Somewhere in your client list there is a site with an outdated plugin nobody has been paid to update. One day the client calls to say Google is warning visitors away, or their customers are landing on a gambling page. They call you because you built it, and in their mind you are responsible for it.
Plenty of good agencies do not keep incident response skills in house, and there is no reason they should. Building sites and cleaning compromised ones are different kinds of work. What you need is someone who can do the cleanup properly, stay out of sight, and hand you what you need to look after the client. That is how we run white label hack cleanup. For the broader picture of how we handle hacked sites, see the hacked website repair and emergency help page.
What changes when the work is white label
The technical job is the same as any cleanup: find the infection, remove it, close the entry point and confirm it stays gone. Our core WordPress malware cleanup describes that work in detail. What changes is everything around it.
Who we talk to
Only your team. Questions, updates and findings go to the person you name, through email, a shared board, Slack or WhatsApp, whichever you already use. We never write to your client, and we do not join their calls.
What carries a name
Nothing we leave behind mentions us. Reports are unbranded and editable. Security plugins we configure send their alerts to your addresses or the client’s, as you decide. If a support ticket has to be opened with the client’s host, we agree with you in advance who opens it and in whose name.
How information reaches the client
You decide what the client hears and when. We give you the facts first, in plain language, so you can brief the client before they start asking. When the work is done, you get a short summary written for a non-technical reader, ready to send as your own.
This is the same principle behind our wider white label WordPress development work: you own the relationship, and we stay behind it.
The parts agencies tend to underestimate
Your own access is part of the picture
Agencies hold a lot of keys: hosting logins, admin accounts across many client sites, FTP passwords stored in a shared team tool. If an attacker got in with stolen credentials, the question of whose credentials becomes an awkward one. We give you a list of every login that should be changed, your agency’s own included, and we raise it tactfully if the evidence points at your side of the fence.
Reseller and shared accounts
Many agencies host clients on one reseller plan or VPS. If those sites share a system user, one infected install can quietly write into the others. When we are asked to clean one client site on such a server, we tell you plainly if we see signs on the rest, and we recommend whether the account should be split up. The hosting suspension page covers what happens when the host acts before you do.
Sites you inherited
Sometimes the hacked site is one you took over recently, built by someone else on a theme you have never opened. The infection may predate you entirely. If the client is asking whose fault it was, a written timeline from a hack investigation can show when the compromise began, which protects you as much as it informs the client. Our post on taking over a site from another developer lists the checks worth doing on any inherited site.
The promise you make the client
It is tempting to tell an anxious client that everything will be fixed by tomorrow. We will give you a straight read of the situation and a realistic start point, so that what you pass on is something both of us can stand behind. We will also say so when the honest answer is that a site needs rebuilding, or that a plugin it relies on has no safe version.
Working across time zones
Our team is in India. For agencies in the US and UK, a client problem raised at the end of your day lands in ours, and work can often begin while your office is closed. We do not promise any particular turnaround, but the overlap is genuinely useful for incident work, where the client mostly wants to wake up to progress. For US agencies, the page on hacked website repair for US businesses explains how we handle communication and payment across the time difference. Indian agencies get the same white label approach in the same working hours as their own clients.
What a typical engagement looks like from your side
From your account manager’s point of view, the job is short. They forward the client’s complaint, share the access they hold, and tell us what the client has already been told. From then on, their inbox receives a first assessment, progress notes, and finally the report and summary. Their only outward-facing task is relaying what they choose to the client, in their own voice.
Behind that, the usual cleanup steps happen: a backup, a scan of files and database, removal of malicious code and rogue accounts, fresh copies of core and plugins, closing the way in, and a period of watching for anything returning. If the client’s site was flagged by Google or blocked by their host, we prepare what is needed for those reviews and tell you who should submit it.
What we need from you to start
- The client’s site address and what the client actually saw, ideally in their own words or a screenshot.
- Access you are able to share: WordPress admin, hosting panel or SFTP, and Search Console if the client has it.
- A note of anything your team has already changed, so we do not mistake your fixes for the attacker’s work.
- Who on your side is the contact, and which channel they prefer.
- Any limits from the client, such as a store that must keep taking orders while the work happens.
Keeping the client calm while the work happens
The client’s anxiety lands on your account manager, not on us, so we try to make their job easier. Early on, you get a short note of what we can see, written so that it can be paraphrased to the client without causing alarm or making promises. When something changes, such as the site being taken offline briefly or a Google review being submitted, you hear about it before the client is likely to notice.
We also flag anything the client should do themselves. Changing the password to their own email account, for example, or checking whether staff reused the website password elsewhere. Those steps are better coming from you, as the person the client already trusts.
Turning one incident into a better setup
A hacked client site is often the moment a client finally agrees to pay for maintenance. If you like, our findings come with update and hardening recommendations written so you can quote them as follow-up work. If you would rather not run that work yourself, we can carry it out under your name on a continuing basis. A one-page plan agreed with the client in advance, of the kind described in our post on a website security incident plan, makes the next incident far easier for everyone.
If you would prefer to hand the client to us openly instead of reselling, our referral partner program is the better fit. The two options suit different agencies, and we are happy to talk through which one works for yours.
Sending us the first job
Send the site address, the symptoms the client reported, the access you can share, and how much the client already knows. For a live incident, put HACKED as the first word of your WhatsApp message so it is treated as urgent rather than queued with routine jobs. The client’s site is backed up before anyone touches it, you hear plainly what we found and when work can begin, and your team stays updated on WhatsApp, or your own channel, until the report is in your hands.