Quick answer
If your developer has disappeared, secure the domain first, then the hosting account, then a full backup of the site. Prove ownership with invoices and company records, deal with the registrar and host directly, and keep enquiries flowing with a temporary page while you rebuild control.
This guide is for Singapore business owners whose website was built or managed by a freelancer or agency that has stopped replying. Maybe the site is down, maybe it has been hacked, or maybe it simply needs a change nobody can make. By the end you will know what to recover, in what order, who to contact, and how to make sure it never happens again.
We are writing from the receiving end of these situations. Adssential Marketing, a Singapore digital growth agency, has designed and built close to 800 websites since 2018, and a steady share of our maintenance work starts with a client who has lost contact with the person who held the keys.
What should you do first when your web developer stops responding?
Stop chasing the developer and start listing what you control. A website is really three separate things: the domain name (your address), the hosting (the server that stores the files and database) and the website itself (WordPress or another platform, plus its content). Each one can be held by a different company and a different login.
Give the developer one clear, dated message by email and WhatsApp asking for the logins and a backup, with a deadline of a few working days. Keep a copy. After that, move on to the steps below in parallel; you do not need their permission to recover assets that belong to your business.
How do you find out who actually owns your domain?
Run a WHOIS lookup on your domain to see which registrar it sits with and when it expires. The expiry date is the number that matters most: if it is within the next few weeks, the domain is your emergency, ahead of everything else.
For .sg domains, the registry is SGNIC, but you never deal with SGNIC for the registration itself. You deal with one of the accredited registrars on SGNIC’s list of registrars, and each registrant is bound by an agreement with the registry and a commercial agreement with that registrar. In practice that means the company named as the registrant is the legal holder, even if the developer opened the account and paid the bill.
One Singapore-specific detail catches people out: .sg WHOIS records mask the registrant’s email and phone number, while the technical contact is shown in full. If the developer listed themselves as the technical contact, you will see their details but not yours. That is not proof they own it; ask the registrar who the registrant is.
What to prepare before you call the registrar
- Your ACRA business profile showing the company name and UEN, matching the registrant name.
- Invoices or receipts showing you paid for the domain or the website.
- A letter on company letterhead, signed by a director, asking for access or a change of contact details.
- A note of the domain, the date you lost contact and every attempt you made to reach the developer.
Phone rather than email if the registrar offers it, ask for a case number, and ask exactly which documents they need. Every registrar has its own verification process, so follow theirs rather than guessing.
Can you move a .sg domain to another registrar without the old developer?
Yes, once you control the registrar account, or once the registrar recognises you as the registrant. SGNIC’s process works like this: you get a domain transfer password from the current registrar, give it to the new registrar, and the new registrar submits the transfer to SGNIC. According to the SGNIC domain registration FAQ, if the losing registrar does not respond to the request, SGNIC approves the transfer after 7 days.
The losing registrar can ask for outstanding payments first, so check whether the domain has unpaid renewals. For .com and other international domains the mechanics are similar (an authorisation code and a transfer request), but the rules come from the registrar and ICANN rather than SGNIC.
Do not rush a transfer while the domain is close to expiry or while you still need the old DNS settings. Write down every DNS record first (the A record pointing to your server, the MX records for email, and any TXT records for Google or Microsoft). A transfer that loses your MX records is how a website problem becomes a company-wide email outage.
How do you regain access to your hosting and website files?
Contact the hosting company with the same proof of ownership. If the hosting account is in your company’s name, most hosts will verify you and reset the login. If it sits inside the developer’s own reseller account, you are a customer of the developer rather than the host, and the host may only be able to help if the developer’s account is closed or unpaid.
Either way, the goal is the same: get a complete backup of the files and the database before anything else changes. With WordPress that means the wp-content folder (themes, plugins, uploads) and a database export. With a hosted builder such as Wix or Shopify, the account owner’s login is everything, because there are no server files to copy.
Once you are in, change every password, remove admin users you do not recognise, and turn on two-factor authentication. Assume the old logins are known to someone you can no longer reach.
If the site is already offline or hacked
A site that was abandoned is often a site that was never updated, which is exactly how outdated plugins and old PHP versions get exploited. If the site shows spam, redirects to strange pages or has been flagged by Google, treat it as a security incident: take a copy for evidence, then clean or rebuild from a known good state. Our guide on checking your PHP version and patch status shows one of the first checks we run.
💡 From our experience at Adssential
The hardest rescue we have handled was a business whose website had been hacked while its previous vendor could not be reached. Every day offline was a day without enquiries. Rather than wait for a full rebuild, we had a landing page live the same day and pointed all their channels to it, so leads started coming in again straight away. While that kept the business running, we rebuilt a stronger lead pipeline and a proper website behind it, recovering their old content and saved images of the previous design from the Internet Archive’s Wayback Machine, so we did not have to start from zero.
How do you keep enquiries coming in while you sort it out?
Put up a simple, fast landing page as soon as you control the domain. It does not need to be pretty. It needs your business name, what you do, your phone number, a WhatsApp button and a short enquiry form. Point your Google Business Profile, ads and social links to it.
This buys time. Recovering hosting or negotiating with a silent developer can take weeks, and in Singapore, where many buyers message a business on WhatsApp within minutes of finding it, a dead link loses the enquiry to the next result on the page.
Recovering content you cannot reach
If you cannot get the files at all, the Internet Archive’s Wayback Machine often holds snapshots of your old pages, text and images. It will not give you the database, plugins or form settings, but it can save you from rewriting every page from memory. Google’s cache is no longer available, so the Wayback Machine is now the main public fallback.
What are your PDPA obligations if the developer held your customer data?
They stay with you. Under section 4(3) of the Personal Data Protection Act, an organisation has the same obligations for personal data processed on its behalf by a data intermediary as if it had processed the data itself. Enquiry forms, newsletter lists and online orders all hold personal data, so a website your vendor abandoned is still your PDPA responsibility.
📊 Field data and verified research
If a breach is notifiable, the PDPC expects you to notify it as soon as practicable and no later than 3 calendar days after you assess it as notifiable (PDPC, Before you report a data breach). The Cyber Security Agency of Singapore reported 165 ransomware cases in 2025, with SMEs the most affected (CSA Singapore Cyber Landscape 2025/26). An unmaintained site is an easy target.
Compliance note: this is general guidance, not legal advice. If you suspect customer data was exposed, speak to a lawyer or your data protection officer about whether the breach is notifiable.
Should you rescue the old website or rebuild it?
Rescue it when the site is recent, the platform is mainstream and you can get a full backup. Rebuild when the site is several years out of date, built on a custom system nobody else understands, or already compromised. Do not decide on looks alone; decide on what it will cost to keep the site secure for the next three years.
If you rebuild, protect what already ranks. Keep the same URLs for pages that bring traffic, or set up 301 redirects from old to new addresses, so a change of developer does not also become a loss of Google rankings. Our SEO team treats this as part of any rebuild, not an extra.
In our experience the rebuild decision gets easier when you split it in two: first get a working page live so the business is not losing leads, then make the rescue-or-rebuild call calmly with the full picture. A typical rebuild takes us 1–2 weeks for a standard site and 6–8 weeks for a larger or custom build.
How do you stop this from happening again?
Own your accounts, and let vendors work inside them. That one rule prevents almost every lock-out we see. A good developer or agency should be comfortable with it; if they insist on holding everything under their own name, ask why.
What to put in your next website contract
- All accounts are registered to the client; the vendor works as a user.
- The client owns the content, design files and code it has paid for (licensed themes and plugins stay under their own licences).
- A handover clause: on request, the vendor provides logins, a full backup and a short note of how the site is set up, within a set number of working days.
- Who is responsible for updates and security after launch, and what happens if that support ends.
Ongoing care matters as much as the contract. Small monthly updates are always cheaper than one big catch-up after something breaks, which is why we offer ongoing website maintenance as well as one-off fixes. Our guide to how long website maintenance takes explains what a routine month looks like.
💡 From our experience at Adssential
When a client tells us their developer has vanished, we first check whether they still have their login details and whether they are actually the owner of the accounts. We also look for anything that has been defaced, and for recurring payments that are still running. That tells us the next step: either we make a carbon copy of the site and move it to hosting the client controls, or we help them request that ownership is switched to them. Either route works. Because we co-host and run some hosting space of our own, we can take an abandoned site under our care quickly while the ownership side is sorted out.
How do you choose a new developer after being let down?
Look for the opposite of what went wrong. Ask every candidate the same five questions, and judge them on how plainly they answer.
- Whose name will the domain and hosting be in? The right answer is yours.
- What happens after launch? Look for a clear maintenance offer, response times and who does the updates.
- Can I see sites you built that are still live? A portfolio of working sites says more than mock-ups.
- How do you handle a rebuild without losing my Google rankings? Listen for URL mapping and redirects.
- What will you need from me? Good developers ask for content, logins and decisions early, because those cause most delays.
If you are comparing quotes, our guide to website development costs in Singapore explains what moves the price, and our web design team can show you the live sites we have built.
Frequently asked questions
Can my web developer legally keep my domain name?
Whoever is named as the registrant is the legal holder of the domain, so check the registration before assuming anything. If your company is the registrant, the registrar can verify you and restore access. If the developer registered it in their own name, you may need to negotiate a transfer or seek legal advice, using your invoices and contract as evidence.
How long does it take to transfer a .sg domain?
Once you have the domain transfer password, the new registrar submits the request to SGNIC. If the current registrar approves it, the transfer can be quick; if the current registrar does not respond, SGNIC approves it after 7 days. Clear any unpaid renewals first, because the current registrar can ask for them.
What if I have no backup and cannot reach the hosting?
Check the Internet Archive’s Wayback Machine for saved copies of your pages, text and images, and ask the hosting company whether it keeps its own backups. You will usually lose the database and settings, but you can often recover enough content to rebuild without starting from a blank page.
Will changing developers hurt my Google rankings?
Not if the change is planned. Keep the URLs of pages that rank, or redirect old addresses to the new ones with 301 redirects, and keep your Search Console and Analytics accounts. Rankings usually drop when a rebuild changes every URL and nobody sets up redirects.
Is my business responsible if the old developer’s server leaks customer data?
Yes. Under section 4(3) of the PDPA, your organisation keeps the same obligations for personal data processed on its behalf by a data intermediary as if it had processed the data itself. If you suspect a breach, assess it promptly, because notifiable breaches must be reported to the PDPC within 3 calendar days of that assessment.
What is the next step?
Work in this order: domain, email, hosting, backup, then the site itself, and put up a simple page in the meantime so the enquiries do not stop. Once you are back in control, move every account into your company’s name so that the next change of developer is a handover, not a rescue.
If you would like help, our web development team can take over an abandoned site, get a working page live, and give you an honest view on whether to rescue or rebuild. No ranking guarantees, just a clear plan and the keys back in your hands.