Most WordPress sites we inherit in India are not broken. They are unowned
What is different about WordPress in India is the cheap end of the market. Sites get built fast on nulled themes and plugins, parked on shared hosting nobody inspects, and handed over with no one responsible for updates. Most of our WordPress work here is not building from scratch. It is taking over and cleaning up.
WordPress runs an enormous share of Indian business websites, and many were built for a price that could not include licences, hosting worth the name, or anyone to maintain the result. The site works on the day it is handed over. What happens afterwards is nobody's job. Later it is slower, stranger and quietly serving something its owner never put there.
The usual discovery goes like this. A business asks why its site has become slow and why search results show pages it does not recognise. The theme turns out to be a paid one obtained without a licence, so it cannot receive updates and arrived with code the original developer did not write. Two plugins are in the same condition. The hosting is a shared plan with permissions wide open, an administrator account belonging to a developer nobody has spoken to in years, and no backups. None of this was sabotage. It is what happens when the build price left nothing for maintenance and nobody was named to do it.
When this work makes sense
Questions worth asking any supplier
Ask whether every theme and plugin will be licensed in your name, because a nulled component cannot be updated and an unpatched component is how most WordPress sites are eventually entered.
Ask what the hosting actually is, because shared hosting is not automatically wrong but shared hosting nobody has ever inspected is, and the difference is visible in minutes.
Ask who is named as responsible for applying updates after launch, because if the answer is nobody it will be nobody, and the site decays on exactly the schedule you would expect.
Ask what the backup arrangement is and when it was last restored from, because an untested backup is an assumption rather than a safeguard.
Ask how many administrator accounts exist and who they belong to, because inherited sites routinely carry logins for people the business no longer employs.
Deliverables
An audit of themes, plugins and their licence status, with every nulled component identified and named
Malware and backdoor removal, including injected files and database entries that survive a theme replacement
Licensed replacements for anything that cannot be cleaned, or a rebuild where no licensed equivalent exists
Hosting reviewed and, where necessary, migrated, permissions, PHP version, isolation and access corrected
User accounts pruned, with administrator access reduced to people who currently work with you
Backups configured and restored from at least once, so you know the restore works
A named update owner and a written routine. What is updated, how often, who checks afterwards
Built with
Process
On an inherited WordPress site we take a full copy before touching anything, and we work on the copy. That ordering matters more here than anywhere else, because on a compromised site the fastest way to lose evidence of how the intruder got in is to start cleaning the live one. The copy tells us which files were modified and when, which accounts were used, and whether the entry point is the theme, a plugin, the hosting account or a password. Cleaning without knowing that produces a site that is reinfected.
The standard nine stages, discovery, strategy, UX/UI, development, content and SEO, testing, launch, measurement and continuous improvement, apply to every project. The paragraph above is what differs for this one.
What moves the number
Pricing depends on scope, functionality, integrations and content requirements. These are the factors that change it most:
Three ways to deal with an inherited WordPress site
Clean and keep it
Fits: Sites where content and structure are sound and the problem is licensing, hosting and neglect
Limits: If the original build is poor underneath, you have paid to preserve something you will replace anyway
Rebuild on the same content
Fits: Businesses happy with what the site says but not with anything holding it up
Limits: Costs more than a clean-up and needs care to keep URLs and existing search visibility intact
Clean now, rebuild later
Fits: Businesses needing the immediate risk removed without committing budget to a rebuild
Limits: You pay twice, and the interim site keeps whatever design and structural limits it started with
Case studies
Nothing is published yet. There is no WordPress rescue or clean-up case study on this site, no client names, no screenshots, no recovery timelines. Security work is also the hardest thing to publish, since most clients would rather not be named alongside it. Our head office is Road No. 36, Plot No. 1202 & 1215A, 3rd Floor, SL Jubilee, Jubilee Hills, Hyderabad 500033, Telangana.
MBGDesk operates from 4 offices in India, United States, United Kingdom, United Arab Emirates. We hold no industry certifications and do not imply otherwise.
Frequently asked questions
How would we know if our site uses nulled themes or plugins?
The clearest sign is a premium theme or plugin that never offers an update and has no licence key registered to you. Another is an update prompt that fails or asks for a key nobody has. A file-level audit settles it quickly. Owners are often surprised, having paid for the site and assumed the components were paid for too.
Is nulled software actually dangerous, or just unlicensed?
Both, and the second part is the reason to care. Nulled copies are redistributed by someone who modified the code to remove its licence check, which is a convenient place to leave other code as well. Even a clean copy cannot receive security updates, so every future vulnerability in it stays open on your site permanently.
Our site was hacked and the developer cleaned it. Why did it come back?
Almost always because the entry point was never found. Deleting the visible damage, the spam pages, the injected redirect, leaves the backdoor that created it, and reinfection follows. Finding the way in means reading file modification times, hosting logs and account activity. It takes longer than deleting symptoms and is the only thing that ends it.
Is shared hosting the problem?
Not by itself. Plenty of small Indian business sites run perfectly well on shared hosting. The problem is shared hosting nobody has ever looked at: an outdated PHP version, permissions left wide open, no isolation between accounts, no backups. Whether those are worth fixing in place or worth migrating depends on what we find.
Who should own updates after you hand the site back?
Someone with a name. Core, themes and plugins all update on their own schedules, and the gap between a patch being published and applied is the window that gets used. If nobody internally can take it, we can hold it under a maintenance arrangement. What does not work is leaving it unassigned.
We cannot reach the person who built our site. What now?
It is recoverable more often than it feels. Registrar and hosting accounts can usually be regained through the provider's own recovery process with proof of the business's identity, and administrator access restored through the database once hosting is back. Tedious rather than impossible, and it is where we start.
Is WordPress the wrong choice for us?
Rarely, in our experience. WordPress is maintainable, well documented and easy to hire for in India, which matters when you want someone else to touch it later. It is badly served by builds that skip licensing and maintenance, but that is a market problem rather than a platform one. If you need a store, the platform comparison sits on our Shopify page.
Services that connect to this
Talk to us about this
Tell us what you are trying to build and we will come back with scope, approach and an estimate.