My Web Developer Disappeared: The First 48 Hours

Your web developer disappeared. The last message went unanswered a week ago, the phone goes to voicemail, and the store is still taking orders on code only one person understands. What you do in the next two days decides whether this is a handover or a rebuild.

This is the plan we give merchants who call us in that state. It is written for a store owner, not a developer, and most of it costs nothing but attention.

What you control, and how to find out

A store is five accounts, and the question is which of them are in your name. Until you know, every other step is guesswork.

The domain

Start with a WHOIS lookup on your own domain name. It tells you which registrar holds it and, unless privacy protection hides it, who the registrant is. If the registrant is your developer, that is the first thing to fix. If it is you, log in to the registrar today and confirm the email on the account is one you read.

The hosting

The server or the platform account the store runs on. On Shopify this is the store itself and the owner email on it. On Magento, WooCommerce or BigCommerce it is a hosting provider, and the invoice tells you who pays for it, which is usually who controls it.

The store admin

Your own administrator login, with the rights to add and remove other users. A login that cannot see the users list is one someone else outranks.

The repository

The source code, on GitHub, GitLab or Bitbucket. Shopify themes live inside the store, but any custom app, and every Magento or WooCommerce codebase, lives in a repository that belongs to whoever created it.

The payment account

Your processor's dashboard: Shopify Payments, Stripe, PayPal, Authorize.net or the acquirer behind your checkout. Check who owns the account and whether your developer is an administrator on it.

Write the five down with a tick or a cross beside each. Two crosses is normal. Five is rare, and still recoverable.

The first 48 hours after your developer disappeared

Work the list in this order: the steps that stop damage come before the steps that recover control, and nothing on it is irreversible.

Hour one: do not panic, and do not delete anything

The store is working. Customers are not reading your inbox. Resist the urge to change the theme, uninstall apps, update plugins or cancel services you do not understand yet. A plugin you remove because you do not recognise it may be the one that sends order confirmations.

Check what is still being billed

Open your card statements and your email for recurring charges: hosting, the domain, apps, the developer's own retainer. A developer who has gone quiet is often still being paid. Note every charge, but do not cancel the ones that keep the store up: cancelling hosting because the invoice came from the developer takes the store down with it.

Recover the domain

If the registrar account is yours, change the password and turn on two-factor authentication. If the domain is registered in the developer's name, you need it transferred to a registrar account you own, and the rules are on your side. Under ICANN's Transfer Policy, the registrar must give the registered name holder the authorization code for a transfer, must remove a transfer lock within five calendar days of a request where it offers no way to do it yourself, and may not refuse to release the code because of a payment dispute. That protects the person named as the registrant, so the first task is proving you are that person, with your invoices and your correspondence. Registrars have a process for this.

Recover hosting

Contact the hosting provider from the email on the invoices with your business details and ask to be made the account owner, or to have the account moved into your name. If the hosting is paid by the developer and they will not respond, a full backup of the files and the database lets you stand the store up elsewhere while the dispute runs.

Recover the store admin and the repository

On the store, use the owner account to list every user and every API integration, and remove the ones you cannot name. On the repository, ask the platform for ownership of the organisation if your company paid for it; if it was created under the developer's personal account, request a transfer, and if that fails, take a copy of the code from the server itself, because the deployed files are a complete copy of what is running.

Take a backup before you change anything else

One full export of the database, the files, the theme and the product catalog, stored somewhere the developer has never had access to. On Shopify, download the theme and export products, customers and orders. On a hosted platform, ask the provider for a snapshot. This is the point of no return: after it, a mistake can be undone.

Change every password and key you now hold

Admin passwords, hosting logins, API keys, the database password, the payment dashboard, the email account that receives order notifications. Every credential the developer may have is a credential they still have until you rotate it. Do this last, with the backup taken, because rotating a database password before you know which services use it is how a store goes down on day two.

Where the developer usually holds the keys

Five places account for almost every lockout we are asked to undo, and none is a sign of bad faith. They are the defaults of a freelancer who set the store up quickly and never tidied the ownership.

The domain in their name

Registered during the launch rush from the developer's own account. The WHOIS lookup shows it, and the transfer policy above is the way back.

Hosting under their account

Many freelancers resell a slice of their own server. The invoice says their business name, the account is theirs, and your store is one folder on it. The provider can split the account with the holder's consent or a clear chain of ownership, which is why the invoices and the contract matter.

Shopify collaborator access

On Shopify, an agency or freelancer should work through a collaborator account rather than a staff login you created for them. Shopify's own collaborator accounts are requested by the Partner, accepted by the store owner, carry only the permissions the owner sets, and do not count toward the store's staff limit. A staff login, or the store owner login, is changed today; collaborator access is revoked in one click and nothing else moves.

Magento Composer keys under their Marketplace account

A Magento store downloads its core packages and extensions with a pair of authentication keys from an Adobe Commerce Marketplace account. If that account is the developer's, every extension licence purchased through it is tied to them, and the next upgrade needs keys you do not have. The fix is your own Marketplace account, your own keys and the extensions re-licensed to you, best done before the next security patch rather than during it.

The repository on their GitHub

The most common one, because the store keeps running without it. The deployed code is yours to copy today; the history and the documentation live in the repository, which a personal account can delete in a minute. Ask for the transfer in writing and take the copy from the server either way.

What a rescue team does with those 48 hours

If the list above is longer than you want to work through alone, this is what the first two days look like with us. Our ecommerce project rescue starts with a free read of the repository and the store inside two business days: what is salvageable, what is urgent, and what it would take, in writing. Nothing is changed during the read, and the previous developer is not contacted, because the assessment is yours and so is the decision about what to tell them.

The read ends with a state-of-the-store report. It says where the access gaps are and how to close them, which parts of the code are sound, which parts are losing orders today, and whether the foundation can carry the business. If it can, the next step is a fixed-scope first week: access recovered, backups and monitoring in place, the hotfixes that stop the bleeding, and a plan with estimates for the rest. If it cannot, the report says rebuild and shows the numbers, because a rescue is only worth doing while it costs clearly less than starting again.

Shopify stores follow the same pattern with their own checklist: collaborator access, the theme pulled into version control, the apps audited, and the checkout customisations checked against what Shopify still supports. The Shopify project rescue page describes that version of the first week.

Whether you call anyone or not, there is one thing worth doing on day one that needs no access at all. The free AI site audit reads the store from the outside, the way a visitor and a search engine see it, and tells you what is broken, slow or exposed before you have recovered a single login. It is the baseline you compare the recovered store against.

When to call the lawyer, and when not to

Most disappearances are not disputes: the freelancer took a job, the two-person agency closed, someone got ill. A written request for the handover items, with a deadline, resolves the majority.

A lawyer earns their fee when there is money or property at stake that the process above cannot recover: a domain the developer refuses to transfer, a repository they will not release, a retainer still being charged for work that stopped, or a contract that says the code belongs to them. The contract, the invoices and the correspondence you gathered in the first hour are the evidence. This article is general information and not legal advice; a lawyer licensed where your business is registered can tell you what your contract actually says.

Key takeaways

• A store is five accounts: domain, hosting, store admin, repository and payment. Find out today which are in your name.
• Recover access before you remove anything, back up before you change anything, and rotate credentials last.
• The registrant of record controls the domain, and ICANN's rules oblige the registrar to release it to that person.
• A free two-business-day read of the store tells you whether this is a handover or a rebuild before you spend anything.

Conclusion

A developer who disappears leaves a store that still works and an owner who cannot prove they own it. The first 48 hours are for proving it. After that it is an ordinary engineering project with an unusual start, and ordinary projects get finished. Keep the store trading, and get the read of the code before you decide what the code is worth.