How can I find and remove a former developer’s email from our website forms?

Don’t assume the address is only in the website files. Check form-provider dashboards, CMS or plugin settings, hosting control panels, server-side environment variables, email-forwarding rules, and any automation services connected to the forms. A clean handoff from a new developer should include an inventory of these systems and new credentials for every account.

If you have access to the source code, search the entire project for the old email address, including configuration files, environment variables, mail handlers, and form-processing scripts. Don’t only check the visible recipient field—there could be a hidden BCC or a second notification address. Replace it with a controlled company address, ideally through a configuration variable rather than hardcoding it.

Treat this as a potential privacy or data-protection incident, especially if the forms collected names, addresses, payment details, health information, or other sensitive data. Preserve logs and records showing what happened, restrict further access, and consult a privacy or business lawyer about notification, retention, and reporting requirements in your jurisdiction.

First figure out how the forms actually send mail. They might use custom server code, a third-party form service, a CMS plugin, or settings at the hosting or DNS level. Check the related accounts and logs, remove the old recipient, rotate API keys and other credentials, and submit test forms afterward. If you’re not comfortable tracing the setup, hire a qualified web developer to audit and rebuild the mail flow.