What It Costs to Fix a Hacked Website (Real Numbers)
By Glenn Lyvers · Updated · 6 min read
Most hacked WordPress sites can be cleaned properly for a few hundred dollars. My flat rate for a complete cleanup is $195. Automated scanner subscriptions cost less and do less, and agency incident response bills by the hour and climbs fast. For a small business site cleaned by a person who knows what they are doing, the honest number usually lands in the low hundreds.
That is the short version. The longer version depends on what shape your site is in, what got in, and whether you would rather spend money or spend your weekend. Pricing in this business is strange, because the same infected site might collect quotes of $50, $500, and $5,000 in a single afternoon. All three quotes are real. They are just for different amounts of work, and the cheapest one is rarely describing a cleanup.
What you are actually paying for
A cleanup is not run-a-scanner-and-delete-what-it-flags. Scanners miss things; a good share of my work comes from sites that were already cleaned once. When I clean a site I find how the attacker got in, remove every file they touched, dig backdoors out of the places scanners skip (mu-plugins, the uploads folder, the database itself), rotate every credential, patch the hole, and then file the review requests that get the Google warnings taken down.
The deleting is maybe a third of the work. The rest is making sure the same thing does not happen again next Tuesday. Keep that in mind when you compare prices, because the cheap options usually stop after the deleting.
Doing it yourself: free, except for your time
You can absolutely clean your own site. I wrote a full walkthrough for exactly that, and some owners work through it just fine: how to remove malware from a hacked WordPress site. Budget a full day if you are comfortable with FTP and databases. Budget a lost weekend if you are not.
The real cost shows up when a backdoor survives. You clean the visible spam, the warning comes back two weeks later, and now you have spent two weekends and you are still blacklisted. If your site earns money, count the hours honestly. Free is rarely free.
Security plugins and scanner subscriptions
Plugins like Wordfence are worth running. I run it myself and wrote up why. But a plugin subscription is prevention and detection money, not repair money. The scanner tells you something is wrong. It is far less help at digging a backdoor out of your database at 2 a.m.
Some scanner companies sell automated cleanups as an add-on. What you get there is a script deleting pattern matches, with nobody asking how the attacker got in. Sometimes that works out. When it does not, the reinfection arrives on its own schedule.
Cleanup services and agencies
Security services sell yearly subscriptions that bundle a firewall, monitoring, and cleanup requests. For plenty of sites that is a reasonable deal. Just read what your tier actually includes, because cleanups usually run through a ticket queue and the depth of the work varies with who picks up the ticket.
At the other end, web agencies and incident-response firms bill hourly, and a compromise that takes three days to unravel adds up to real money. Those firms exist for good reasons. The reasons usually involve a company with lawyers, not a bakery with a WordPress site.
What I charge, and why the price is flat
My pricing is public and flat, because a hacked site is stressful enough without an open-ended invoice. A Simple Inspection is $19.95: I look at your site and tell you exactly what is wrong and what it needs. Bulletproof Cleaning is $195, the full cleanup described above, and it is what most people need. If you want me watching the site afterward, 3-Month Monitoring is $395 and Yearly Maintenance is $645. Everything is listed on my ordering page.
Flat pricing also keeps me honest. If your cleanup takes longer than I expected, that is my problem, not a surprise on your bill.
What makes a hacked site cost more
A few situations genuinely take more work, whoever does the job:
- Ecommerce. A store with a card skimmer needs slower, more careful work than a brochure site, and you may have disclosure obligations to sort out.
- Several sites in one hosting account. Malware crosses between them, so cleaning one and ignoring the neighbors just schedules the next infection.
- Server-level compromise. If the attacker got past WordPress and into the hosting account itself, the job is bigger than anything a plugin can see.
- Blacklists. Every blocklist has its own delisting process, and a site flagged in a dozen places takes real time to walk back. You can check where you stand for free.
- No backups. Recovery without a safety net means working slower and more carefully, because there is no undo.
Why the cheap cleanup costs the most
The most expensive cleanups I do are second cleanups. Somebody paid for a bargain fix, the visible symptoms disappeared, the backdoor stayed, and a month later the site was hosting a phishing kit with the domain on more blacklists than before.
Whatever you choose, ask the person one question first: how will you find the entry point? If the answer is a shrug, keep looking.
Questions to ask anyone you hire
Prices vary, but the questions that separate a real cleanup from an expensive scan do not. Ask how they will identify the entry point, and listen for an actual method: logs, file timestamps, comparing against clean copies. Ask whether backdoor hunting is included or an upsell. Ask who files the blacklist and Safe Browsing review requests, because a cleanup that leaves the warnings up has only done half the job. And ask what happens if the site gets reinfected in the first month.
Anyone doing this work honestly answers all four without flinching. I would rather lose a job to someone who answers them well than win it from someone who cannot.
The costs nobody puts in the budget
The repair bill is usually the small number. While a site sits infected, Google warnings turn visitors away, ad accounts get suspended, email lands in spam folders, and rankings drift down. Those losses grow with every day of waiting, which is the strongest argument I know for dealing with an infection this week instead of next month.
If you are not sure yet whether you are infected at all, start with my free site check. It costs nothing and takes a minute.
And if you would rather hand the whole thing to a person, that is what I do all day. Start with the $19.95 inspection or go straight to the full cleanup on the ordering page. Either way, you will know the exact cost before I touch anything.
Common questions
How much does it cost to remove malware from a WordPress site?
A hands-on professional cleanup of a typical WordPress site usually costs a few hundred dollars. Mine is a flat $195, which covers finding the entry point, removing backdoors, cleaning the database, and filing the review requests that clear Google warnings. Automated scanner cleanups cost less and do less. Hourly agency work costs considerably more.
Why do some hacked website cleanups cost thousands of dollars?
Hourly billing, mostly. Incident-response firms and agencies charge by the hour, and a messy compromise can take days to unravel. Ecommerce sites with card skimmers, server-level compromises, and hosting accounts with many infected sites also genuinely take more work than a single small site.
Are free malware removal offers legitimate?
Read them closely. A free scan usually means the scan is free and the fix costs money, which is fair as marketing goes. Be careful with anyone promising a free cleanup. The work takes hours, so either a price appears later or the cleanup is a script that deletes obvious matches and leaves the entry point alone.
Do I have to keep paying after a one-time cleanup?
No. A proper cleanup is a one-time job that stands on its own. Ongoing monitoring is worth considering if the site earns money or you never want to think about this again, but it is optional. What matters after any cleanup is that the entry point was closed and every password was rotated.
Does business insurance cover hacked website repair?
Some business policies include cyber coverage that reimburses cleanup and recovery costs, but many small-site owners either do not carry it or have a deductible higher than the repair bill. Check your policy before assuming either way. For a typical WordPress site, the repair costs less than a year of premiums.