It usually starts small. A request takes a week instead of a day. Then the invoices keep arriving but the replies stop. Eventually you realise nobody at your company can log in to your own website.
This is more common than anyone admits, and the panic is unnecessary. But the order you do things in matters.
1. Find out what you actually own
Three things, in this order:
- The domain. Check the registrar. If it is registered to your agency rather than your company, this is the most urgent item on the list. Everything else can be rebuilt. The domain cannot be taken back easily if someone else holds it.
- DNS. Where the domain points. Often at a different provider from the registrar.
- Hosting. Where the site actually lives, and whose card pays for it.
If all three are in your agency’s name, you do not have a website problem. You have a leverage problem.
2. Get administrative access
Not an editor account. Full administrator on the CMS, plus the hosting control panel. Ask directly, in writing, and cite the contract if you have one.
Ask for access while the relationship is still polite. It is much harder once it isn’t.
3. Take a backup you control
Files and database, downloaded somewhere you own. Not a backup that lives on their hosting. Do this the day you get access.
4. Check what state it is actually in
Now you can look properly. Plugin and core versions, SSL certificate expiry, when it was last updated, whether backups were ever running. This is usually where people discover the site has not been updated in two years.
5. Change every credential
Once you have control, rotate everything. Admin passwords, database credentials, API keys, FTP. Remove old user accounts, including the ones belonging to people who left years ago.
The short version
Domain, access, backup, assessment, credentials. In that order. Most of it you can do yourself in an afternoon. If the domain is in someone else’s name, start there and start today.