My web designer won't give me access to my website

First, work out what you actually control right now

People say "my website" and mean four separate things, each with its own account and its own owner. The domain name, registered through a registrar. The DNS, which points that domain at a server and at your email. The hosting, where the files sit. And the site itself, usually a WordPress or similar login. You can be completely locked out of one and hold all the keys to another, so do not assume the worst until you have checked each one.

Open a notebook and give each of those four a line. For each, write down where it lives, whose email address is on the account, and whether you have ever logged in. Then go hunting in your inbox. Search for the domain name itself, for "renewal", for "invoice", and for the names of the big UK hosts and registrars. Renewal receipts are the fastest way to find out whose account your domain has been sitting in for the last five years. Your bank or card statements are the second fastest, because whoever is charging you is usually whoever holds the account.

While you are still calm and before you have complained to anybody, try a password reset on every account where you think the registered email might be yours. If a reset email lands in your inbox, you have that account, and you should sign in, change the password and add a second factor straight away. Do this quietly and do it first. Once a dispute is out in the open, contact email addresses have a way of changing.

Check who really owns your domain

For a .co.uk, .org.uk or .uk domain, the register is run by Nominet. You can look up any .uk domain yourself using Nominet's public lookup or their RDAP tool at rdap.nominet.uk. What you will see is the registration date, the current status, the name servers, and the registrant's agent, which is the registrar currently holding the domain. The registrant's actual name and address only appear if the registrant has opted in to display them, so a blank there is normal and does not mean anything sinister. Even so, the agent tells you which company you are dealing with.

The real test for a .uk domain is Nominet Online Services at secure.nominet.org.uk. It works off the registrant email address held on the domain record. Go to the login page, use the option for a first login or forgotten password, and try each email address you use. If a password arrives and you get into an account showing your domain, you are the registrant of record and you are in a strong position. If nothing arrives on any of your addresses, your email is not on the record, and you need to find out whose is.

For a .com, .net or .org, there is no Nominet. Look the domain up through any WHOIS service or ICANN's lookup, though be aware that privacy services hide the owner's details as standard, so you will often only see the registrar's name. In that case the registrar is who you contact, and they will only speak to whoever holds the account. Either way, the question you are answering is the same one: is my business the owner, or is my web designer?

Moving a .co.uk when they will not help

This is where most online advice goes wrong, so be careful who you listen to. A .co.uk or .uk domain does not use an auth code or an EPP code. That is the process for .com and other international domains. UK domains use an IPS tag, a short code that identifies the registrar currently holding the domain. To move the domain, the tag is changed to the new registrar's tag, and then you claim it at the new end. Normally the current registrar makes that change, and Nominet's rules mean it should not cost you anything to move.

If the current registrar will not act, and you are the registrant with a working Nominet Online Services account, you can change the tag yourself directly with Nominet. There is a small charge for going that route, around £10 plus VAT when this was written, and it is charged per transaction rather than per domain, so several domains moved together cost the same as one. Check the current figure with Nominet before you budget for it. Once the tag has moved, set up the domain at your new registrar and repoint the DNS at whatever hosting you choose. Take a note of every existing DNS record first, especially the mail records, because a careless DNS move will take your email down with it.

One important limit. Changing the tag moves who manages the domain. It does not change who is named as the registrant. If the record says your designer's company, you need a registrant transfer, which under Nominet's process has to be started by the current registrant and paid for, with the incoming party accepting within a few days. If they refuse to start it, you have a legal argument on your hands rather than a technical one. Nominet's Dispute Resolution Service is not a general complaints route for a fallout with a supplier, because it deals with abusive registration under its own policy, usually where somebody has taken a name that trades on your rights. It can sometimes fit, but do not assume it will. That is a question for a solicitor who knows domain work.

For a .com, ask the registrar to unlock the domain and issue the transfer authorisation code, then enter that code at your new registrar and approve the confirmation email. Transfers can be blocked for a period after a recent registration, a recent transfer, or a change of registrant details, and those rules have shifted in the last couple of years, so ask the registrar directly whether a lock applies to your domain and when it lifts.

What you are entitled to, and what you may not be

I am not a solicitor and this is not legal advice. If there is real money at stake, or the business genuinely cannot trade without this being resolved, an hour with a commercial solicitor is money well spent and will cost less than a fortnight of guessing. What follows is only the shape of the thing, so you know which arguments are worth having.

The part that shocks people most is copyright. Under UK law the person who creates a work is normally the first owner of the copyright in it, even where somebody else commissioned and paid for it, unless it has been assigned in writing. The government's own guidance on ownership of copyright works says exactly that. So paying an invoice does not automatically buy you the design files or the custom code. Without a written assignment you may have only an implied licence to use the work for the purpose it was made for, which may not cover handing it to somebody else to modify. That is uncomfortable, and it is also very common, because most small website jobs are done on an email and a handshake.

Other things sit on much firmer ground. A domain registered in your business name is yours. Your own content, your own photographs, your logo if you had it created under a proper agreement, and your accounts with third parties such as your Google Business Profile, your analytics and your mailboxes are yours. So is your customer and enquiry data. Where a supplier holds personal data on your behalf, you are usually the data controller and they are the processor, and the ICO's guidance on processor contracts says the arrangement should require them to delete or return that data at your choice when the work ends. If you never had a written contract, that argument is weaker, but asking for it plainly and in writing tends to focus a quiet developer's mind. Whether any particular refusal is lawful depends entirely on what was agreed between you, which is why it is a question for a solicitor and not for a forum thread.

How to ask, in writing, so it actually lands

Stop using WhatsApp voice notes. Write one email, keep it short, keep every trace of emotion out of it, and number what you want. Something like: transfer the domain by changing the IPS tag to XXXX, or confirm the registrant email so I can access it; provide an administrator login for the website; provide the hosting login or a complete backup of the site files and database; provide a copy of all customer and enquiry data held on my behalf; provide a list of current DNS records. Give a clear deadline, seven to fourteen days is reasonable for most of that, say where to send it, and say what you will do next if you hear nothing. Do not threaten anything you are not willing to follow through on.

Send it to every address you have for them, and if they trade as a limited company, send a printed copy to the registered office as well. You can find that free on Companies House in about a minute. It costs you a stamp and it removes the "I never received it" answer. If you have to speak on the phone, follow the call with an email that says what you both agreed. From here on, everything that matters happens in writing.

If they simply do not reply, the next step in England and Wales is a letter before action, sometimes called a letter before claim, which is expected under the Practice Direction on Pre Action Conduct before you start a court claim. It sets out the facts, what you want, a reasonable deadline and the fact that you will consider proceedings. Money claims can be started online through Money Claim Online. Be realistic about what a court is good at, though. Courts are comfortable ordering somebody to repay money. Getting an order that makes a person press a button on an account they control is a slower and more expensive business. Take advice before you spend a penny on it, and weigh it against the next section.

When to stop fighting and just rebuild

Here is the honest arithmetic. If you have the domain, you have already won the only fight that really matters. Everything else is replaceable. The site you are fighting over is probably two or three years old, you were most likely going to replace it before long anyway, and a rebuild will very often cost less than the time and stress of the argument, especially once you count the hours you are not spending on your actual business. I have watched owners burn three months of attention chasing a login for a site they did not much like.

Before you walk away, harvest what you can while the old site is still up, because it may not be tomorrow. Copy the text off every page into a document. Save the images you own. Write down every page address, because those are what Google has indexed. If the site is already offline, the Wayback Machine at archive.org will often have most of it. Export whatever the CMS will let you export. Check whether your email is running on the same hosting, because losing email is far worse than losing a website, and that is the emergency to plan for first.

Rebuilding does not have to cost you your search rankings. Keep the same domain, keep the same page addresses where you sensibly can, and put 301 redirects from the old addresses to the closest new ones. Rankings sit with the domain and the content much more than with the code, so the real risk is going live with a thinner site than the one you replaced, not the rebuild itself. Then set it up so this never happens twice: register the domain yourself, in your business name, on an email address only you control, hold the top level account for hosting and add your designer as a user rather than the other way round, and get one written line about who owns what before work starts.

For what it is worth, that is how I work. Domain and hosting go in the client's name with the client holding the master login, and every password is handed over at the end whether we carry on working together or not. If you are in this mess right now and want a second opinion on what you are actually looking at, send me the domain name and I will tell you straight what I can see from the outside, whether or not you ever become a client.