Guides · Website · Access
Lost Access to Your Website: Recovering the Domain, Hosting and Admin
A website rests on several accounts. Take back the recovery email first, then the domain name, the hosting and finally the site’s admin area, keeping all proof of ownership.
The short answer
Losing access to your website can mean three independent problems: the domain name, the hosting or the site’s admin area. The domain directs visitors and often email. The host keeps the files, the database and the backups. WordPress or another CMS manages the content and the users. A single provider can sell all three, but the access stays separate.
Start by securing the email address that receives the password resets. Then build an inventory from invoices, bank statements, old emails, contracts and Whois lookups. For each account, note the provider, the known login, the contractual holder, the recovery address and the next renewal date.
Take back the domain before changing any DNS, recover the hosting and export the files and the database, then reset the CMS admin. Keep the current settings until you have a complete copy: a domain transfer leaves the site and the email where they are.
Once you have regained control, put the accounts in the company’s name, turn on multi-factor authentication, create at least two named administrators and keep the credentials in a shared vault. The next change of provider should be possible with the company’s own accounts, without depending on an outside person.
Secure the mailbox that opens every other door
The email address used by the registrar, the host and WordPress receives the recovery links. Take it back first, change its password, revoke its sessions and check its recovery methods and forwarding rules.
If that address belongs to a former agency, an employee who has left or a domain that is itself unreachable, build a written timeline and contact each provider with the company’s proof. A new address controlled by the company can replace the old one once validated.
Separate the three sets of keys
Look for invoices, customer references, bank debits, renewal emails, contracts and screenshots of old customer areas. Whois or RDAP identifies the domain’s registrar. Invoices and contracts then help you find the site’s host.
| Access | What it controls | Where to find the provider | Proof to prepare |
|---|---|---|---|
| Domain name | The site’s address, DNS and often email routing | AFNIC Whois for a .fr, ICANN tool for other extensions | Company name, holder, invoice, customer reference, representative’s ID |
| Hosting | Files, database, logs and backups depending on the plan | Invoices, bank statements, old emails and the provider’s contract | Customer number, contract, invoice, domain concerned, representative’s ID |
| Site admin | Content, accounts, plugins and CMS settings | Login page, WordPress emails, documentation or the agency | Account address, hosting access, backup of the files and database |
Recover the account before asking for a transfer
The registrar manages the domain’s account. First ask for the account to be handed back and the contact address corrected. For a `.fr`, AFNIC lets you identify the registrar concerned, and the AuthInfo code must be provided free of charge to the holder.
The authorization code is used to move the domain to another registrar. The holder, DNS, hosting and email stay unchanged. Keep the configuration in place during recovery, then prepare any transfer you want separately.
What not to do
- Changing the DNS servers before noting down all the records
- Confusing a registrar transfer with a site migration
- Sharing the AuthInfo code outside the transfer you chose
- Sending several contradictory requests to different providers
Get a complete copy before every change
Ask for access to the account, then export the files, the database, the hosted emails, the DNS zones, the certificates and the available backups. Keep the references of connected services: payment, email sending, analytics and API keys.
A screenshot of the customer area shows the products you subscribed to, but only a restore validates the copy. Open the archive and the database in an isolated environment before a cancellation, a DNS change or a migration.
Start with password recovery
The “Lost your password?” function remains the simplest route when the account’s address works. Then check the administrators present and replace shared logins with named accounts.
With reliable access to the hosting, WordPress also documents methods using WP-CLI, the database or an emergency script. Make a backup before any intervention and hand these methods to someone who knows how to roll back. Delete any emergency script immediately after the reset.
Ask for the assets one by one, in writing
Send a factual request that separates the domain, the hosting, the files, the database, the CMS and third-party services. Attach the company’s supporting documents and ask for a written reply on each item.
If the domain is in the company’s name, the registrar can handle the account recovery. If a third party is the holder, the disagreement becomes contractual or legal. For certain disputes over a `.fr`, AFNIC’s PARL procedures let you ask for the name to be transferred or deleted under conditions. Technical support remains the entry point for a simple loss of access.
Subject: return of access and data for the website [domain]
Please send us, separately:
— the domain name account and its authorization code;
— the hosting account and the list of active services;
— a complete export of the files and the database;
— the site’s administrator accounts;
— access to the backups and connected third-party services.
Holder requested: [company name]
Representative: [name and role]
Supporting documents attached: [list]
Please state in writing any item that is unavailable and why.Keep control when staff or providers change
Put the domain, the hosting and the essential services into accounts created with a company email address. Turn on MFA, revoke old sessions and reset shared passwords, keys and secrets.
Keep an inventory with each service’s provider, holder, administrators, renewal date and recovery procedure. Keep a copy of the site outside the hosting. Two trusted people must be able to find this inventory without depending on a provider’s session.
What to ask your provider or support team
Who is the domain’s contractual holder, and which company bills its renewal?
The exact name of the holder, the registrar, the customer reference and the next renewal date.
Can you hand over the domain account and its authorization code while keeping the current DNS?
Access controlled by the company, the AuthInfo or authorization code, and confirmation that the zone stays unchanged.
Does the export you provided contain the files, the database, the media and the configuration needed to restart?
The list of items exported, their date and the result of a verification restore.
Which external services still use an account or key held by the former provider?
An inventory of the connected payments, email, analytics, backups, DNS, CDN and APIs.
What access will stay with the company after the contract ends?
The written list of accounts, data and backups handed back, and the date the other access is closed.
Sources
- AFNIC — Trouver les informations d’un nom de domaine avec le Whois (Finding a domain’s details with Whois)
The public holder, the registrar, the renewal date and the name servers of a .fr domain.
- AFNIC — Gérer son nom de domaine (Managing your domain name)
The registrar’s role and the holder’s free access to the AuthInfo code.
- AFNIC — Procédures alternatives de résolution des litiges (Alternative dispute resolution procedures)
The scope of the procedures for transferring or deleting a .fr name.
- ICANN — Domain name holder FAQs
Identifying the registrar, the authorization code, the deadlines and the grounds for blocking a transfer.
- WordPress.org — Reset your password
The official methods using email, WP-CLI, the database or an emergency script.