What should a business do if it suddenly loses access to its website?

The business should secure the evidence, reconstruct the technical and contractual history, identify the current domain holder, and determine precisely which legal rights the company can enforce. Do not assume the domain has expired because a renewal invoice was not paid and someone has subsequently registered it. That is, only one hypothesis. The same symptoms could result from an unauthorized domain transfer, a change of registrar, a change of hosting provider, a compromised administrator account, a dispute between the company and its former web developer, or a situation in which the domain was never legally registered in the company’s name in the first place.

Why is losing control of a website more than an IT problem?

This is because the assets do not necessarily belong to the same person. A website normally consists of several separate assets and relationships. These may include the domain name, website content, photographs, trademarks and company names, source code, the CMS, databases, customer information, hosting arrangements, domain-registration accounts, and contracts with developers and hosting providers. The first question should not be “Who stole our website?” but who owns the domain, who controls it, who operates the website, who owns the underlying content, and how did control move from the original arrangement to the present situation. This distinction is essential before any legal claim is made.

What is the first step a business should take after losing access to its website?

The company should first preserve evidence. A website can be changed within minutes, texts deleted, photographs replaced, contact information altered, and an entire website taken offline. It is therefore important to preserve the website as it currently exists. This include screenshots of the current website, screenshots showing the old website if available, previous invoices, domain registration invoices, hosting invoices, contracts with the developer, correspondence with the developer, correspondence with the previous hosting provider, payment records, CMS login information and administrator records, previous WHOIS/domain records if available, server/IP information previously known, and dates the website went offline and came back, and date the developer discovered that his credentials no longer worked.

Why should a business avoid bypassing the new login credentials?

A website normally consists of several separate assets and relationships which may be owned and controlled by different parties. If the current server, CMS or hosting account is controlled by another person, attempting to circumvent passwords or security measures can create additional legal problems. The safer approach is to investigate through authorized channels and preserve publicly available technical information.

How can a business find out who currently controls its domain?

The first substantive question is “who is the registered domain holder?” The precise procedure depends on the TLD. For domains such as .com, .net and .org, check the domain’s current registration data through ICANN’s RDAP-based lookup system. RDAP is the principal registration-data system for gTLDs. ICANN’s Registration Data Request Service (RDRS) provides a standardized route for requesting non-public gTLD registration information where the requester has a legitimate interest. For country-code domains, the procedure depends on the particular country and its registry rules. For example .de domains, DENIC can disclose holder information to third parties with a legitimate interest in specified circumstances.

How can the business determine whether the domain actually expired?

The expiry of the domain is one hypothesis and should never be treated as fact until verified. Establish who originally registered the domain, in whose name was it registered, which registrar was used, who paid the registration fees, when was the last renewal, were renewal notices issued, to which email address, were invoices paid, was the domain suspended, was it deleted, and when did the present holder acquire it? The domain may genuinely have expired and subsequently been registered by another person. Each scenario produces a different legal analysis.

How can the company reconstruct the domain’s history?

The investigation should reconstruct a chronological history using several sources. The aim is to establish a timeline of events from domain registration to website development to hosting to renewal history to outage to restoration to DNS change to hosting change to loss of developer access to current website. This chronology may reveal the precise event that caused the loss of control.

Could the web developer be the actual domain holder?

Yes. A company may have engaged a developer to build and maintain its website without realizing that the developer registered the domain using his own name, email address, registrar account, or payment details. The company should therefore obtain the original website-development agreement and determine exactly what the developer was authorized to do.

What should the business ask its web developer?

The relevant questions include who was instructed to register the domain, in whose name, which registrar was used, who was supposed to control the account, who was responsible for renewal, who received renewal notices, who paid the fees, was the developer authorized to register the domain in its own name, was the domain supposed to be transferred to the client, when was access lost, was any transfer request received, did anyone request a change of DNS, did anyone request a change of hosting provider, were administrator credentials changed, were backups maintained, and does the developer still possess website files or databases? The answers should be documented.

Why is the current website content important?

If the current website still contains the business’s content, there may be intellectual-property issues independent of any domain dispute. The business should therefore compare the current website with archived copies of its former website. Internet archives, old company backups, marketing materials and previous versions of the website may help establish what content originally belonged to the business. 

Does the business automatically own the website copyright?

Not necessarily. The legal position depends on the applicable law and the contractual arrangements with the developers and other contributors. The business should determine whether the relevant rights were assigned or licensed to the business. 

Could a Trademark or business-name rights help recover a lost domain?

If the domain corresponds to a registered trademark or established business brand, the business will have stronger grounds for challenging the present registration and use. For .com and many other generic domains, the Uniform Domain Name Dispute Resolution Policy (UDRP) may provide an alternative to ordinary court proceedings where the dispute concerns abusive registration and use of a domain name. WIPO explains that the UDRP is available to trademark owners in qualifying cases involving gTLDs such as .com and .net.

Could the UDRP be used to recover the domain?

Yes. The Uniform Domain Name Dispute Resolution Policy (UDRP) provides an international administrative mechanism for certain disputes involving abusive registration and use of domain names. WIPO explains that the UDRP covers disputes between domain registrants and trademark owners concerning abusive registration and use of domains in gTLDs , as well as certain country-code domains that have adopted the policy. A UDRP proceeding can result in cancellation or transfer of the domain where the required elements are established. It is however, not a universal remedy for every lost-domain dispute. A genuine expiry, contractual dispute or dispute falling outside the UDRP’s scope may require another approach. For a .de domain, one particularly important mechanism is the DENIC Dispute entry, which prevents the disputed domain from being transferred to another third party while the dispute is being pursued.

Should the business immediately send a legal demand?

A demand should be sent after identifying the owner of the domain, how it was acquired, the rights the business possesses, whether the website content has been copied, whether customers are being misled, and whether remedy is actually available. The eventual demand may seek transfer of the domain, cessation of infringing use, removal of copied content, disclosure of relevant information, preservation of evidence, damages or reimbursement of legal costs.

What Is the Recommended Investigation Process of a website loss? – A Practical Checklist

1. Preserve the Evidence – Capture the current website and preserve all contracts, invoices, emails, backups and technical information.
2. Identify the Domain Infrastructure – Establish the registrar, registrant, DNS provider, hosting provider and current website operator.
3. Reconstruct the History – Determine when the domain was registered, renewed, transferred, suspended or moved.
4. Identify the Legal Rights – Assess trademarks, business names, copyright, contractual rights, confidential information and other relevant rights.
5. Secure the Domain – Depending on the domain extension, consider registry-level measures, registrar action or a domain dispute mechanism such as UDRP/DENIC Dispute entry.
6. Enforce or Negotiate – Once the facts are established, decide whether to negotiate, issue a formal demand, commence administrative proceedings, seek court relief or pursue another remedy.

Autor: Yeboah Osei-Kwabena

LLB, Wisconsin International University College, and Professional Law Course, Ghana School of Law. Member of the Ghana Bar Association, October, 2024. An Associate of Lartey Badombie & Co.