Edit 10/3: Thank you everyone who commented! I wanted to share the path forward in case anyone gets here in the future from Google.

After getting the log-in information to CloudFlare from the company, I took the CloudFlare DNS and did a whois lookup to figure out that the website was hosted with AWS. Looking at the information from the whois lookup, the IP pointed to a Plesk server (it showed EC2 in the information).

From there, I took that direct I.P. address and forced my way into the Plesk log-in page using the following link:

https://(WEBSITE-IP):8443

[Thanks to u/LunaFlowLab] Comment Here

This brought me to a custom sign-in page, with a logo for a local web development company. After informing the client of this company, they were able to reach out and get back into the admin account.

This is also hilarious, but they had 3 years of unpaid invoices as the invoices were going to an inactive email address. I have no idea why this company continued to host for them to be honest.

From there, straight into WordPress as an admin, no log-in needed. :) Thanks again!

Original Post:

This may be the most disastrous start to a job I have ever had.

I will be honest, I'm not an insane expert savant web designer by any means, but I can get around with code and am all around technically savvy.

I took up this client, who gave me their wordpress log-in for my first day working on changes to the website. Part of my contract was that I was to "set-up a staging site before pushing any changes." Which is fine, I know how to do that a few different ways, but this is where a can of worms opened.

The account they gave me is NOT the admin to WP, I'm not even sure what permission level it is set at, so I have no way to check or download plugins, which was also in my contract.

Over this entire week, they have found 3 other accounts from people no longer at the company, all of which are also not admin level. I thought, no biggie, I can help you out if you point me to your hosting.

They didn't know where their website was hosted. So after a lot of whois look-ups, I was at a dead end since it pointed to Cloudflare and, you guessed it, they didn't know the account for that either.

They finally got access to Cloudflare, so I found the domain provider. Name, cool, I'll log in there and maybe get access to the cpanel or something and be able to help them finally. IT was able to get access after more waiting. NOPE. Only bought the domain there, no other products.

Now, after even MORE digging, I see that everything routes to AWS. I give them the names of many different website hosts that would point a WP site to AWS (WP Engine, Cloudways, etc.) No dice.

I have access to Cloudflare and Name but I can't seem to find anything about where the site is actually hosted to be able to edit the WP files to restore admin access. Their billing department swears that the only thing they pay for web-wise is the domain at Name. "My Products" shows nothing being purchased, bill is $0 for Name and Cloudflare, so I guess?

Is a nuclear option the only way forward? Rerouting the domain somewhere else? Did their previous person truly use an AWS server manually through the console? It's funny - because this is a moderately sized national company. I shudder to think what would happen if something went wrong with their website. At least they're scrambling to figure it out now.

All of this to say, does anyone have any ideas? I've spent the last hour just looking at the page source while logged in looking for ANY instance of a plugin being connected to a hosting provider with no dice. It's all through Elementor if that matters. DNS lookups doesn't seem to help either. HELP! lol.