business advice urgently needed. Please help!

[quinne]

Help please from all you wise MNetters!! I have a problem with the developer of my business?s website and I need advice about what to do. It is a web based business so it is very important to us. The website is four years old and we made a few mistakes when we launched the business-

? We didn?t get a contract with the developer, just a series of verbal, email and IM conversations
? We didn?t take up references about him and now we know that technically he is fine but professionally he isn?t.
? We paid 80% of his fee up front and we didn?t ask for a receipt.
? We didn?t agree any penalties if he didn?t finish it on time (the first release was 5 months late- it was supposed to take one month, not six!)

Our problem is that the developer emailed us last night (Friday) and informed us that we have to give him £2500 by this Sunday or I will switch your website off on Monday morning. If I am honest then I admit that morally I think we owe him about £500 if you don?t allow for the damage he did to us by making us loose five months of business. He isn?t even charging for thing we owe him £500 for, but instead for things he insisted he do for us (like put together ads for newspapers) which we didn?t want him to do, didn?t use and even if we had paid for professional work instead of doing it ourselves, it would have cost much, much less than he says.

The developer says he owns the code, even though we agreed at the very first meeting that we would own the copyright to him, and he has agreed several times in writing down the years that we own it. But it is always like this with him: he says something, we argue about it, he eventually agrees with us and then six months later he ?forgets? and starts all over again.

As far as I know he has no access to the site, though he does give a lot of work to hosting company.

So far I haven?t answered him. My guess is that he needs the money for something, maybe he hasn?t earned much this year and so he just decides to come and take more from us. Right now though the website is four years old. It was hardly cutting edge back then and now I looks dated so it is not worth £2500. I?d build a new one if we weren?t in the midst of a recession but money is very tight and this could be the tipping point to send the business (and our livelihood) under.

WHAT CAN I DO??

(PS We are not in the UK, so UK law doesn't apply and the local courts are so ineffective and slow that the law doesn't really help at all even if there were contracts).

Sorry, I have no idea but have found UKbusinessforums a brilliant place for advice in the past. I know you're not in the UK but they may be able to help if you copy and paste your post over there.

Alas no idea as you say you aren't in the UK - not that I feel UK contract law would be that much help.

What you may be able to do is:

contact the hosting company (are you paying them directly... if so, they have a contract with you) and get the FTP and SiteAdmin passwords changed.

Request a full backup (they may charge for that) - or do a full backup, if you know sufficiently about the SiteAdmin software. You will need a backup of ALL files, including database(s) - not just HTML files.

Then negotiate with your webdesigner - see if you can iron out the issues between him and you. Get all agreements in writing.

Thanks I will do both of these. I stopped talking to the web developer abut three years ago (truth is he was very very boring!!). So every conversation was on email or IM and I kept all of them, including all his early hours of the morning wittering about his travels and family life. I used to just browse MN while he was talking and then try to drag him back on subject when he ran out of steam. So in between all the rubbish I do have his written commitments and could show that he didn't do what he said. But who would bother to read them? There must be a few hundred pages.

Bubblerock ... just to say thanks for the introduction tor UKbusinessforums. It is a really good recommendation. It seems the developer should not be able to raid my site and do damage, but the question remains whether he has programmed a bug which will let him in.

Nannyrock ... I've done the backups, warned the hosting company etc. So fingers crossed. Thanks for your help and advice. (You are SOOO right about getting things in writing. If only i knew that four years ago!)

No problem - there are some lovely people on there. I really hope you get things sorted!

A small tip. Make sure that you have changed ALL the passwords and usernames to access the site. Especially the one that allows access to the My_SQL aspect of it. This will be where all your clients details will be stored if you use any web forms for registraions etc.

Also, ensure you do the same with any e-mail accounts you have. Check to make sure there are no "erronious" e-mail accounts that are picking up or forwarding your mail anywhere else.

If you need a good host to migrate to then try www.one.com as they are cheap and very good.

Not sure what your IT skills are like, but its actually not that hard to update a basic site so dont be fooled by expensive web design. There are people out there who can update and maintain it cheaply.

Hope it all works out for you.

E_mailing on Friday to have the money for Sunday doesn't give you much time, so you have a valid excuse to stall him {whilst in reality you are investigating other options}. Can you contact him to string him along to buy some time? Obviously these 'negotiations' should be verbal, not in writing.

Does he belong to any trade body that you could complain to?

An update...
He used FTP to get into another site we own today and deleted some key files bringing the site down. I told the hosting service (who I'd previously warned to be on alert for him) and they confirmed that he'd done it from his office via FTP. The odd thing about FTP is that he doesn't know the password... or at least he shouldn't as I set it and had never told him or anyone else what it is...

Luckily the hosting service had a backup and restored the missing files this evening. I've asked them again to be on the lookout for suspicious activity tomorrow night.

I removed him form everything in sight over a year ago, including the webmaster email account but still he got in through FTP, even though i've changed the password. I think i am IT literate - well more than my Mum but less than an IT professional! - but I know his knowledge exceeds mine (which is why we hired him in the first place).

unfortunately there is no law which can protect us and no trade body either. In the country in which we have our business, you have to look after yourself and if you don't then you're in trouble. (So I've learned a lot about what counts since leaving the UK..!)

Sound to me that he has now gone from developer to hacker. Im sure what he has done is illegal, but if as you say the law cannot protect you then you should certainly move to another host that he cannot have had any access to. It is possible that even though you will have changed a password the host may have e-mailed you the new one and the e-mail is being redirected/copied to his account so he see all the activity.

If you can check your mail setting on the admin panel you should look for any forwarded mail just to be sure.

If you use any online payment systems, paypal for example, mak sure you have changed all your passwords and secret questions here too.

One last thing to make sure is that your virus check and spyware is up to date. It is also possible that you could have a keylogger in your PC. Try using Adaware from www.lavasoft.com which is free and will remove anything suspicious and for a decent free virus check try www.avast.com

If you make it hard enough for him to access the system he will eventualy get bored and leave you alone.

have you thought about hiring a new developer and paying him to check the site and move it to a new hosting service and change all the passwords for you.

if the site needs an update anyway you can then do this as well with the new (more professional) developer when you have the time/money

I use a yahoo account to talk to the hosting company (because I thought it would be harder to hack..!). If he can hack into it, then he has probably read some very unpleasant comment about himself!!!

By coincidence I do use the spyware and virus checking software you suggest. They are updated daily and both are run regularly... most recently last Thursday as it happens.

We don't have paypal or similar and I went through the email with a fine tooth comb only a week ago with the intention of rationalising the accounts, but changed all the passwords while I was at it. But somehow he can get access??!

The hosting company are asking me to contact the developer's employer and tell them what is happening. He works as a consultant for them and is using their hardware to first build our site and now destroy it. The thing is I'm not sure what to say? I'm fairly certain that they know what he is like, which is why the prefer him to work in the evenings and at night when they are not there!

A new developer and rebuild from scratch sounds like a good idea. It was on our to do list (or our "would like to do" list). The timing is about as inconvenient as it gets as we are planning to move back to the UK to put our sons into school and in the next few weeks i've got to find a house to rent, a state school for both of them and to organise the removals. We have to be gone by July as that's when my visa expires.

I doubt if he knows this (unless he has hacked my email - and i did check all the redirects recently) but I don't know how I am going to get it all done.

Change the FTP password on a regular basis. Do that via the webadmin system, or by contacting your host.

My webhost has recently implemented a new ftp login system, where I have to log into the hosts website and then activate ftp for that day, then my ftp password then works. Maybe you can ask your host to disable all FTP access for the time being.