A lot of hacked websites in India are discovered the same way. A customer sends a WhatsApp message: “Sir, your website is opening some betting site.” Or the person who built the site three years ago stopped picking up the phone, and now the hosting company has sent an email in English full of words like “malicious” and “suspended”.
If that sounds familiar, this page is for you. We are a small WordPress team near Kolkata, working on Indian time, and WhatsApp is usually the easiest way to reach us. Our overview of repairing hacked websites for Indian and US businesses describes the service as a whole. Here we talk about the things that are specific to running a website in India, because they shape how a cleanup goes.
Tell us in the language you are comfortable with
Many business owners can run a shop, a clinic or a factory perfectly well without ever needing to explain a technical problem in English. You do not need to start now. If it is easier to describe what is happening in Hindi or Bengali, write to us or send a voice note in that language. What matters is that we understand exactly what you and your customers are seeing.
The reports we send at the end are written in simple English so they can be shared with an accountant, a partner or a future developer, but we are happy to explain any part of them in conversation.
WhatsApp first, on Indian working hours
Message us on WhatsApp and begin with the word HACKED. That marks it as urgent, so we read it before ordinary maintenance requests. Send screenshots, screen recordings from your phone, and any email your host has sent you. The form and phone line also work, but WhatsApp makes it easy to send photos, recordings and voice notes in one place.
Because we work on IST, our office hours are your office hours. When you message during the working day, you are reaching people who are at their desks, not a team on the other side of the world. Before asking for any login, we study the site from the outside and send you an honest reading of the situation, along with a start time. Nothing is touched until you agree, and the first thing we do with access is take a full backup.
The hosting situations we see most often in India
Indian small-business websites tend to share a few hosting patterns. None of them are anyone’s fault, but each one affects the repair.
One cPanel account, many websites
Budget shared hosting plans often allow several domains in a single account. A developer may have put your company site, an old campaign site, a relative’s blog and two test copies all in the same place. If one of them is hacked, the attacker can usually reach all the others, because they share the same files and user. Cleaning only your main site leaves the infection sitting next door, ready to come back. We check every site in the account, not only the one you noticed. Our article on how one hacked site spreads across a hosting account explains why this happens.
The account is in the developer’s name
Very often the hosting, the domain, or both were bought by the freelancer or agency who built the site, using their email address. When they cannot be reached, the owner has no login and the host will not talk to them. This is solvable, but it takes patience: proof of domain ownership, invoices, sometimes a formal request to the host. We help you through that process and, once access is back, we make sure the accounts are in your name. Our guide to taking over a website from another developer covers the handover in more detail.
“Premium” themes from unofficial sources
Paid WordPress themes and plugins are sometimes passed around for a small one-time fee or no fee at all, in WhatsApp groups and download sites. Those copies frequently carry hidden code that gives an outsider a way in. If your site was built with one, the cleanup has to replace it with a genuine copy or a different theme, otherwise the backdoor stays. We explain this further in our post on why pirated themes and plugins carry malware.
The host’s only backup
Many owners assume the host keeps backups forever. Some keep a few days, some keep only the latest copy, and some charge to restore one. By the time a hack is noticed, every copy the host holds may already be infected. That is why we make our own snapshot first and look carefully before restoring anything.
Support that suggests buying an add-on
When you contact the host, the reply may simply recommend a security product they sell. Sometimes that is helpful. Often it scans and reports but does not actually remove the cause. If your host has suspended the account, our page on getting a suspended hosting account back after malware explains how we work with the host to restore it.
What Indian businesses usually notice first
The symptoms vary, but in India a few come up again and again:
- Betting, gaming or adult pages appearing when your business name is searched on Google.
- Your site opening normally on a laptop but jumping to another site on a customer’s phone.
- Thousands of strange pages in Japanese, Chinese or English spam showing in Google, which our SEO spam cleanup handles.
- Enquiry forms suddenly sending junk, or genuine enquiries drying up.
- A WordPress login that no longer works, or admin users with unfamiliar names.
- Your Google Business Profile still pointing customers to a site that now shows a warning.
CERT-In and reporting
The Indian Computer Emergency Response Team, known as CERT-In, is the national agency that deals with cyber security incidents. It accepts reports of incidents, including website compromises, from organisations and the public.
This is general information, not legal advice. Whether your business has a formal duty to report a particular incident, and in what form, depends on the kind of organisation you are and what happened. If you are unsure, ask a qualified adviser. We can give you a written account of what we found, which helps if you or your adviser decide to report. Where customer personal data might have been exposed, it is also worth reviewing your own privacy policy and obligations; our post on reviewing your website privacy policy for Indian rules is a starting point.
How the repair itself works
Once you approve, the work follows the same careful method we use for every site, described in detail on our WordPress malware removal service page. In short: we save a full backup, stop any harm to visitors, secure the logins, remove the infection from files and the database, find out how the attacker got in, and close that gap. If Google is showing a warning, we request a review once the site is clean.
What is different for many Indian sites is the extra groundwork around that method: recovering accounts from a past developer, cleaning every site in a crowded hosting account, and replacing unofficial themes with genuine ones. We tell you upfront when this extra work is needed, so there are no surprises later.
After the site is clean
Most hacks in small Indian websites trace back to the same few causes: plugins nobody updated, a theme from an unofficial source, a shared password used by several people, or an old forgotten site in the same hosting account. Fixing the immediate problem without changing these leaves the door open.
So the handover includes plain advice: which plugins to remove, which logins to change, which old sites to delete, and whether your hosting setup is safe to stay on. If you want someone to keep watch afterwards, that is ongoing maintenance, and it is entirely your choice.
If your website is in trouble today, open WhatsApp, type HACKED followed by your website address, and describe what is going on in whichever language you prefer.