In this guide · 8 sections
Short answer
Start with the domain: look it up in WHOIS to see who the registrant is, then ask the agency in writing for the transfer code or a change of registrant. If the domain is in your company's name, the registrar can help you directly. Then recover hosting, website, Google and Meta accounts.
First, list what you need back
Write down every asset, who you think controls it, and whether you can log in today.
| Asset | Why it matters | How urgent |
|---|---|---|
| Domain name | Controls your website address and email; if it expires, both stop | Highest |
| DNS settings | Point the domain to your website and email provider | High |
| Hosting account | Where the website files and database live | High |
| Website admin (WordPress, Shopify, Wix) | Lets you update content and add users | High |
| Business email (Google Workspace or Microsoft 365) | Customer emails and account recovery for everything else | High |
| Google Analytics, Search Console, Business Profile | Traffic history and how you appear on Google | Medium |
| Facebook Page, Instagram, ad accounts | Customers, reviews and ad history | Medium |
| Design files, plugins and licences | Needed to keep the site running or rebuild it | Lower |
Check the domain's expiry date first. If it is close, prioritise getting it renewed, even if the agency renews it on your behalf for now.
Step 1: Recover the domain
Look up your domain in a WHOIS search. For .sg domains, use the search on SGNIC. It shows the registrar and the domain's status, while contact details are partly masked.
- Registered to your business, held at the agency's registrar account: ask the agency or the registrar for the transfer password (also called an auth code or EPP code), then start a transfer to a registrar account you control.
- Registered to the agency or the designer personally: ask for a change of registrant to your business first. For .sg, SGNIC says to consult the registrar on its procedure for transfers to another registrant.
- Agency not responding: contact the registrar's support directly with proof that you are the business using the domain, such as your ACRA business profile, invoices showing you paid for the domain and website, and emails.
For .sg domains, SGNIC's domain registration FAQ says the registrant gets a domain transfer password from the current registrar and gives it to the new registrar. The current registrar may require outstanding payments first, and if it neither approves nor rejects, SGNIC approves the transfer after 7 days.
For .com and other generic domains, ICANN's Transfer Policy says the registered name holder and administrative contact are the only parties who can approve or deny a transfer, and in a dispute the registered name holder's authority wins. Registrars may deny a transfer only for listed reasons, such as fraud, non-payment, or a transfer within 60 days of registration or of a previous transfer.
Step 2: Hosting, website admin and email
Ask for an administrator account, not a shared login
For WordPress, Shopify or Wix, ask the agency to add your own email as an administrator or owner. On Shopify, ask them to transfer store ownership to you.
Get a full backup
Ask for a complete backup of the website files and database, or an export from the platform, so you can move even if they stall later.
Move or take over the hosting
If the site sits on the agency's shared server, plan to move it to hosting in your name. Our guide to moving a website without losing SEO covers the steps.
Secure your email admin
Make sure a person in your business is a super admin of Google Workspace or a global admin of Microsoft 365, and remove the agency's admin rights once handover is complete.
Change every password and turn on MFA
Once you are in, remove old users, rotate passwords and API keys, and enable multi-factor authentication.
Our MFA set-up guide shows how to protect each admin account, and a password manager gives you one shared, controlled place for business logins.
Step 3: Google and Meta accounts
- Google Analytics: per Google's help page, you need the Administrator role to add users or change permissions. Ask the agency to add your Google account as an Administrator at account level, then remove them yourself.
- Google Search Console: ask to be added as an owner, or verify ownership yourself through your DNS once you control the domain.
- Google Business Profile: ask to be made primary owner. If no one responds, Google lets you request access to a profile from within Business Profile.
- Facebook Page and Instagram: ask the agency to give your own business portfolio full control in Meta Business Suite, then remove their access. Pages created inside the agency's business portfolio need to be moved, not just shared.
If you control the domain and email, you can recover most other accounts even when the agency refuses, because their password reset and verification steps go to you.
What to ask for in writing
Keep it polite and factual, and set a deadline. A written request also helps if you later need the registrar or a lawyer involved.
Handover request checklist
If the agency claims they own the website because of unpaid invoices or contract terms, read your contract. Ownership of design and code depends on what you agreed, but the domain registrant and your Google and Meta business accounts are usually straightforward. For a real dispute, get legal advice; this guide is not legal advice.
Prevent it on the next project
Every new website project should start with the business owning the accounts, and the agency invited in as a user.
Ownership checklist for new projects
Choosing between .sg and .com.sg? Our .sg vs .com.sg guide explains the rules for each.
Do it yourself or get help?
If the agency cooperates, an owner can collect everything in a few hours with the checklist above. It takes longer when the domain is in someone else's name, the agency has disappeared, or the site must move to new hosting without downtime.
Domain & DNS Setup (S$99) moves your domain to a registrar account in your name and sets up DNS records correctly. Website Migration (S$490) moves the website to hosting you own, with redirects and checks so search traffic and email keep working. You keep all the logins.
Frequently asked questions
The registrant listed in the registry is the legal holder of the domain. If the designer registered it in their own name, you need a change of registrant to your company. If it is in your company's name but in the designer's registrar account, ask for the transfer code or contact the registrar with proof of ownership.
Get the domain transfer password from the current registrar, then give it to a new registrar you control, which submits the transfer request to SGNIC. The current registrar may ask for outstanding payments and can approve or reject; if it does neither, SGNIC approves after 7 days.
Under ICANN's Transfer Policy for generic domains such as .com, a registrar may deny a transfer only for specific reasons, including evidence of fraud, a dispute over the registrant's identity, unpaid fees, an objection from the registrant, or a transfer within 60 days of registration or a previous transfer.
Ask the agency to add your Google account as an Administrator at the account level. Google says only users with the Administrator role can add users or change permissions. Once you are an Administrator, remove the agency's access yourself.
Contact your domain registrar and hosting company directly with proof that you are the business using the site, such as your ACRA profile and invoices. Keep the domain renewed. Once you control the domain and email, you can usually recover Google and other accounts through their own recovery steps.