Can’t reach the agency that built your site? 7 steps to take your WordPress site back

You send emails and get no reply. The phone goes unanswered. Then the site starts looking wrong, or the domain renewal notices stop arriving. For small business websites in Japan, this is a common story.

The reasons vary. The person in charge left, the agency closed down, or they’re simply too busy. Whatever the reason, the job is the same: find out who holds what, and bring each piece back into your company’s name and control.

In most cases, you don’t need to rebuild the site. If you go step by step, you can usually get almost everything back yourself.

Step 1: Split the site’s “ownership” into four parts and write them down

A “website” is really made up of these four things. Each has its own owner and its own place to check.

Item	What it is	Where to check
Domain	The address, such as example.co.jp	WHOIS, the domain registrar
Hosting	Where the site’s data lives	The contract with the hosting company
WordPress admin	The account used to log in to the admin	The WordPress user list
Paid themes and plugins	Licences for the design and features	The vendor’s account

Start by gathering the documents you have in-house: the original contract and quote, invoices, emails with the agency, and your company’s bank and credit card statements. If payments to a hosting company or domain registrar came from your company, those contracts are likely in your company’s name.

Step 2: Check who the domain is registered to, and when it expires

Check the domain first. If it expires, both the site and your email stop working. And an expired domain can be registered by someone else.

Look it up with WHOIS

Anyone can view a domain’s registration details through a system called WHOIS.

• For .jp, .co.jp and similar, use JPRS WHOIS (whois.jprs.jp)
• For .com, .net and similar, use ICANN Lookup (lookup.icann.org)

There are three things to look at:

1. Registrant: the legal owner. Is it your company, or the agency?
2. Expiry date: how many months are left?
3. Name servers: if they include something like xserver.jp or sakura.ne.jp, that’s a hint about which hosting company is used.

Registrant details for .com and similar domains are often hidden. Even then, the registrar’s name is shown, so you’ll know who to contact.

If the domain is in your company’s name

The most common case is “registered to our company, but managed from the agency’s account”. As the registrant, ask the registrar to move the domain to your own account. They will usually ask for identity documents.

Note that a .co.jp domain can only be registered by a company incorporated in Japan, one per company. The registrant is, as a rule, your company itself, so these are among the easier ones to recover.

If the domain is in the agency’s name

In that case, the domain legally belongs to the agency. Changing the registrant generally needs the agency’s cooperation. Ask in writing, following Step 6. If the expiry date is close, also explain the situation to the registrar and find out what options you have.

Step 3: Check who holds the hosting contract

Once the name servers or your payment records point you to a hosting company, check who the contract holder is.

If the contract is in your company’s name

If you can log in to the hosting company’s member page, things get much easier. Even if you don’t know the login details, the hosting company will usually reset the password if you contact them as the contract holder.

Once you’re in, take a backup straight away. Most hosts let you download one from the control panel.

If the contract is in the agency’s name

In that case, you can’t get into the server yourself. The thing to watch out for is that if the agency stops paying, the site can disappear one day without warning.

While asking the agency to help with the move, it’s worth preparing the following in parallel:

• Sign up for new hosting in your company’s name
• Gather the materials your company supplied, such as the site’s text and photos

If you can get the data, you can move the site over as it is. If you can’t, rebuild it from the materials you gathered, and point the domain to the new server.

Step 4: Get back into the WordPress admin

Once you’re into the server, you can almost certainly get into WordPress.

1. Try “Lost your password?” on the login screen. But if the admin email address belongs to the agency, the reset email will go to them.
2. Reset it from the hosting control panel. Some hosting companies let you change WordPress users and passwords from their control panel. Even if yours doesn’t, the password can be reset in the database. A mistake there can take the site offline, so if you’re not confident, get a professional to do this part.

Once you’re in, work through these in order:

• Create a new admin account with your company’s email address
• Change the Administration Email Address under Settings → General (設定 → 一般) to your company’s address
• Don’t delete the agency’s account right away; lower its role first. When you do delete it, assign its posts to your company’s account

Step 5: Check the licences for paid themes and page builders

This is the one people tend to miss. Paid themes, and paid plugins such as Elementor Pro, are often bought and registered under the agency’s account.

The site won’t stop working the moment a licence lapses. But it will stop getting updates, and a plugin that isn’t updated becomes a security weak spot.

Go through Plugins and Appearance → Themes in the admin and mark the paid ones. For each, decide whether to buy your own licence or replace it with something else.

Step 6: Sort out the contract and legal side in writing

This isn’t legal advice, just an overview of the general principles. If you’re unsure, talk to a lawyer or your local chamber of commerce (商工会議所) advice service.

Keep a record of contact, and set a deadline

Note the dates and content of your calls and emails. If you still get no reply, send a letter stating what you need and by when: specifically, the domain registrant change, the server data, and the login details. If you want a formal record, you can use content-certified mail (内容証明郵便).

Check whether the company still exists

You can check whether the agency has been dissolved or gone bankrupt using the Legal Affairs Bureau’s (法務局) commercial registry, which is also available online through the registration information service (登記情報提供サービス). If it has gone bankrupt, the bankruptcy trustee becomes your point of contact.

Copyright depends on what the contract says

Text and photos your company supplied belong to you. On the other hand, the design and any custom code the agency created, as a rule, remain the agency’s copyright unless the contract says they were transferred. Check the contract clauses on copyright ownership (著作権の帰属) and rights to the deliverables.

If a maintenance contract is still running, cancel it in writing

If you’re still paying a monthly maintenance fee, give notice of cancellation in writing, following the cancellation clause in the contract.

Step 7: What to do first once you have access back

The day you get access back, take care of these:

• Change every password for the hosting, domain and WordPress
• Check for admin users you don’t recognise, and tidy them up
• Take a backup, and store a copy off the server (on a company PC or in cloud storage)
• Check the versions of WordPress core, plugins and PHP

A site that hasn’t been updated in years is very likely carrying old plugins. In IPA’s 2024 survey of information security at small and medium-sized businesses in Japan (2024年度 中小企業における情報セキュリティ対策の実態調査), 48.0% of unauthorised access cases were caused by “vulnerabilities such as unapplied patches”. We cover specific measures in 15 WordPress security measures.

An ownership checklist so this never happens again

The next time you hire someone to build or maintain your site, fill in this table before you sign. You can also use it to check where you stand now.

What to check	Where it should be
Domain registrant	Your company’s name
Domain management account	Registered with your company’s email address
Domain expiry and auto-renew	Known to your company, auto-renew on
Hosting contract holder	Your company’s name, paid by your company
Hosting control panel login	Kept by your company
WordPress admin account	At least one for your company’s own use
WordPress admin email address	Your company’s address
Paid theme and plugin licences	Bought under your company’s account
Email (MX) settings	Known to your company
Copyright ownership	Stated in the contract
What’s handed over on cancellation	Stated in the contract
Where login details are kept	A place your company has decided on, such as a password manager

Giving a provider a working account is fine. What matters is that your company is the owner, and the provider is only “borrowing the keys”. That way, you’re free to switch providers or update the site yourself. More in our website ownership checklist.

If you’re stuck

At wpexperts.jp, we take over maintenance only after putting the domain, hosting and admin all back in your name. We don’t assume the site needs rebuilding.

• If you’d like to know the current state of your site first, enter its URL in our free security check. It shows exposed version numbers and common configuration problems.
• It’s fine if you’re still at the “we don’t know whose name anything is in” stage. Tell us what’s going on through the contact form or LINE.