How do I get my website files back from an agency?

A vague request like send me my website rarely gets a complete result. Ask specifically for a full export of the source code or CMS files, the database if the site uses one, any custom images or media in the media library, and a list of any plugins, themes, or third party integrations connected to the site.

If the site was built on a platform like WordPress, ask for a complete database export alongside the file export, since WordPress content, settings, and much of its structure live in the database, not just in the files themselves. A files only export without the database is often close to useless on its own.

If the site runs on a hosted platform like Shopify, Squarespace, or Wix, a full file export in the traditional sense may not exist. Instead, ask for direct login access to the platform account itself, or for the account to be transferred to you, since the content lives inside that platform's own system rather than in downloadable files.

Files without access to deploy and run them are only half the picture. Ask for the hosting account login, the domain registrar login, and admin access to the CMS itself, such as the WordPress admin dashboard, separately from the raw export. Each of these can be held by a different party, so confirm all three rather than assuming one covers the others.

Ask whether the site uses any external services connected through API keys or integrations, such as a booking system, a payment processor, or an email marketing tool, and get those connection details too. A site can look complete in an export but stop working entirely if a connected service was tied to credentials only the agency held.

If DNS, meaning the settings that point your domain to your hosting, is managed through a separate provider like Cloudflare, ask for access to that account as well, since DNS control is often overlooked until a migration breaks because of it.

Put every request in writing, by email, with a clear deadline, and reference your contract if it addresses ownership of deliverables, which most agreements do even if only in a general sense. A written record matters if the situation escalates, since a verbal promise to send files eventually is difficult to act on if it never happens.

If the agency stops responding, check what you can access without them. If you have any admin login to the CMS, even a limited one, you may be able to trigger your own export through the platform's built in tools without needing the agency's cooperation at all. Many CMS platforms, including WordPress, allow a site owner to export content directly from the dashboard.

If your domain is registered under your own name, you can move it to new hosting independently of the agency, using a fresh copy of the site rebuilt by a new provider, even if the original files are never fully recovered, which limits how much leverage an uncooperative agency actually has over you.

Ask any new agency, before work begins, how and when you will receive a copy of your site files and database, and how often, such as after each major update rather than only at the end of the relationship. A written handover process agreed upfront removes the ambiguity that causes this problem in the first place.

Request admin level access to your own CMS from day one, even if the agency does most of the day to day editing, so you always have a way to trigger an export yourself without depending entirely on them to provide one later.

Keep your domain registration and hosting account under your own name from the start, as covered in the ownership questions above, since a site you can already access through your own hosting login is far easier to recover files from than one you can only reach through an agency's account.