Recover your website's domain and hosting: step by step

The agency that built your site shut down. The freelancer moved away and stopped answering. The partner who handled everything left the company. Now the site is down, email has stopped, or you just want to switch vendors and find out you don't have a single password.

The good news: in most cases, you can get it back. The bad news: the longer you wait, the fewer options you have, especially if the domain expired. This guide shows the right order, what's up to you, and what's up to the old company.

First, understand the three pieces of your site

A business website isn't one thing. It's three pieces, and each can be in a different person's name:

• Domain: the address (yourcompany.com.br). In Brazil, .br domains are registered with Registro.br.
• Hosting: the server where the site's files are stored and served to visitors.
• Code and content: the site files, database, images, and copy. If the site was built on WordPress, for example, this includes the admin dashboard.

The domain is the most urgent: without it, not even a new site can go live at the address your customers know.

Step 1: find out whose name the domain is in

Run a public lookup of your domain on the Registro.br website. It shows the registrant, meaning the CPF or CNPJ that owns the registration, and the expiration date.

This decides everything. The CGI.br resolution that governs domain registration uses the CNPJ or CPF to identify the registrant and states, in article 5, that the registrant is responsible for the domain, the registered data, and paying the fees. In other words: the owner is whoever is on file, not whoever paid the agency.

Three scenarios come up often:

1. The domain is under your company's CNPJ. Best case. You recover the account directly with Registro.br, no one else needed.
2. It's under a partner's or former employee's CPF. Still recoverable, but it depends on that person cooperating with the ownership transfer.
3. It's under the agency's or freelancer's CNPJ. Technically, the domain is theirs. You'll need a formal transfer request.

Step 2: recover your Registro.br account

If you're the registrant, the path is to regain access to the account. The most common problem here is email: many agencies list their own email as the domain contact. So "forgot my password" sends the link to the inbox of whoever disappeared.

In that case, contact Registro.br support. Since the registrant is identified by CPF or CNPJ, anyone who can prove they're the registrant can request a contact update. Have these ready:

• CNPJ card or an ID with the registrant's CPF.
• Current articles of incorporation, if it's a company.
• ID of the person who signs for the company.

Once you're back in, immediately change the contact email to a company address that doesn't depend on any outsider, and turn on two-factor authentication.

If the domain is in another person's or company's name, you need an ownership transfer. It's done at Registro.br with the consent and documents of the current registrant. Without that cooperation, the path becomes negotiation and, as a last resort, legal action.

Domain expired? Race the calendar

A common case: the renewal invoice went to the agency's email, and the agency no longer exists.

For .br domains, the deadline summary published by Homehost in September 2026, a Registro.br accredited provider, describes three phases:

• Up to 14 days after expiration: the domain is expired but still works. Just pay the renewal.
• From day 15 to about day 104: the domain is frozen. The site, email, and any system using the address stop. You can still renew, and payment unfreezes the domain within a few hours.
• After 104 days: the domain is removed and has no registrant. It can no longer be renewed. It enters the release process, open to anyone.

In the release process, if two or more people request the same name, it may go to auction, according to Homehost. In other words: a competitor, a domain reseller, or anyone else can take the address you've used for years. The same article counts nearly 120,000 .br domains removed in the 30 days to September 2026, most for nonrenewal.

If your domain is frozen, stop reading and renew it now. The rest can wait.

Step 3: recover the hosting and a copy of the site

With the domain secured, the focus shifts to hosting. Here too, the question is: whose name is the server account in?

If the account is yours and you just lost the password, recovery goes through the hosting provider, the same way: prove you own the account. If the hosting belongs to the agency (very common with "site + hosting" plans), you need to request, in writing:

• A full copy of the site files.
• A database export.
• Admin access to the site dashboard, if there is one.
• A list of services tied to the domain: email, forms, analytics tools, ad pixels.

Send the request by email, with a deadline, citing the contract. If the contract says the site is yours, that carries weight. We've written about what to do when the freelancer vanishes with the project, and the logic is the same: put everything in writing before any hard conversation.

Even with zero cooperation, you can still get the site live. With the domain in your name, you point it to new hosting and publish a new or rebuilt site. You lose what only existed on their server, but you don't lose the address.

Change every password, even ones you think no one has

Regaining access isn't enough. A password that passed through many hands is a risk. According to additional research to Verizon's 2025 DBIR, stolen or abused credentials were the entry point for 22% of the data breaches analyzed.

Once you've recovered everything:

• Change the passwords for Registro.br, hosting, the site dashboard, the database, and email.
• Remove admin users you don't recognize.
• Turn on two-factor authentication wherever you can.
• Keep passwords in a company password manager, not in one person's head.

If, once you're in, you find strange pages, redirects, or files no one created, treat it as a breach. We have a guide on what to do with a hacked site in the first hours.

How to keep this from happening again

Almost every "hijacked" site case comes from a contract that didn't say who owned what. Next time you hire, require in writing:

• Domain registered under your company's CNPJ, with your company's contact email.
• Hosting on an account in your company's name, or a clause guaranteeing a full copy and all logins are handed over when the contract ends.
• Code, files, and logins delivered to you, not kept by the vendor.
• Someone on your team with admin access to everything, even if they never use it.

What this means for you

Before asking for a quote on a new site, map the three pieces: whose name the domain is in, where the hosting is, and where the code and content are. That map decides whether the job is to recover, migrate, or start from scratch.

At the Studio, on every project we deliver, the code, files, and logins are in the client's name. The price is fixed after discovery and the deadline is written into the contract. If your site is down, locked out, or stuck with a vendor who won't respond, talk to our project rescue service. And if starting from scratch makes more sense, we'll launch a new website at the address that's already yours.