You have no boss. You cannot just report situation to boss and move on.
Crosspost on freelancing website has I believe optimal solution: remove your content only from website and (politely) notify client what you did and that he needs to change password.
My assumption is that your client is a small mom-and-pop business (say 3-person car mechanic shop) asked you (a kid living in parent's basement with no office and no company) to create static 3-page business website for yellow pages or some cheap web hosting company or something similar trivial task. Then the client noticed TV ad which promises creating website for free and decided not to pay you. Client has no legal department to sue you, or not even a friend attorney who will sue you for free, or the client is not a local attorney.
My answer is based on these assumptions, which are most likely hypothetical:
- You want to design websites.
- There is nobody else responsible to collect from clients, who understands local laws.
Whatever you do, do not delete any data which don't belong to you. What actions you take should have no impact on client's business (other than not having access to design which was not paid for).
Still, you need to move on. Don't waste time trying to sue or damage customer. Consider lost money as your tuition you paid to learn following lesson: you should have milestones and get paid for every milestone. And next time evaluate clients more carefully.
You can make more money per hour doing what you know how to do. Consider how much time you will spend to learn something you don't know to do (suing your client in small claims court), compare skills you gain if you spend same time building websites for other clients. Which skills are more valuable? What is better use of your time? Hint: is not suing.
But as an option (as a small shop), consider changing master password so next time customer needs some website change he needs to go back to you. Website will be up and undamaged, but no more changes possible until client pays.
You should decide what kind of business you are dealing with, and what kind of risk is acceptable to take to get the payment which you deserve. Nobody's reputation will be destroyed if the website is up and running, while you are waiting for the payment.
I agree that no serious company should sabotage another serious company. But that's not the case here. Neither one is a Fortune 500.
I wouldn't suggest having a page on your website with customers who owe you money. You don't want to advertise that you are vindictive towards your clients. My advice: Don't do anything as stupid as that. It will NOT win you new clients, it will scare them away.
Sure, my assumption could be wrong, that job might be from real company with legal department, or at least attorney on retainer, or website for attorney. They will sue you in no time, and you want to avoid this. Then, of course, my assumptions and my advice is invalid. But that is unlikely, I like my chances.
You learned the lesson about getting paid for milestones and don't deploying to client hardware the final product until you get paid.