What It Costs to Fix a Hacked Website (Real Numbers)

By Glenn Lyvers · Updated November 11, 2026 · 9 min read

Most hacked WordPress sites can be cleaned properly for a few hundred dollars. My flat rate for a complete cleanup is $195. Automated scanner subscriptions cost less and do less, and agency incident response bills by the hour and climbs fast. For a small business site cleaned by a person who knows what they are doing, the honest number usually lands in the low hundreds.

That is the short version. The longer version depends on what shape your site is in, what got in, and whether you would rather spend money or spend your weekend. Pricing in this business is strange, because the same infected site might collect quotes of $50, $500, and $5,000 in a single afternoon. All three quotes are real. They are just for different amounts of work, and the cheapest one is rarely describing a cleanup.

What do companies charge to fix a hacked website?

There is no single market price, because “cleanup” covers very different amounts of work. These are typical, approximate ranges for one small WordPress site. They are not quotes, and every provider changes its pricing, so check the current number before you buy.

• Freelance marketplace gigs: roughly $15 to $100. Listings on freelance gig marketplaces start around $15. At that price you are usually buying a scanner run and a delete pass, with no time budgeted to find the entry point.
• Flat-fee cleanup firms: roughly $90 to a few hundred dollars. A fixed price, a ticket queue and a standard checklist. The low end of that range usually buys malware removal only. Blacklist delisting, hardening, a database review and a written guarantee are often extra, or not offered at all. How deep the work goes depends on the checklist and on who picks up your ticket.
• Security plugin and scanner subscriptions: billed per year, per site. MalCare, Sucuri and SiteLock are the names most owners run into. They sell protection plans, and cleanup is either bundled into a higher tier or sold as an add-on. That is prevention and monitoring money, not a one-time repair price.
• A hands-on specialist: commonly a few hundred dollars. A person works through the files, the database and the logs. My flat $195 sits at the low end of that range, and it includes deep malware removal, a manual database inspection, blacklist check and mitigation, hardening, a full backup, a video report, and a 60-day cleanup guarantee.
• Agencies and incident-response firms: hourly, often into the thousands. Billing by the hour suits a company with lawyers and card data at stake. It is more than a small business site usually needs: $195 is about what an hour or two of agency time costs.

The price differences mostly come down to one thing: whether anyone is paid to find out how the attacker got in. Everything else is deleting. So the useful question is not why $195 instead of $15, but what the $15 job leaves behind.

Is a cheap overseas cleanup safe?

It can be, and where the technician lives is not the real question. Skilled people work all over the world. The risk is the price point and the process that usually comes with it. And if the price is too cheap, you’re the product. The saying comes from free apps: if you aren’t paying for it, you’re what’s being sold. A real cleanup takes hours of skilled work, so a price that can’t cover those hours gets made up some other way: an upsell once you’re hooked, a backdoor left behind so you pay for the next cleanup too, your site quietly used for someone else’s spam links or redirects, or the logins you handed over reused or sold. Four things to check before you hand anyone the keys:

• Root cause. A $15 to $50 job has no time in it to trace the entry point. The visible spam gets deleted, and the vulnerable plugin, stolen password or weak hosting account stays exactly as it was.
• Reinfection. Backdoors hide in places a quick pass skips: the uploads folder, mu-plugins, scheduled tasks, the database. The site looks clean for days or weeks, then the warning comes back.
• Credential handling. A cleanup needs your hosting, FTP or WordPress admin login. Ask who will use it, whether the job is passed to a subcontractor, and how the login is shared. Change every password when the work ends, whoever did it.
• Accountability. Can you name the person doing the work? Is there a written report and a written guarantee? If customer data was exposed, your own notification duties apply regardless of who cleaned the site, and you will want a clear record of what was touched.

A practical test: ask how they will find the entry point, who will be logged in to your account, and what the report will say. A confident, specific answer is worth more than a low price. For a local example of this approach, see my Denver malware removal page.

What should a malware cleanup guarantee cover?

A guarantee is only worth what it says in writing. A useful one answers these questions in plain language:

• How long does it last? A stated number of days, counted from when the cleanup is completed.
• What triggers it? The same site getting infected again inside that window.
• What do you get? A new investigation and a re-clean with no new labor charge, or a refund. Know which one.
• What does it cover? If several sites share one hosting account, malware moves between them, so a guarantee that ignores the neighbors is weak.
• What does it exclude? Every guarantee has limits. Read them before you pay, not after the site is reinfected.

Mine is the 60-day malware cleanup guarantee that comes with Bulletproof Cleaning. If a covered site becomes infected again within 60 days of a completed cleanup, I investigate and re-clean it without another labor charge. A single-install hosting account qualifies automatically. When an account holds several WordPress installations or a Multisite network, every site has to be included in the original cleanup. The full terms and exclusions are in my service terms.

What you are actually paying for

A cleanup is not run-a-scanner-and-delete-what-it-flags. Scanners miss things; a good share of my work comes from sites that were already cleaned once. When I clean a site I find how the attacker got in, remove every file they touched, dig backdoors out of the places scanners skip (mu-plugins, the uploads folder, the database itself), rotate every credential, patch the hole, and then file the review requests that get the Google warnings taken down.

The deleting is maybe a third of the work. The rest is making sure the same thing does not happen again next Tuesday. Keep that in mind when you compare prices, because the cheap options usually stop after the deleting.

Doing it yourself: free, except for your time

You can absolutely clean your own site. I wrote a full walkthrough for exactly that, and some owners work through it just fine: how to remove malware from a hacked WordPress site. Budget a full day if you are comfortable with FTP and databases. Budget a lost weekend if you are not.

The real cost shows up when a backdoor survives. You clean the visible spam, the warning comes back two weeks later, and now you have spent two weekends and you are still blacklisted. If your site earns money, count the hours honestly. Free is rarely free.

Security plugins and scanner subscriptions

Plugins like Wordfence are worth running. I run it myself and wrote up why. But a plugin subscription is prevention and detection money, not repair money. The scanner tells you something is wrong. It is far less help at digging a backdoor out of your database at 2 a.m.

Some scanner companies sell automated cleanups as an add-on. What you get there is a script deleting pattern matches, with nobody asking how the attacker got in. Sometimes that works out. When it does not, the reinfection arrives on its own schedule.

Cleanup services and agencies

Security services sell yearly subscriptions that bundle a firewall, monitoring, and cleanup requests. For plenty of sites that is a reasonable deal. Just read what your tier actually includes, because cleanups usually run through a ticket queue and the depth of the work varies with who picks up the ticket.

At the other end, web agencies and incident-response firms bill hourly, and a compromise that takes three days to unravel adds up to real money. Those firms exist for good reasons. The reasons usually involve a company with lawyers, not a bakery with a WordPress site.

What I charge, and why the price is flat

My pricing is public and flat, because a hacked site is stressful enough without an open-ended invoice. Prices are per site, and I do the work myself.

• Simple Inspection, $19.95 one-time. Malware scan, vulnerability testing, a blacklist check and a video report, with a $20 credit toward a cleanup. You learn exactly what is wrong before you spend more.
• Bulletproof Cleaning, $195 one-time. The full cleanup described above: malware removal, hardening, blacklist mitigation, database inspection, a backup and a video report, with the 60-day guarantee. It is what most people need.
• Full Service, $395 for 3 months. Everything in Bulletproof Cleaning plus cleanups as needed, daily malware and blacklist scans, and daily updates and security reports.
• Yearly Maintenance, $645 per year. The same ongoing protection for twelve months.

Flat pricing also keeps me honest. If your cleanup takes longer than I expected, that is my problem, not a surprise on your bill.

Get my site cleaned →

What makes a hacked site cost more

A few situations genuinely take more work, whoever does the job:

• Ecommerce. A store with a card skimmer needs slower, more careful work than a brochure site, and you may have disclosure obligations to sort out.
• Several sites in one hosting account. Malware crosses between them, so cleaning one and ignoring the neighbors just schedules the next infection.
• Server-level compromise. If the attacker got past WordPress and into the hosting account itself, the job is bigger than anything a plugin can see.
• Blacklists. Every blocklist has its own delisting process, and a site flagged in a dozen places takes real time to walk back. You can check where you stand for free.
• No backups. Recovery without a safety net means working slower and more carefully, because there is no undo.

Why the cheap cleanup costs the most

The most expensive cleanups I do are second cleanups. Somebody paid for a bargain fix, the visible symptoms disappeared, the backdoor stayed, and a month later the site was hosting a phishing kit with the domain on more blacklists than before.

Whatever you choose, ask the person one question first: how will you find the entry point? If the answer is a shrug, keep looking.

Questions to ask anyone you hire

Prices vary, but the questions that separate a real cleanup from an expensive scan do not. Ask how they will identify the entry point, and listen for an actual method: logs, file timestamps, comparing against clean copies. Ask whether backdoor hunting is included or an upsell. Ask who files the blacklist and Safe Browsing review requests, because a cleanup that leaves the warnings up has only done half the job. And ask what happens if the site gets reinfected in the first month.

Anyone doing this work honestly answers all four without flinching. I would rather lose a job to someone who answers them well than win it from someone who cannot.

The costs nobody puts in the budget

The repair bill is usually the small number. While a site sits infected, Google warnings turn visitors away, ad accounts get suspended, email lands in spam folders, and rankings drift down. Those losses grow with every day of waiting, which is the strongest argument I know for dealing with an infection this week instead of next month.

If you are not sure yet whether you are infected at all, start with my free site check. It costs nothing and takes a minute.

And if you would rather hand the whole thing to a person, that is what I do all day. Start with the $19.95 inspection or go straight to the full cleanup on the ordering page. Either way, you will know the exact cost before I touch anything.

Related reading: rebuild or clean, what a cleanup report should contain.

Common questions

How much does it cost to remove malware from a WordPress site?

A hands-on professional cleanup of a typical WordPress site usually costs a few hundred dollars. Mine is a flat $195, which covers finding the entry point, removing backdoors, cleaning the database, and filing the review requests that clear Google warnings. Automated scanner cleanups cost less and do less. Hourly agency work costs considerably more.

Why do some hacked website cleanups cost thousands of dollars?

Hourly billing, mostly. Incident-response firms and agencies charge by the hour, and a messy compromise can take days to unravel. Ecommerce sites with card skimmers, server-level compromises, and hosting accounts with many infected sites also genuinely take more work than a single small site.

Are free malware removal offers legitimate?

Read them closely. A free scan usually means the scan is free and the fix costs money, which is fair as marketing goes. Be careful with anyone promising a free cleanup. The work takes hours, so either a price appears later or the cleanup is a script that deletes obvious matches and leaves the entry point alone.

Do I have to keep paying after a one-time cleanup?

No. A proper cleanup is a one-time job that stands on its own. Ongoing monitoring is worth considering if the site earns money or you never want to think about this again, but it is optional. What matters after any cleanup is that the entry point was closed and every password was rotated.

Does business insurance cover hacked website repair?

Some business policies include cyber coverage that reimburses cleanup and recovery costs, but many small-site owners either do not carry it or have a deductible higher than the repair bill. Check your policy before assuming either way. For a typical WordPress site, the repair costs less than a year of premiums.

What do companies charge to fix hacked websites?

Typical ranges for one small site: freelance gigs roughly $15 to $100, flat-fee cleanup firms roughly $90 to a few hundred dollars, security plugin subscriptions billed yearly per site, a hands-on specialist commonly a few hundred dollars, and agencies hourly and often into the thousands. These are approximate and change by provider. My flat $195 cleanup sits at the low end of the hands-on range and includes blacklist mitigation, hardening and a 60-day guarantee.

Is a cheap overseas cleanup safe?

It can be, but the price point is the risk. A very cheap job rarely includes time to find the entry point, so the site gets reinfected. It also means giving your hosting or admin login to someone you may not be able to identify. Ask who will use the login, how they find the entry point, and what the written report and guarantee say, and change every password afterward.

What should a malware cleanup guarantee cover?

It should state the number of days it lasts, that reinfection of the same site triggers it, whether you get a re-clean or a refund, whether every site in the hosting account is covered, and what it excludes. Mine is a 60-day guarantee on Bulletproof Cleaning: if a covered site is reinfected within 60 days, I re-clean it without another labor charge.