What should you do when your web developer disappears? First, confirm you control the four things that matter: your domain, your hosting account, an administrator login to the website and a recent backup. Then take a full backup, check for signs of hacking, update or replace outdated software in a safe order, and put someone in charge of maintenance. Most rescues are calm, methodical admin work. The danger is in waiting until something breaks.

Why abandoned websites get into trouble

A website is not a brochure that sits still once printed. It runs on layers of software: the hosting server, the PHP language, WordPress itself, a theme and a set of plugins. Each layer gets security fixes over time. When nobody applies them, the gaps add up.

The numbers are hard to ignore. Patchstack's State of WordPress Security in 2026 report (updated February 2026) found 11,334 new vulnerabilities in the WordPress ecosystem in 2025, a 42% rise on 2024. Some 91% were in plugins and 9% in themes, while WordPress core had only six, all low priority. In 46% of cases, no fix from the developer was available when the flaw was made public. For heavily exploited vulnerabilities, the weighted median time to first exploit was just five hours.

In plain terms: WordPress core is fairly well looked after. The risk lives in the plugins and themes your developer installed and nobody has touched since. And when a plugin's own author stops updating it, there may never be a fix. The only safe answer is to replace it.

The server layer matters too. According to PHP's official supported versions page, PHP 8.2 receives security fixes only until 31 December 2026. Older branches are already past end of life. Many forgotten sites still run on versions like these, and an old plugin may break the moment the host upgrades PHP.

Warning signs your site needs rescuing

• Nobody can log in to the WordPress dashboard, or the only admin account belongs to the old developer.
• The dashboard shows a long list of pending updates, or plugins marked as no longer maintained.
• You see pages you never created, often in other languages or selling pills, loans or betting.
• Visitors are redirected to other websites, especially on mobile or when arriving from Google.
• Google shows "This site may be hacked" under your listing, or your host has suspended the account.
• Your contact form stopped sending enquiries and nobody noticed.
• The SSL certificate has expired, or the domain renewal email went to an inbox nobody reads.

The rescue plan: seven steps in the right order

Order matters. Updating plugins before you have a backup, or cleaning malware before you control the hosting, can turn a fixable problem into a lost website.

1. Confirm the domain is yours. Look up who the registrant is and which registrar holds it. If the old developer registered it in their own account, ask them to move it into an account in your business's name using the registrar's official transfer or change-of-registrant process. Our account lockout checklist covers this in more detail.
2. Get your own hosting access. Find out who pays the hosting bill. If it is the developer, ask the host about its official account transfer process. If the host account is in your name, use the host's own password reset.
3. Create your own administrator account. Once you have hosting access, set up a named admin account for your business. Then remove or downgrade accounts for people who no longer work with you. Turn on two-factor authentication.
4. Take a full backup before touching anything. Back up both the files and the database, and store a copy away from the hosting server.
5. Check for compromise. Run a reputable security scan. Look for unknown admin users, unfamiliar files and spam pages. If it is hacked, clean it fully and close the hole that let the attacker in.
6. Update in a safe order, ideally on a staging copy. Update plugins and themes one at a time, test the key pages and forms after each, then update WordPress and, finally, the PHP version. Replace any plugin that is no longer maintained.
7. Put maintenance on a schedule. Monthly updates, automatic off-site backups, uptime monitoring and a short written record of who has access to what. Our guide to website maintenance plans explains what a good plan includes.

If Google says "This site may be hacked"

Google shows this message when it believes a hacker may have changed your pages or added spam pages. Its help page for site owners sets out the official route:

• Verify your website in Google Search Console.
• Open the Security Issues report to see sample URLs Google flagged.
• Clean the site and fix the vulnerability that let the attacker in. Google warns the site is likely to be reinfected if you don't.
• Request a review in the Security Issues section only once the entire site is clean and secure. Google removes the warning after it confirms the fix.

Google does not publish a set timeframe for these reviews, so don't trust anyone who promises the warning will vanish by a certain date. And nobody outside Google can remove it for you.

Website rescue self-check

Where Xuru can help

Xuru Technologies is a web design, development and digital marketing partner. We cannot override a registrar, a host or Google, and we always work through their official processes. We will never ask you to send us your passwords; we help you set up access properly instead.

• Website Rescue — US$299 / ₹9,999. We help you regain control, take a full backup, update or replace outdated software and fix what's broken.
• Hacked-site Cleanup — US$399 / ₹14,999. Malware and spam page removal, closing the entry point and guiding you through Google's review request.
• Care Plan — US$49 / ₹1,999 per month. Ongoing updates, backups and monitoring so the site doesn't drift again.
• Rebuild — quoted after the rescue, only if the site is not worth keeping.

Frequently asked questions