I have lost access to my own website

Losing access to your own website is four different problems wearing one description, and they are recovered in different ways. Work out which accounts you have lost before doing anything, because the routes are independent and one of them matters far more than the rest.

Start with the domain. With control of the domain, you can point the name at a new site. That keeps your web address, your email addresses and everything printed on vehicles, invoices and signage. Without it, any recovery ends at a different address. Everything else is repairable; this one is the constraint.

The four accounts and how each is recovered

Account	What losing it costs you	Recovery route
Domain registrar	The address itself, and email	Registrar’s process, tied to the registrant record
Hosting	The files and the server	Host’s account recovery, tied to the billing contact
Platform administrator	Editing the site	Password reset, or a database-level reset by the host
Email or DNS	Where mail goes	Usually follows the domain

The pattern is that recovery is tied to a record — a registrant, a billing contact, an email address — rather than to who is morally entitled to the account. That is why the practical question is never “whose is it” but “whose name is on the record”.

Start with the easy case: a password reset

If you have the login email address and can receive mail at it, most of this is a password reset and takes an afternoon. Work through the four accounts in the table above and reset each one. Then change the recovery address to something the business controls permanently rather than to an individual’s address.

Do this even when nothing is wrong. It is the whole content of finding out who controls your website accounts, and it takes twenty minutes.

When the recovery email address is the problem

Here is the common hard case. The accounts were created on an email address at a former staff member’s name, or at the supplier’s domain, or at an address that no longer exists.

Three routes, in order.

Recover the mailbox first. If the address is on your own domain, whoever administers your email can usually restore or forward it, and every other reset then works normally. This resolves more cases than people expect and is the reason the email question comes before the website question.

Use the provider’s account recovery. Registrars and hosts have processes for a legitimate account holder who has lost the email. They ask for evidence of identity and of entitlement — the entity name, the business registration, billing records, an invoice. Have those ready. It is slower than a reset and it works.

Ask, in writing, with a deadline. Where a supplier holds the accounts, send a written request naming the specific accounts, the specific credentials and a date. That request is both the fastest practical step and the record you will need if it goes further.

When the supplier will not co-operate on ownership or account credentials

This is a contract question rather than a technical one. This page will not tell you what you are entitled to, because that depends on what was agreed and on facts this page does not have.

What is worth knowing before the conversation: under the Copyright Act 1968 the person who creates a work generally owns the copyright in it unless it has been assigned in writing, so ownership of the site’s code and design is not automatic simply because it was paid for. The domain licence is a separate thing again, governed by auDA’s rules and by the registrant record. The two are set out on who owns your website and Australian domain eligibility.

The practical sequence that usually resolves it: recover independently whatever you can, request the rest in writing, and take advice before escalating. What a contract should have covered is on what a contract should cover.

What you can recover without domain access, server access or account credentials at all

More than most people assume, and it is worth doing early because it removes the leverage from the situation.

• The visible content. Every published page is public. The words and images can be copied from the live site or from an archive of it.
• Your own assets. Logos, photographs and documents you supplied are yours and you already have them somewhere.
• The structure. A crawl of the live site gives you every address, which is the redirect map for a rebuild.

What cannot be recovered without access is the database, form submissions, customer accounts, and anything that was never public. If those matter, that changes the calculation.

At some point rebuilding becomes cheaper than fighting. For a small site with no database, it frequently is — and if you hold the domain, a rebuild is invisible to customers.

The thing to fix afterwards: regain access before you lose it again

Whatever caused this, the fix is the same and it is structural. It means accounts on business-controlled logins, recovery addresses on the business’s own domain, and suppliers added as users rather than as owners.

Two additions worth making at the same time. Enable two-factor authentication on the domain registrar account specifically, because it is the account with the most consequence. And write down which four accounts exist, where, and under whose name — a single page in a drawer, updated when a supplier changes.

What to do next if you have lost access and cannot log back in

Find out today whether you can log into your domain registrar. Not the website, not the hosting — the registrar. It is the account that decides how bad every future version of this problem is. If you cannot, that is this week’s task rather than next year’s. The services section sets out where account ownership sits among the things a build is supposed to hand over.