In the Islamic Republic of Pakistan, the land of the pure, it seems that if one entity is really 100% pure, that is exploitation.
Exploitation is too often normalised. Therefore, it remains usually undocumented and rarely challenged. One such undetected form prevails in the digital space, where website owners unknowingly lose control over what should rightfully be theirs.
I have deliberately not disclosed the identities of the professionals in the web development business who have given me and many other apparently empowered, modern, urban women such hard times.
This is not to protect them. This is because this article is about the (mal)practice and not people.
While digital harassment is widely talked about now, donors fund it, NGOs campaign against it, and UN agencies hold consultations about it, this particular form of harassment and abuse is probably being documented for the first time, at least in Pakistan.
We talk about online trolling, cyberbullying, and revenge porn. But financial exploitation through web design?
Digital asset hostage-taking? This remains invisible.
And, like so many other forms of violence against women and children, the abuse is mostly committed by people you trust.
People you know.
The Hidden Costs Clients Are Never Told About
Most clients believe: "Website bananay ka ek hi kharcha hota hai" (Making a website has only one cost). This is where exploitation begins.
A woman-owned apparel business pays Rs. 60,000 for a website. Every year, she is asked for Rs. 30,000 for "renewal" without an invoice breakdown. Reality: domain costs Rs. 4,000, hosting Rs. 6,000. The rest is exploitation.
A website involves two essential recurring annual costs: the domain registration fee and hosting charges. Separate from these are the one-time website development costs, along with optional or agreed-upon annual maintenance fees. However, unethical developers often blur these distinctions, intentionally or otherwise, creating confusion that ultimately disadvantages the client.
Domain Ownership: When Your Website Is Not Really Yours
A domain name is your business identity online, like your shop's nameboard. But designers register it on their own email, using their personal account, without giving login access. The client assumes: "Website meri hai, domain bhi meri hi hogi" (The website is mine, the domain must also be mine). Legally and technically, it is not.
When one client's site sends spam, the entire IP gets blacklisted, your legitimate business emails are marked as spam, your invoices disappear, and your credibility suffers
A consultant with a five-year-old website wants to change the web designers. She is told: "Domain meri email ID pe hai, aap isay le nahi saktay" (The domain is on my email ID, you cannot take it). That domain, built with years of marketing, is now held hostage.
Hosting, Credentials, and Control
Instead of creating hosting in the client's name, designers use their own reseller accounts. The client never sees the hosting company, control panel, or server details.
Clients are denied domain login, hosting access, WordPress admin, or email credentials. Everything remains with the designer, creating dependency: "Website chalani hai to Web designer ke baghair kaam nahi chalega" (If you want to run the website, work will not happen without the web designer).
In Pakistan, deals happen on WhatsApp: "Bhai/Behan tension na lo, sab manage ho jata hai" (Don't worry, everything gets managed).
Nothing is written about ownership, costs, access rights, or transfer policy.
When disputes arise: "Yeh cheez agreement mein likhi nahi thi" (This was not written in the agreement).
There was no agreement at all.
The Hidden Dangers of Shared Hosting
I discovered this entirely by accident. And it was traumatic.
For months, my business emails were going to spam. My website was loading slowly, sometimes going down for hours. I kept paying renewal fees and kept trusting my web designer.
Then an IT expert checked my website's IP address. My professional website, representing years of work, was hosted on the same IP as dozens of other sites—some flagged for spam, some with malware, some penalised by Google. I was sharing digital space with websites with which I would never associate. Their problems had become my problems.
This is what unethical web hosting looks like: the designer puts 20, 30, or even 50 clients on a single shared hosting reseller account to maximise profit. You think you have your own hosting. You do not.
The consequences are devastating: malware from one site spreads to yours. When one client's site sends spam, the entire IP gets blacklisted, your legitimate business emails are marked as spam, your invoices disappear, and your credibility suffers. High traffic on one site slows everyone else down. Google penalises your search ranking because you share an IP with spam sites. Years of SEO work wasted.
You have no control. No visibility. No way to know this is happening until the damage is done.
When I confronted my highly educated web developer and the hosting company in charge about this, the response was breathtaking: "I am not a technical person, and I was not responsible for maintenance. We do not look into clients' websites. It is not possible to maintain so many emails for separate hosting."
A person charging for web hosting services claims, "I am not a technical person." A person taking money for maintenance says, "I was not responsible for maintenance." Translation: it is not profitable for us to do the right thing. So we will not.
This is calculated exploitation disguised as incompetence.
What Happens When You Try to Leave
Problems explode when a client says: "Hum kisi aur se kaam karwana chahtay hain" (We want to work with someone else). Suddenly, migration fees appear, technical excuses start, fear of downtime is created, and calls and messages are ignored. Some designers openly intimidate: "Payment clear hogi tab domain milega" (Pay first, then you get the domain), "Website delete kar dunga" (I will delete the website), "Emails band kar dunga" (I will shut down emails). Digital hostage-taking.
Legal Recourse: Where Is It?
Pakistan has a Domain Name Dispute Resolution Center (DNDRC) handling .pk domain disputes, primarily for trademark infringement and cybersquatting, but client-designer ownership battles remain undocumented. DNDRC processes take 4–6 months and cost money.
Most clients in Pakistan are not cheated because they are careless; they are cheated because they trust too easily and do not know what to ask
I searched extensively for DNDRC's physical address but found only: website (www.dndrc.com), email (contact@dndrc.com), established in 2006, based in Karachi, with no specific address.
Many disputes never reach formal forums because clients do not know DNDRC exists, the process seems too technical, women fear retaliation, and there is little precedent. The shocking part? The client paid for everything yet owns nothing.
Theoretically, Pakistan's National Cyber Crime Investigation Agency (NCCIA, formerly FIA Cybercrime Wing) investigates cybercrimes under PECA 2016. Section 14 addresses "electronic fraud." Domain hostage-taking could fall under this. Victims can file complaints by calling 1991 or on their website.
But here's reality: most women do not report. The process requires technical evidence that many do not have because the designer controls everything.
You must prove "intent for wrongful gain" and "deception"—nearly impossible with verbal agreements. FIA officers have been arrested for corruption. How do you trust a system where protectors are perpetrators?
Why Don't We Go to the Police?
I do not trust the system. Our police do not understand this. Try explaining "domain hostage" to an SHO.
Having worked as a gender consultant on police projects, I have seen their reality. Our police are underpaid, overworked, and dealing with visible crimes: theft, assault, and murder. Digital exploitation requires specialised knowledge. Non-officer staff seldom get training in emerging crimes.
They are expected to handle everything with minimal resources.
I know police officers and civil servants who did PhDs while assistants did "typing for them." If they are ignorant about digitalisation, imagine a muharrir (police station clerk) in a typical thana? The gap between digital crimes and police infrastructure is enormous.
But the bigger problem is our culture. It blames victims: "Pehle check nahi kia?" (Didn't you check first?).
Even women do not support other women unless you are a media celebrity or there's an advantage in it. And there's fear.
Fear of unknown revenge.
I live in a society where abusive power is respected shamelessly. Where women are attacked emotionally, physically, for refusing a rishta (marriage proposal) by a so-called Ashiq (suitor/lover). What will a man do when his business practice is exposed publicly?
So we stay silent. We pay. We suffer.
The Mental Health Toll
Nobody talks about this part. The constant anxiety: "Kya kal website band ho jayegi?" (Will the website shut down tomorrow?). The helplessness: "Main kuch kar bhi nahi sakti" (I cannot do anything). The humiliation: "Itni parhi likhi hun, phir bhi thag gayi" (I am so educated, yet I got cheated).
For women, especially, this becomes another layer of trauma. We are already navigating a society that questions our competence, our decisions, and our right to do business independently. And then this—being financially exploited, digitally controlled, professionally undermined by someone we trusted.
Many women I know have developed anxiety disorders. Some have stopped pursuing their business dreams altogether.
The psychological cost is immense but invisible.
We suffer mentally. In silence. Because who will understand?
For women entrepreneurs, especially, shared hosting contamination is particularly damaging. We are already fighting for credibility in male-dominated spaces.
When our emails go to spam, when our websites load slowly, when our online presence is compromised, it reinforces stereotypes that women cannot manage professional digital identities. We blame ourselves.
We think we are not tech-savvy enough.
We internalise failure.
Who Are These Web Designers?
Through my experience and talking to other women, a profile emerges: mostly 30–55 years old, educated (sometimes from good institutions), soft-spoken and professional initially, publicly visible on LinkedIn and Facebook, presenting themselves as helpful and trustworthy.
This makes it harder.
They do not look like fraudsters.
They look like professionals.
How Clients Can Protect Themselves
Treat your website like property, not a service favour. Keep admin access to websites and emails. Hosting must be in your name.
Demand written confirmation of ownership.
Ask for cost breakdowns. Always register a domain in your own email.
A website is not decoration; it is a business asset.
Conclusions
Most clients in Pakistan are not cheated because they are careless; they are cheated because they trust too easily and do not know what to ask.
Transparency is not optional. Ownership is not a luxury. And no web designer has the right to control what a client has paid.
This is not just bad business practice. For women especially, this is another form of control, another way our autonomy is undermined, another space where we are made dependent on men who hold the keys to our digital presence, our professional identity, our economic independence.
It is time we name it for what it is.