If your WooCommerce developer has gone quiet and ghosted you, whether mid-project or in the middle of a live-site problem, what happens next matters more than figuring out why. Secure your access, back up what you have, and get a clear picture of where things actually stand, in that order. None of it requires you to know why they disappeared, and most of it doesn’t require much technical skill either.
Step 1: Secure your access before anything else
If your developer has admin access to your WordPress site, your hosting account, or your domain registrar, your first move is to audit and secure all of those access points. Not because every non-responsive developer is acting in bad faith; most simply disappear for ordinary reasons. But an account you don’t fully control is a vulnerability either way, and it’s worth resolving regardless of what’s actually happening with the project.
- WordPress admin. Log in at yourdomain.com/wp-admin and go to Users. If your developer has an Administrator-level account, change your own password immediately, then deactivate or delete their account if you want to revoke access. You can always add them back later.
- Hosting control panel. Log into your hosting account and change the password. Check whether the developer’s email is listed as an account contact or has its own separate login, and remove or change those.
- Domain registrar. Log into wherever your domain is registered and verify you have full access. Make sure the account email is yours, not the developer’s. Losing control of your domain is the most serious scenario on this list.
- FTP and SFTP credentials. These are the logins used to move files to and from your server. Change them in your hosting control panel; any file access the developer had is now invalid.
- Payment gateway dashboards. Change passwords for Stripe, PayPal, or any other payment accounts the developer had access to.
If you discover you don’t actually have access to any of these accounts, because the developer set everything up and never handed over credentials, that’s a more serious situation covered in Step 4 below.
Step 2: Take a complete backup right now
Before anything else technical, take a full backup of the site as it currently exists. This gives you a restore point in case anything goes wrong in the next steps. If you have a backup plugin like UpdraftPlus or Jetpack, run a manual backup now and download it to your computer. If your host provides server-level backups, download the most recent one.
Step 3: Assess the state of the project
- What’s currently live and working? Document what functions properly: product catalog, checkout, payments, order notifications. This is your baseline for what needs to keep working through any transition.
- What was in progress? If the developer was mid-build or mid-change, figure out what’s incomplete or potentially broken. Look for staging environments they may have used, any partially built features, or changes that were being made directly to the live site.
- What files actually exist on the server? If you have FTP or SFTP access, connect and look in the wp-content/plugins and wp-content/themes folders. Any custom plugin or child theme the developer built should be there. It’s your code, even if you can’t read it yourself.
- Is there documentation anywhere? Check any project management tools (Basecamp, Asana, Trello) plus email threads for specifications, notes, or documentation the developer left behind.
Step 4: What to do if you’re locked out
The worst version of this: the developer set up the hosting account in their own name, the domain is registered under their email, and you have no login credentials for anything. This happens, especially when a business gave a developer full autonomy over the initial setup.
For domain access: contact your domain registrar directly. Most have a process for proving ownership through business documentation like incorporation paperwork or trademark registration. If the registrar itself can’t resolve it and the dispute becomes about which registrar should actually be handling the domain, ICANN’s Transfer Dispute Resolution Policy exists for exactly that, though it’s a slower, more formal route than working it out with your registrar first.
For hosting access: your hosting provider has an account recovery process. Contact their support with documentation proving you’re the business owner. Managed WordPress hosts like WP Engine and Kinsta are generally cooperative with legitimate business owners in this position.
For WordPress admin access: if you can reach the server through your host’s file manager or FTP, an admin password can be reset directly by editing the database. That takes some technical comfort, or help from a developer who can walk you through the specific steps.
Step 5: Find a developer to assess and continue
Once you have secure access and a backup, you can bring in another developer without any time pressure. Give them full access to the codebase and ask for a brief technical assessment before any work begins: what’s there, what was being built, what’s complete, and what the path forward looks like.
That assessment is worth paying for on its own. It gives you a clear picture of what you actually inherited and what it’ll take to finish or fix it, without committing to a full engagement before you know what you’re dealing with.
For future projects, this situation is largely preventable, and it’s worth building that prevention into how you scope the next developer relationship from the start.
| WORKING WITH BRIOFORGE Trying to work out who to trust with this? The hardest part of hiring a developer is that you’re being asked to evaluate work you can’t yet assess. Most bad outcomes aren’t fraud. They’re a scope nobody wrote down, a handoff that never happened, or a build only one person can maintain. What we do differently is tell you what we actually think before you’ve paid us anything, including when the honest answer is that you need less than you were planning to buy. If you’re scoping a project, comparing quotes, or picking up something another developer left behind, get in touch and we’re happy to talk it through. |
Frequently Asked Questions
Can I legally keep a developer’s code if they abandoned the project?
This depends on the contract you had in place and applicable law. If you paid for the work, you likely have a claim to the deliverable, but the legal specifics vary. Secure the code now since it’s already on your server, document what was agreed and paid, and consult legal counsel if there’s ever a dispute about ownership.
Should I try to contact the developer before taking action?
Make one or two documented attempts by email and phone, then proceed regardless. You can’t leave your business access unsecured while waiting on a response that may never come. Document the attempts in case there’s ever a dispute later.
What if the developer is holding the site hostage and demanding payment before handing over access?
Document everything. If you have a contract, have a lawyer review your leverage. If the domain and hosting were set up using your own payment methods, you can work directly with those providers instead. If payment is genuinely in dispute, the fastest resolution is often either paying the disputed amount to get access back and sorting it out afterward, or pursuing legal remedies if the amount justifies it.
How do I prevent this from happening again?
Register domains and hosting accounts in your own name with your own payment method, always. Get login credentials for every account at the start of any engagement, not after. Use a written contract that specifies code ownership and what a handoff looks like. And never let a single developer be the only person with admin access to a production site.
