Your Web Developer Controls Your Domain, Hosting, or Code and Will Not Release It: What to Do
Last updated: November 2026. Reviewed by Pavel Kolmogorov, California business litigation attorney (State Bar No. 321018).
A developer who registered your domain in his own name usually cannot keep it as collateral for a disputed bill. In California a domain name is property that can be converted. (Kremen v. Cohen (9th Cir. 2003) 337 F.3d 1024, 1030, 1036.) Holding a domain that matches your brand for ransom can also violate the federal cybersquatting statute, even if the registration was innocent. (DSPT International, Inc. v. Nahum (9th Cir. 2010) 624 F.3d 1213, 1219-1221.) Kolmogorov Law, P.C. handles these disputes in Orange County, Los Angeles, and across California.
Call (909) 235-6116 or contact us online to discuss a domain, hosting account, or code base that someone else is refusing to hand over.
Three assets, three sets of rules
The dispute usually starts with an invoice the owner disputes. Then the owner learns that the developer holds every key: the domain registration, the hosting login, and the only copy of the code.
Those are three different assets, and the law treats each differently. The domain is property with a registrant of record. The text, photos, and design are usually protected by copyright. The hosting account and admin credentials are access to a computer system. I sort the problem into those three piles first.
The domain name
Start with the registration record. If your company is the registrant and the developer is only the technical contact, the registrar can usually restore your control once you prove who you are.
If the developer is the registrant, he will say the domain is his. That position is weak when he registered it for you, with your business name, at your expense. The Ninth Circuit has held that domain names are property under California law, protected by the tort of conversion. (Kremen, supra, 337 F.3d at pp. 1030, 1036.) An agent who registers property for a principal and then refuses to deliver it invites that claim. See our page on conversion claims.
Federal law adds a second claim when the domain is identical or confusingly similar to a mark of yours that was distinctive when the domain was registered. A person who uses such a domain with a bad faith intent to profit from the mark is liable to its owner. (15 U.S.C. § 1125(d)(1)(A).) In a Ninth Circuit case, a man who had registered a company's domain in his own name later kept it to press a claim for commissions. The court held that using a domain as a bargaining chip in a money dispute can show bad faith, and that he could not hold it for ransom even if he had been owed something. (DSPT, supra, 624 F.3d at pp. 1219-1221.) A court may order the domain transferred to the mark's owner. (15 U.S.C. § 1125(d)(1)(C).)
Our cybersquatting and domain disputes page covers the statute.
The site content and the code
Paying for a website does not by itself transfer the copyright in it. An independent contractor generally owns what he writes unless a signed writing transfers it. (17 U.S.C. §§ 201(a), 204(a).) Our page on contractors and work made for hire explains why.
But courts in this circuit recognize an implied license when a client asks for a work, the creator makes and delivers it, and the creator intends the client to use it. Where the client paid for the work, the license is generally not revocable at the developer's whim. So even a developer who owns the code usually cannot forbid you from running the site you paid for.
Your own text, product photos, logo, and customer data did not become the developer's property by being uploaded.
Lockouts and takedowns
Some developers go further and change the passwords or take the site offline.
A deliberate lockout is usually a breach of the service contract. It may also fall under California's computer access statute, which reaches a person who knowingly and without permission disrupts computer services or denies them to an authorized user. (Pen. Code, § 502, subd. (c)(5).) The owner or lessee of the system or data who suffers loss may sue for compensatory damages and injunctive relief, and the court may award attorney fees. (Pen. Code, § 502, subd. (e)(1), (2).) The firm pursues the civil remedy only.
Permission is the contested issue. A developer with admin rights will argue that he was authorized. The answer usually turns on what the contract allowed and whether you had revoked his access in writing. See our page on Penal Code 502 civil claims.
What to do when a web developer is holding your website hostage
- Collect the contract, the proposal, every invoice, and proof of what you paid.
- Capture the registration record and screenshots of the site, the lockout notice, and the developer's messages.
- Secure what you still control: email, payment accounts, analytics, and social logins.
- Send one written demand that identifies each asset, revokes the developer's authority, and sets a short deadline.
- Write to the registrar and the host with proof of your identity and your payments.
- Consider offering to place the disputed amount in a neutral account pending transfer. It weakens the developer's best argument.
Do not retaliate by logging into the developer's accounts.
If the site is down and sales are stopping, a court can act quickly. We can ask for a temporary restraining order requiring the developer to restore access while the invoice dispute proceeds. The evidence has to be strong.
If you are the developer who has not been paid
You may well be owed money. The remedy is a claim for the invoice, not self-help against the client's property. A contract clause that lets you suspend your own services for nonpayment is one thing. Keeping a client's domain or data is another, and it can convert a simple unpaid invoice claim into a lawsuit against you.
Release what belongs to the client, reserve your claim in writing, and pursue the debt.
The next contract
Most of this is avoidable. Register the domain in the company's name from the first day, and keep owner-level logins for hosting and every platform. Put a copyright assignment in the agreement, along with an exit clause that requires delivery of code, credentials, and data whatever else is in dispute.
What to bring to the first meeting
- The agreement, statements of work, and all invoices and payment records.
- The current registration record for the domain.
- Hosting and platform account details, including who created each account.
- Messages in which the developer refuses access or states conditions.
- A rough estimate of daily revenue lost if the site is down.
Frequently asked questions
Who owns my domain name if my web developer registered it?
The registrant of record controls it day to day, but that is not the last word. If the developer registered the domain for your California business, at your direction and expense, he likely holds it for you. Domain names are property under California law, and refusing to hand one over can be conversion. Check the registration record first, since you may already be the registrant.
Our web designer registered our domain in his own name and refuses to transfer it unless we pay a disputed invoice. What can we do?
Send a written demand, contact the registrar with proof of your rights, and consider depositing the disputed sum with a neutral party. If that fails, a California business can sue for conversion and, where the domain matches its distinctive mark, under the federal cybersquatting statute. (15 U.S.C. § 1125(d)(1)(A).) A court can order the domain transferred.
Does my developer own the copyright in my website?
Often, yes, unless a signed agreement assigned it to you. Under federal law an independent contractor generally owns what he creates, and a transfer must be in writing. (17 U.S.C. § 204(a).) A California client that requested, received, and paid for the site usually holds an implied license to keep using it, so ownership rarely justifies shutting the site down.
Can a web developer take down my site for nonpayment?
A developer may be able to suspend services if the contract allows it or the nonpayment is a material breach, but the developer takes a risk either way. In California, disabling a client's site or locking the client out without permission can be a breach of contract and may support a civil claim under Penal Code section 502. A developer who is owed money has the ordinary remedy of suing for the unpaid invoice.
My developer changed all the passwords and my online store is offline. How fast can a court help?
Often quickly, when the harm is ongoing. A California court can hear an urgent request for a temporary restraining order on short notice, usually within days, and may order the developer to restore access while the payment dispute continues. You will need evidence of your right to the site, the lockout, and the losses accruing each day.
Talk to a California business and internet litigation attorney
If someone is holding your website, domain, or code, call (909) 235-6116 or contact us online. Kolmogorov Law, P.C. is located at 327 Magnet, Irvine, CA 92618, and represents businesses in Orange County, Los Angeles, and throughout California. Related brand and content disputes are on our intellectual property page.
This page provides general information about California and federal law and is not legal advice. Outcomes depend on the contract, the registration records, the facts, and the court.