Asking for what is already yours
Who owns the code depends on your agreement with whoever built it. Ask for everything below either way; the request itself often settles it.
Ask for these by name
Vague requests get vague replies.
- The source code, as a complete copy.
- Access to wherever it is hosted, in your name.
- The domain, or the account that controls it.
- Any database, and a recent export of it.
- Accounts for anything the site depends on: email sending, payments, maps, forms.
- Logins for the content area, with full rights.
Keep it brief and dated. One message, a list, a reasonable date. Written, not spoken, so there is a record. No threats: they rarely speed anything up and they often end the conversation.
If nothing comes back
You still have more routes than you think. Domain control can usually be re-established through the registrar with proof the business is yours, which is covered in taking back your domain. Hosting can be identified and claimed. And a site can be rebuilt from what is public without any cooperation at all, which is often faster than waiting for a reply that never arrives.
Every rescue ends with a written record of how the whole thing fits together, which exists precisely so that no single person, including us, holds the only copy of how your product works.