What to Do When You Lose Access to a Business Account

Someone left the company. Or a contractor finished their work and moved on. Or a password was saved in a browser that died three years ago and nobody thought to write it down.

Now you need to get into an account and you cannot.

This happens more often than most business owners expect, and it is almost always more recoverable than it feels in the moment. Here is how to approach it depending on what you have lost access to.

Before You Do Anything Else

Write down exactly what you know:

Which account or service is inaccessible
What email address was used to register it
Whether that email address still exists and is accessible
Who last had access and whether they are reachable
What you were trying to do when you discovered the problem This takes five minutes and saves time later. Every recovery process will ask for some version of this information.

Domain Registrar

Your domain registrar is the most consequential account to lose access to. Without it you cannot renew your domain, update DNS records, transfer the domain, or verify ownership for other services.

If the email address on the account still exists and you can access it: Use the registrar's password reset. Most send a reset link to the account email within minutes. This is the easy path and it works more often than people assume.

If the email address exists but you cannot access it: This is the common situation when a former employee's email was used. You need to either recover access to that email account first, or contact the registrar directly.

Contact the registrar's support team and explain you are the business owner trying to recover control of a domain. They will ask for proof of identity and business ownership. Acceptable proof typically includes a business registration document, a government-issued ID matching the registrant name, or a credit card statement showing you paid for the domain. The process takes anywhere from a few days to a couple of weeks depending on the registrar.

If you do not know which registrar holds the domain: Run a WHOIS lookup at who.is. The registrar name appears in the results. If the domain has privacy protection enabled the registrant contact may be hidden, but the registrar name will still show.

If a contractor registered it under their own account: This is a harder situation. If the relationship ended on good terms, contact them and ask for a transfer. If it did not, contact the registrar with proof of business ownership. ICANN has a dispute resolution process for situations where domain ownership is genuinely contested, though it is slow and better avoided if possible.

Hosting Account

Losing access to your hosting account means you cannot update your website, manage files, or access backups.

Most hosting providers have account recovery through the registered email address. If that email is inaccessible, call their support line directly. Hosting companies deal with account recovery regularly and most have a process for it.

Have ready: the domain name hosted on the account, the last four digits of the card used for billing, any old invoices or order confirmation emails, and your business details.

If the hosting account was set up under a contractor or agency's master account, the recovery path is different. You may need to work with them to have your sites migrated to an account you control, or negotiate a transfer of the account itself. This is a good reason to ensure hosting accounts are always registered in the business name rather than a third party's account.

Google Workspace or Microsoft 365

If you have lost access to a specific user account within Google Workspace or Microsoft 365, the admin of the workspace can reset it. That is the straightforward path.

If you have lost access to the admin account itself, both platforms have recovery processes:

Google Workspace: The account recovery form asks you to verify domain ownership, usually by adding a DNS record or uploading an HTML file to your website. If you have access to either of those you can verify and recover. If you do not, Google support can assist with identity verification.

Microsoft 365: Similar process through the Microsoft account recovery portal. You will need to verify the domain and provide billing information associated with the subscription.

If the account was set up by a managed service provider and is under their tenant, you are in a more complex situation. You may not have direct ownership of the Microsoft or Google account in the way you would expect. This is worth understanding before it becomes a problem rather than after.

Website CMS (WordPress or Similar)

If you cannot log into your WordPress admin panel, there are several recovery options depending on what you have access to:

Email-based reset: If you have access to the email address associated with the admin account, use the standard password reset on the login page.

Hosting panel access: If you can access your hosting control panel, most hosts provide phpMyAdmin or a database tool. You can update the admin password directly in the database without needing email access. Your hosting provider's support team can walk you through this if you are not comfortable doing it yourself.

FTP or file manager access: It is possible to add a new admin user by adding a small PHP file to the site, running it once, and then deleting it. Again, hosting support can assist.

If none of these are available, it means you have lost access to hosting and CMS simultaneously. Work on recovering hosting access first.

Email Accounts

If you are locked out of an individual email account within your business email platform, the admin of that platform can reset your access.

If you have lost access to the platform admin account itself, follow the recovery steps above for Google Workspace or Microsoft 365.

If your email is hosted through your domain registrar or hosting provider rather than a dedicated email platform, account recovery goes through whichever of those you need to contact.

One important note: if you are trying to recover access to a former employee's email account, this is usually straightforward if you are the account admin. If you are not the account admin and the account belongs to someone who has left, you need to establish admin access first.

How to Make Sure This Does Not Happen Again

The accounts described above share a common vulnerability: they were set up once, access was assumed to be stable, and nobody documented who controlled what or how to recover it if something changed.

The fix is straightforward even if it is not exciting:

Use a business email address for all account registrations. Not a personal Gmail, not the email of whoever set it up. An address that the business controls and that will exist regardless of staff changes.

Store credentials in a shared password manager. 1Password, Bitwarden, or similar. Not a spreadsheet, not a browser, not an email thread.

Document who controls what. A simple list: account name, registrar or platform, login email, where credentials are stored, who is responsible for renewal. Updated when anything changes.

Test access periodically. Knowing credentials are stored somewhere is not the same as knowing they work. Logging into critical accounts once a quarter takes minutes and confirms things are where they should be.

Ensure business ownership of accounts. If a contractor or agency set something up, make sure the account is registered in the business name with a business email and a business payment method. Access can be granted to third parties without handing them ownership.

FAQ

The person who had access is refusing to hand it over. What can I do? For domain registrars specifically, ICANN has a dispute resolution mechanism. For other services, contact the platform's support team with proof of business ownership. Most platforms will assist a verified business owner in recovering control of an account, though the process can take time. In serious cases this becomes a legal matter, but most are resolved through the platform's support process before it reaches that point.

We do not have any documentation of what accounts we have. Where do we start? Start with what you know is critical: domain registrar, hosting, email platform. Then work outward. Check bank and credit card statements for recurring charges to services you might have forgotten. Search your email for registration confirmations. Ask whoever has been managing IT what they have access to.

Should we have a policy about this going forward? Yes. At minimum: all business accounts registered with a business email address, credentials stored in a shared password manager, and a handover process whenever someone with system access leaves the company. This does not need to be elaborate. A one-page document and a shared 1Password vault covers most small businesses.

ExplainMyIT checks your domain registrar, DNS configuration, SSL certificate, and email security setup every month and keeps a dated record. It does not store your credentials or give you access to anything, but it does tell you what is visible about your setup and flags when something changes, so you know what you have before you need to recover it.

See what your setup looks like right now or read more about how it works.

Related reading: