A neglected website can usually be recovered, but the order matters: secure the domain first, then the hosting, then the logins, and only then decide what to do with the site itself. This is the sequence I follow when an owner calls about a site nobody has touched in years.
Step 1: Triage before you touch anything
Open the site on your phone and on a computer. Does it load normally, load with a certificate or "not secure" warning, show a parking page or an error, or not load at all? Each points to a different broken piece. Then send yourself a test through the contact form; if nothing arrives, it may have been failing quietly for months.
Next, the domain. A WHOIS lookup is a public record search: type the domain into a lookup tool (most registrars offer one; ICANN runs an official one) and you get the registrar's name and the expiration date. The owner's name is usually hidden by privacy protection, so don't worry if your business isn't shown. If the domain expires within sixty days, it goes to the top of the list.
This table is the whole job in miniature.
| Order | Account | Why it matters |
|---|---|---|
| 1 | Domain registrar | Owns the name |
| 2 | DNS | Points the name at hosting and email |
| 3 | Hosting | Holds the files and database |
| 4 | Website admin | Lets you edit the site |
| 5 | Business email | Recovery address for everything above |
| 6 | Google Business Profile | Map listing and reviews |
| 7 | Analytics and Search Console | What search engines see |
Step 2: Regain the domain
The domain is the one asset you cannot rebuild. Search old email for the registrar's name: receipts, renewal notices, "your domain has been registered". Try the registrar's account recovery with every address the business has used. If the account is in the developer's name, you need them to transfer the domain to you; if they refuse, registrars have a formal dispute process, but it is slow and needs proof such as invoices and business registration.
Do not let the domain lapse in the meantime. After expiry there is a short grace period, then a redemption period with a steep fee, then the domain drops and anyone can register it. There are services whose only business is catching dropped domains and reselling them or pointing them at ads. If you can renew from anyone's account, even the developer's, do that first and settle ownership afterward. Once the account is yours, turn on two-factor authentication and automatic renewal.
Step 3: Regain the hosting and the site files
Hosting is where the files and database live. The DNS records at the registrar show where the site points, which usually names the hosting company. Same routine: receipts in old email, account recovery, support with proof you own the business and the domain.
If the developer hosted the site on their own account, you need their cooperation. Ask politely and in writing: a short email saying you are updating the business's records and asking for the hosting login or a transfer, a full backup of files and database, and any other credentials they hold. A hostile tone is the fastest way to get ignored.
What you are entitled to depends on your contract, and many small sites never had one. In general, you paid for the site, so the content and design are yours; a hosting account the developer pays for is theirs, but they should still hand over a copy. If they never respond, the public pages can be saved from the live site or the Internet Archive: the words and images, not the database.
Step 4: Regain the website admin and the email
With hosting access, the admin is usually the easiest piece. On WordPress and similar platforms, the password reset goes to the admin user's email; if that address is dead, the hosting control panel lets you change it or create a new admin user. Then remove the old developer's user.
Email matters just as much, because it is the recovery address for everything else. Find where it is hosted (the domain's MX records tell you), regain that account, and point every recovery address above to a mailbox you control.
Do all of this from a clean device: a computer with current updates, not the office laptop that has sat unpatched for three years. If the site was compromised, the same malware may have reached whatever was used to manage it.
Step 5: Assess the damage
In the admin, note the platform and version. A WordPress install untouched for years will have plugins that no longer exist and a PHP version the host wants to retire. Click through every page and note what's broken: missing images, forms that don't send, prices from 2019.
Look for signs of compromise: unfamiliar admin users, plugins nobody installed, pages in languages you don't use. Then search site:yourdomain.com for indexed pages you don't recognize; pharmacy and casino pages are the classic tell. Search Console, if you can get in, states directly whether the site has a security issue. The fundamentals are in my guide to website security basics for small businesses.
Step 6: Decide: repair, migrate, or rebuild
What the old site cost is not a reason to keep it.
- Repair when the platform is current or easily updated, the content is mostly right, nothing is compromised, and the design isn't embarrassing. Often a day or two of work.
- Migrate (move the same site to hosting you control, then clean and update it) when the site is fine but the hosting is the problem: the developer's account, an old server, a host you can't reach. Migrations start around $750.
- Rebuild when the platform is abandoned, the site was compromised, or the content no longer describes the business. A redesign that reuses content starts at $2,800; a new five-page site at $3,200.
Rough rule: if the site is more than five or six years old and you will rewrite most of the text anyway, rebuilding is usually cheaper than a long repair. If you want an outside opinion first, a site review is $250, credited toward whatever comes next.
Step 7: Preserve what still works
Even a dated site has things worth keeping: its place in search results, links from other sites, and a Google Business Profile pointing to it.
If you rebuild and the page addresses change, redirect each old URL to the closest new page. Google's guidance on site moves with URL changes covers the details; in plain terms, without redirects every existing link to the old pages hits an error, and whatever ranking those pages had goes with it. Keep the same domain unless you have a strong reason not to.
Make sure the Google Business Profile is in an account you control. If the developer created it, request ownership of the Business Profile through Google, and keep its website field pointing at your domain. Use the same business name, address and phone on the new site; that consistency is a large part of local SEO for Fairfield County businesses.
Step 8: Make it not happen again
The site was lost because the knowledge lived in one person's head. Fix that, not just the site.
- Every account in the table is in the business's name, on an email the business controls, with you as owner and any developer as a collaborator.
- One written record, kept somewhere safe, listing each service, the login email, who has access, what it costs and when it renews.
- Auto-renewal on the domain and hosting, with a calendar reminder a month before each date.
- A maintenance plan: updates, tested backups, someone watching uptime and the certificate, which is roughly what website maintenance includes. My care plan does this for $125 a month, but what matters is that someone is named and it is written down.
When to do it yourself, and when to call someone
Steps 1 and 2 you can and should do yourself: the triage, the WHOIS lookup, the registrar recovery. The registrar will only deal with the owner anyway, and holding that account yourself is the whole point.
Steps 3 through 5 are doable alone if you are comfortable in a hosting control panel and patient with support tickets. People get stuck on a dead admin email, a database they can't reach, or a site that turns out to be compromised. That is when to bring someone in, because a wrong move there can lose what's left.
If you would rather hand over the recovery and get back a working site plus a record of where everything is, get in touch. Either way, start with the domain today.
Javier NapolesJavier Napoles is the founder of Argus Digital Works in Stamford, Connecticut. He designs, builds, secures and maintains websites for small businesses in Fairfield County and remotely, and holds CompTIA Security+. About Javier