Developer Not Giving Website Access? How to Get It Back in India

Developer Not Giving Website Access? How to Get It Back in India

You paid the last UPI instalment, the site went live, and nobody thought about it for a year. Then the clinic timings changed, and the freelancer stopped answering. Now your developer is not giving website access — and the domain, the hosting, the WordPress login and even your Google listing all sit on his email, not yours.

It is common. According to ICANN's compliance dashboard, transfer problems were the third-largest type of complaint against registrars worldwide from February 2024 to January 2025 — 1,314 complaints, about 10% of the total. India has about 4 million .in domains, the 9th-largest country-code domain, and plenty were bought by someone other than the business that uses them.

Most of it is recoverable, in a set order. Below: who legally holds each piece under Indian law, how to get each one back, a hypothetical Pune clinic worked through step by step, and a website handover checklist you can paste into your next contract.

Developer not giving website access? First, who owns what

Most owners assume paying the invoice means owning the site. Under Indian law it doesn't. Whoever holds the registrant record, the account logins and a signed written copyright assignment holds the site — and on many builds, none of those is in the client's name.

Start with the code. The Copyright Act treats a computer programme as a literary work (s.2(o)), and s.17 makes the author the first owner. The exceptions are narrow:

• Commissioned work (proviso b) covers only a photograph, painting or portrait, engraving or cinematograph film made for payment. Software is not on the list.
• Employment (proviso c) applies only under a "contract of service or apprenticeship". A freelancer or agency is normally not your employee in that sense.

So who owns website source code in India? Usually the developer, unless there is a written assignment. As IP firm Khurana & Khurana puts it, "the author normally retains the copyright unless there is a valid written assignment to the client or commissioner." The US "work made for hire" idea is not how the Indian Act works.

Section 19 says what a valid assignment needs: writing signed by the developer (s.19(1)) that names the work, the rights, the duration and the territory (s.19(2)). Leave out duration and it defaults to five years (s.19(5)); leave out territory and it defaults to India (s.19(6)).

In Pine Labs v Gemalto Terminals (Delhi High Court Division Bench, 3 August 2011), a software IP clause silent on both fell back to those defaults — "Whatever be the nature of the MSA, the provisions contained in section 19(5) and (6) would inevitably be triggered." That was a prima facie view on appeal from an interim order, and the injunction was restored for the developer. The flip side: in Exegesis Infotech v Medimanage (Bombay High Court, 15 July 2015, also interim), the client won because a written MOU said "Medimanage will hold the complete ownership of the software."

With no document at all, you likely have at least a right to keep using what you paid for. But that is weaker than ownership and untested in a reported Indian case.

Developer not giving website access: the asset-by-asset table

"The website" is really five or six things, each held by someone different.

Asset	Who legally holds it	How to get it back	What to sign next time
Domain (.in or .com)	The registrant on record	Registrar lookup, written auth-code and change-of-registrant request, escalate with ID and payment proof	Business as registrant; developer only as technical contact
Hosting and DNS	Whoever holds the hosting account	Ask for a full backup; if refused, rebuild on hosting in your name	Hosting on the business card, developer as a user
Custom code and design	The developer (s.17), unless assigned in writing	Negotiate a short written assignment: rights, full term, worldwide	Signed s.19 assignment with duration and territory
Premium theme and plugins	Whoever bought the licence	Ask for the Envato purchase code and licence details	List of every third-party licence, in your account
Google Business Profile	The primary owner's Google account	Request ownership, wait the 3-day window, appeal if denied	Business Gmail as primary owner, agency as manager
Android app (Play Console)	The account that published it	Only the current owner can start a transfer	Play Console in the business's name, developer as user

How to get your domain back if it is registered in your developer's name

A domain registered in the developer's name is the most urgent piece, because the renewal reminder goes to his inbox. If it lapses, your email goes with it.

1. Find out who holds it. A WHOIS or RDAP lookup shows the registrar. Many Indian developers buy through reseller panels, and wholesale registrars often deal only with resellers — OpenSRS, for example, sends domain holders back to their reseller.
2. Ask in writing — the developer and the reseller — for the auth code (EPP code) and a change of registrant to your business. Attach invoices, UPI receipts and the WhatsApp messages where he agreed to register it for you.
3. Escalate to the registrar with your ID, GST or incorporation certificate and that payment proof.

The rules differ by extension. For .com and other gTLDs, ICANN policy says the registrar must give the auth code to the registered name holder within five calendar days; if not, you can file an ICANN Transfer Complaint. For .in, registry.in says "Registrars are contractually required to provide the auth code upon the request by the registrant", but "NIXI does not give out authorization codes" and a change of registrant goes through the sponsoring registrar — "NIXI cannot do this for you." A .in transfer completes in five 24-hour periods.

The catch is the word registrant. If the developer is the registrant, the right to the code is his. Whether a registrar acts on your evidence instead is up to that registrar, so don't count on it.

If he refuses or has moved the domain into his own name, the next step is a formal dispute. INDRP (for .in) needs a domain "registered or is being used … in bad faith" — either is enough; UDRP (for .com) needs both. We've covered how an INDRP complaint works separately. In one 2026 UDRP case between US parties, nomadfreight.com, an IT contractor had moved his client's domain to himself, and the panel ordered it transferred back.

Two things are shifting. Registrars such as Enom report that NIXI puts unverified .in domains on server hold and asks for a government ID or incorporation certificate — so a domain carrying the developer's details can get stuck on his paperwork. And in Dabur India v Ashok Kumar (24 December 2025), the Delhi High Court directed registrars to run e-KYC, end default privacy masking and disclose registrant details within 72 hours to courts, law enforcement and parties with a legitimate interest. That order is under appeal before a larger bench.

Google Business Profile and Play Console: two accounts you cannot force

Your Google Business Profile is what puts your clinic or shop on Maps, and agencies often set it up on their own Gmail. To take it back:

1. Find your business in Google and request ownership.
2. Google emails the current owner, who "has 3 days to respond".
3. If there's no response, "you may have the option to claim the profile" — but "the option to claim a profile isn't always available."
4. If denied, use Google's appeal route. Screenshot every step.

Play Console is harder. If your Android app was published from the developer's account, both routes need him. An app transfer needs "the registration transaction ID" for both accounts, and the original owner starts it. An account ownership transfer can only be started by the current owner, under Users and permissions → "Make account owner", followed by a 7-day hold and identity verification. You cannot force either — your leverage is negotiation and the contract.

Hosting, WordPress admin, themes and plugins

If the hosting is his, ask for a full backup: files, database and email. If he refuses, you can usually rebuild from a copy of the live site on hosting in your own name, then point the domain there once you control it.

Premium themes are less of a problem than owners fear. Envato's Regular Licence (clause 4) says: "You can create one End Product for a client, and you can transfer that single End Product to your client for any fee. This license is then transferred to your client." Ask for the purchase code. If an Elementor Pro licence on his account isn't renewed, Elementor says the site stays live — updates and support stop, and Pro features are restricted. Annoying, not fatal.

The same trap applies to security: an SSL certificate bought through his reseller account is one more renewal lapsing in someone else's inbox.

A hypothetical Pune clinic whose developer is not giving website access

This is a hypothetical example, not a real client. Say a physiotherapy clinic in Pune paid a freelancer to build its WordPress site and set up its Google Business Profile. He bought the .in domain through his reseller panel with his own email, hosts the site on his account, is primary owner of the Business Profile on his Gmail, and activated the premium theme and page-builder licence on his account. There's no contract — just WhatsApp messages and UPI receipts. After a fee dispute he stops answering. The clinic can't edit its timings, and the renewal reminder goes to him.

How to get the website back from the developer, in order:

1. Look up the registrant and registrar.
2. Send a written auth-code and change-of-registrant request, with payment proof.
3. Request Business Profile ownership and wait out the 3-day window.
4. Rebuild on hosting in the clinic's own name from a backup.
5. Negotiate a short written assignment of the custom code — rights, full term, worldwide — and settle genuine dues in writing.
6. For the next build, sign the contract before paying anything.

Can a developer legally refuse to give access until you pay?

There is no statutory lien for web developers. Section 171 of the Contract Act gives a general right to retain goods only to bankers, factors, wharfingers, attorneys of a High Court and policy-brokers — "no other persons have a right to retain … unless there is an express contract to that effect." That doesn't make withholding automatically illegal. It means your contract should rule it out in so many words.

A consumer forum is likely closed to you: the Consumer Protection Act 2019 (s.2(7)) excludes services obtained "for any commercial purpose". Commercial Courts hear disputes of ₹3 lakh and above, and under s.12A pre-institution mediation is mandatory unless you need urgent interim relief — confirmed by the Supreme Court in Patil Automation v Rakheja Engineers (17 August 2022). A police complaint is not the default route.

If real money or a live business is at stake, talk to a lawyer before sending a legal notice. This guide is a practical checklist, not legal advice.

Website handover checklist: what a website ownership agreement in India should say

Whether you're recovering or signing with someone new, copy this into the agreement:

• Domain: registrant is the business, with the business email and ID; developer only as technical contact.
• Hosting and DNS: in the business's name, paid on the business card; developer added as a user.
• Code assignment (s.19(1)): written and signed, naming the work and rights, for the "full term of copyright", "worldwide", stating the consideration, and saying it does not lapse for non-exercise (s.19(4) otherwise lapses it after one year).
• Third-party licences: every theme, plugin and library listed, with licences in the client's account.
• Google Business Profile: business Gmail as primary owner, agency as manager.
• Play Console: owned by the business, developer invited as a user.
• No withholding: credentials and code are not withheld during a fee dispute; disputes go to mediation first.

When you compare quotes for the rebuild — what a website should cost is its own question — ask each developer if they'll sign this list as written. It is the same list Cybiqon works from, and a developer who hesitates is telling you something.

FAQs

Does paying a developer mean I own the source code in India?

Not by itself. Under s.17 of the Copyright Act the author is the first owner, and software isn't among the commissioned works that pass to the payer. You need a written assignment signed by the developer naming rights, duration and territory.

How do I get the auth code or EPP code for my domain?

Ask your registrar or reseller. For .com, the registrar must give it to the registered name holder within five calendar days. For .in, registrars must give it to the registrant on request; NIXI doesn't issue it. If the developer is the registrant, you need him — or the registrar acting on your proof.

How do I transfer my Android app from a developer's Play Console to my own account?

The developer has to start it. An app transfer needs the registration transaction IDs of both accounts; an account ownership transfer is started by the current owner and has a 7-day hold. You cannot force either.

Can I file a consumer complaint against a web developer?

Probably not for a business website — the Consumer Protection Act 2019 excludes services obtained for a commercial purpose. Disputes of ₹3 lakh and above go to the Commercial Courts, after mandatory mediation under s.12A.

Getting it right the second time

If you're rebuilding after a developer disappeared, Cybiqon builds the new site with every account in your name from day one. The domain, hosting, Google Business Profile and, for app projects, the Play Console are registered to your business, and we are added only as users. You get a signed written assignment of the custom code stating full term and worldwide territory — you own every line. The site is written for your business, not configured from a template. The same terms apply to our custom website builds and to admin panels and Android apps.

Book a 30-minute call, call +91 9250711473, or write to [email protected]. Bring whatever logins you still have and we'll help you map which assets sit in whose name.

Conclusion

When a developer is not giving website access, the fix is rarely one dramatic step. It's a checklist: find the registrant, request the auth code in writing, reclaim the Google Business Profile, rebuild on hosting you control, and get a written s.19 assignment covering full term and worldwide rights. Paying for the work didn't give you the code — the signed document does. Before you pay anyone for the next build, put the handover checklist into the contract, or book a call and Cybiqon will set it up that way from the start.