The agency has vanished: the access you need to recover

The order matters

Do not start with the WordPress admin, even though it is the most visible part. Start with the domain, because without it you lose everything at once: the site, the email and the address your customers know. Then the hosting, where the files and backups live. Only then the site and the rest. At each step, check two things: who owns it (whose name is on the account and the invoice) and who has the password. They are not the same. An account in your company’s name with the password held by the agency can be recovered. An account in the agency’s name with the password held by the agency needs their cooperation.

The list, in order

1. Domain registrar. The company the domain is registered with. Check your invoices for who pays and to whom. The registrant details are visible at the registrar or in the public domain database. If the registrant is your company: a password reset via the contact email, and if that email sits with the agency, the owner verification procedure with company documents. If the registrant is the agency: a written request to transfer the domain to you. Note the expiry date.
2. DNS. The settings that say where the site and the email live. Usually at the registrar or the host, sometimes with a separate provider. Without DNS access you cannot move the site or fix the email. Write down every record before you change anything.
3. Hosting. The server the site runs on. The customer panel (invoices, renewals) and the server panel (files, database, backups). If the agency pays for the hosting, ask for the service to be transferred to you. If they refuse, the site can be moved to new hosting from a copy, as long as you have one of the next two.
4. WordPress admin. The administrator account. If you have access to the mailbox it was set up with, a password reset is enough. If not, a password can be set from the database side through the hosting panel. Once in: the list of users, who has the administrator role, which accounts are not yours.
5. FTP, SSH and the database. Access to files and data, needed for backups, repairs and migration. Usually in the hosting panel, where new passwords can be created if only the agency had the old ones.
6. Email. Where company email runs: on the hosting, in Microsoft 365, in Google Workspace. It is the key to every password reset, so check who the administrator is and that it is someone in the company. Note separately the address the agency used to set up accounts (often their own).
7. Google Search Console and Analytics. Ownership of the property and the statistics. Add your own account as an owner before you lose touch with the agency. Otherwise the history of your statistics stays with them.
8. Payment gateway and shop. With WooCommerce: the payment provider’s panel (who receives the money, into which account), API keys in the shop settings, the courier account, the invoicing system. Check that the contract with the payment provider is in your company’s name.
9. App stores. If you have a mobile app: the developer account on Google Play or the App Store. If it is in the agency’s name, the app is formally not yours. A transfer is possible, but needs both sides to cooperate.
10. The rest. SSL certificate, licences for paid plugins and the theme, the newsletter tool, social media accounts, source files for graphics.

What to do once you have it back

• A backup of files and database, downloaded off the hosting, before you change anything else.
• New passwords everywhere, kept in the company’s password manager, not in a spreadsheet and not in email. Two-factor authentication wherever possible.
• The agency’s accounts: first note what they were tied to (plugins, integrations, payments), then disable them. Deleting without that note can stop a form or payments.
• An owner in the company for every access: the named person responsible for renewal who knows where the password is.
• One document listing: service, provider, whose name the account is in, who pays, when it expires, who has access. The date of the last update at the top.

The list in brief

Access	Why it comes first	Where to look
Domain	Without it the site and email disappear	Invoices, domain database, registrar
DNS	Without it you cannot move anything	Registrar or host
Hosting	Files, database, backups	Invoices, emails from the provider
Site admin	Content and users	Reset via email or database
Email	The key to every reset	Hosting, Microsoft 365, Google
Payments	Money and the contract	Provider panel, shop settings

If you would rather somebody went through this list with you and left a finished inventory, that is what a site takeover after an agency looks like.