not get to keep the job. You do not beg him. You follow the release process, and the process works whether he cooperates or not. Domains work the same way, with one difference worth naming up front: if the paperwork was filed in HIS name instead of yours, the path gets harder. Step 2 sorts out which situation you are in.

Want a coach through it? Build your walkthrough prompt

Skip this box freely — the six steps below are the whole path and stand complete without it. It's here for whoever runs your screens, or for you if an AI coach sounds useful: fill in the boxes, press the button, and copy what comes out into whatever AI you already use (a free ChatGPT or Gemini account works; if you don't use one and don't want to, that's what the six steps are for). The prompt carries this page's verified facts inside it, orders the AI to go one step at a time in plain words, and forbids it from guessing about your specific registrar instead of admitting it isn't sure.

What leaves this page: the boxes have no server behind them, and what you type stays here — with one exception you control. If you press "Look it up for me," the domain name alone goes to a public lookup relay (rdap.org) and on to the registry's own record servers. Nothing else is sent.

What can you still log into today?

Step 1Find out what exists

The "look it up for me" button above runs this exact step. If you already pressed it, you have your answer — write the registrar's name down and move to Step 2. This is the by-hand version, for anyone who'd rather see it themselves or whose browser blocked the button.

Type your domain — or hand this one to your helper — into lookup.icann.org. It is free, it is official, and ICANN runs it itself. No account needed.

The result is your domain's registration record. Find the field marked Registrar. That field names the company that controls your domain's registration. Write the name down, even if you have never heard of it. And read one more field while you're there: the expiration date. If the date is close, the renewal is now the most urgent job on this page. If it has already passed, ask the registrar what it takes to reclaim the name, the moment you make contact. A name that fully lapses can be re-registered by anyone. Check the date before anything else on this page gets your energy.

Checkable result: you can say your registrar's name out loud.

What if that's a company I've never heard of?

Common, and not a problem. The name on the record is the registrar of record — the company legally responsible for your domain under ICANN's rules. Two things make it a name you might not recognize:

  • Your web guy used a middleman. A lot of web shops buy domains through a reseller that sits on top of a big wholesale registrar. So the record shows the wholesaler, while your actual account, if there is one, was with the reseller. You never dealt with the wholesaler, but under ICANN's rules that wholesaler is still the one on the hook to hand your domain over.
  • It's a hosting brand's domain arm. If you bought hosting from a big company, the domain may sit under a registrar name in that same family that looks nothing like the brand on your bill.

Either way, the move is the same. Start at the account, not the phone:

  1. Go to that registrar's website and try to recover the account using your business email — the "forgot password" link. If an account exists under your email, you may be one reset away from control.
  2. If there's no account under your email, a middleman holds it. That is the harder path in Step 2, and it runs on written records and the registrar-of-record's ICANN obligations, not on reaching the vendor.
  3. Whoever you contact, do it in writing where you can — a support ticket or an email — so every request has a date on it.

Checkable result: you know whether an account exists under your email at that registrar, or whether a middleman is in the way.

Step 2Whose name is on it

Same record, one more field: the registrant. Two words, one letter apart, two different things. The registrar ends like "car" — it is the company that keeps the record. The registrant ends like "tenant" — it is the owner named on the record. Step 1 found the company. This step reads the name.

If your name or your business's name is there: the rights are yours. ICANN's rules say plainly that transferring a domain between registrars is the registrant's right. Read one more line while you're in there, though — the email address on the record. Under ICANN's transfer policy the registrant named on the record is the only party who can approve or deny a transfer, so nobody else's consent is needed — but the confirmation email goes to the address on the record, so read which one is there.

So do it in this order. And do not clean up the email on the record first. Changing it is what springs the 60-day lock in Step 4.

If the vendor's name is there: this is the harder path. Contact the registrar of record in writing — a support ticket or email — and bring business records: invoices showing you paid for the domain and the site, plus your business filings. Ask what proof they need to review the registration. Nobody can promise you an outcome on this path. What you can do today is get your request and your records on file, in writing, with a date on them.

Checkable result: you know which name is on the record, yours or his.

Step 3Get the key

Moving a domain takes a transfer authorization code, usually called the Auth-Code. It is a one-time code that proves the transfer request is real.

Contact the registrar of record from Step 1 and request the Auth-Code for your domain. There are two routes, and be clear-eyed about which one you're on. With account access it can be quick: log in, find the transfer or unlock option. One speed bump to expect — a domain sitting in Lock status cannot move, and that lock is one of the listed reasons a registrar may refuse a transfer. It is not a wall. The same rules make the registrar give the name holder a reasonably accessible way to take the lock off, within 5 calendar days of asking. Flip the switch if you can see it in the account; if you cannot, put that request in the ticket too. Without account access, it's a support ticket with your proof attached. The 5-day clock runs from your request. Whether the registrar accepts you as the registrant is the real fight, which is why Step 2's answer matters so much. The obligation holds even when your web guy bought through a reseller on top of them. Make the request in writing where you can, and note the date.

Then budget for the second clock. Getting the code is the first one. Starting the transfer at the new registrar is the second: the old registrar gets 5 calendar days to answer the registry, and under ICANN's rules, if it says nothing, the silence counts as approval. The same goes for the contact on the record — if he never confirms and the registrar never explicitly denies it, the rules say the transfer proceeds anyway. A vanished vendor cannot block this by ignoring it. Write both dates down: the day you asked, and the day you started the transfer.

Checkable result: the code is in your hands, or your dated request is on record and the 5-day clock is running.

Step 4The 60-day trap

Read this step before anyone touches the account.

Changing the registrant's name, organization, or email address locks the domain against transfers for 60 days. Registrars are not required to offer a way out of that lock.

So the order of operations matters. Transfer the domain first. Fix the contact information second. If your helper cleans up the account tonight and puts your email on the record before the transfer, the domain can be stuck where it is for two months.

Checkable result: nobody has changed the name, organization, or email on the record, and everyone helping you knows not to. The order, one more time, because it is the trap: the transfer first. The contact info second.

Step 5Hosting is a different company

Two separate services keep a website alive:

  • The registrar holds the record of your domain name. Steps 1 through 4 live here.
  • The host runs the computer where your site's files actually sit.

This split works in your favor. Your domain can be pointed at new hosting without moving registrars at all. The pointing is a settings change inside the registrar account, under a setting called nameservers — a helper-with-laptop job, and the new hosting company's setup instructions cover their side of it. The honest precondition: this lifeline needs registrar-account access, the same access Steps 1–3 are fighting for. Once you're in — even while a transfer is still in progress — the name you own can point at a site you control.

Checkable result: you can name which company does which job for your site, or you know one of the two is missing from your records.

Step 6The site files

If anyone on your side can still log into the hosting account, download a full copy of the site now, every page and image, to a computer you own.

If nobody can get in, here is the shape of it. One owner reported a vendor leaving his business with no website once the contract ended. Another described a vendor holding his site hostage. Those are owner reports, not verified facts. The mechanics under them are not in dispute — files that sit on somebody else's computer leave when he does.

If the files are truly out of reach, do not spend months begging for them. A rebuilt site on a domain YOU control is worth more than a hostage site you can never touch. The domain is the asset that matters most; it is the address printed on your trucks and your cards. One owner reported a vendor assigning him a new web address without consent while the old one was still on his trucks, shirts, and business cards.

Checkable result: a full copy of the site saved on your own machine, or a written decision to rebuild on the domain you control.

Never again

When you hire the next company, the ownership terms go in writing before any money moves: the domain in your name, the hosting account in your name, and the site files yours on request. Two chapters cover that paper:

  • Reading a proposal — where ownership terms live in the paperwork, and how to spot the ones that are missing.
  • The five questions — what to ask any vendor before he touches your domain.

If a step dies here

Print this: the recovery checklist

Hand-off sheet · For whoever runs the laptop — the owner makes the calls

Getting the website back

Done by __________________Owner checked __________________

The first move is your domain name, typed into lookup.icann.org. That one free lookup turns "I have no idea what I own" into a list of names and a first move. It is the tonight step, and it costs nothing.