You just found out your WordPress site has been hacked. Maybe there’s Japanese or casino text in your Google results. Maybe visitors are getting redirected to a pharmacy site, or Chrome shows a red “Deceptive site ahead” screen. Your first question is probably what a WordPress malware removal service will cost, and whether the cheap option will actually work.
This guide answers both with real numbers. We checked the current prices of the main cleanup services in October 2026, and we walk through four hacked sites we cleaned ourselves. What drives the price is mostly where the infection is hiding, and those four show how much that varies.
How much does a WordPress malware removal service cost?
Most WordPress malware removal services cost $229 to $1,250 a year as a protection plan, or a one-time cleanup quoted by the job, usually priced by how deep the infection goes.
There are three ways to pay. Security companies sell yearly plans that include cleanups. Plugin vendors sell automated, one-click removal. Agencies and developers who look after your site quote a cleanup by the hour or by the job. Here is what the best-known options charge right now:
| Service | Price | What you actually get |
|---|---|---|
| Sucuri Basic | $229/year | Unlimited manual cleanups by their team, 30-hour cleanup response target |
| Sucuri Pro | $339/year | Same, with a 12-hour response target |
| Sucuri Business | $549/year | Same, with a 6-hour response target |
| MalCare Repair | $299/year | Automated one-click malware removal plus a report |
| MalCare Fortify | $499/year | Automated removal plus unlimited manual security fixes |
| Wordfence Care | $590/year | Hands-on help and incident response during business hours |
| Wordfence Response | $1,250/year | Incident response 24/7 with a 1-hour response time |
| Jetpack Scan | $9.95/month, billed yearly | Scanning with one-click fixes for most issues; no hands-on cleanup |
| Agency or developer | Hourly or per job | Someone who knows your site does the cleanup and hardening. We bill $50/hour: some cleanups take about an hour, and the worst need a full 1:1 rebuild of the site |
Prices come from each company’s own pricing page (Sucuri, MalCare, Wordfence, Jetpack) and were checked in October 2026. Sucuri notes its response times are estimates and can stretch when the queue is busy. Freelance marketplaces are all over the map and are priced per gig, so we left them out of the table.
The yearly plans make the most sense if you buy them before you need them. If you are already hacked, a plan bought today still works, but you are paying for a year of coverage to get one cleanup. The real question is whether whoever does the cleanup finds everything, which is where the price of a hack really comes from.
What makes one cleanup cost more than another?
Where the malware hides, how long it has been there, and whether clean backups exist decide the cost far more than the size of your site does.
Not every hack is the same job. These are the things that move the price.
Files or database
A hack that lives in a few PHP files is the easy case. A scanner finds it, the files get replaced with clean copies, done. A hack that lives in the database is slower, because it sits inside your real content and has to be picked out by hand without deleting the pages around it. SEO spam is usually this kind.
How long it has been there
An infection caught in its first day is much cheaper than one that has run for months. Given time, attackers add more ways back in, copy themselves into more places, and get into your backups. Some even patch the hole they used to get in, so nobody else can take “their” site.
Whether your backups are clean
Restoring a clean backup is the fastest fix there is. But a backup taken after the break-in restores the malware along with everything else. Finding out which backup is actually clean takes time, and on one of the sites below, the newest backup was already infected.
How many sites share the server
On shared hosting or a server running many sites, an infection can spread from one site to the next. Then every site on that server has to be checked and cleaned.
Whether customer data was involved
If the site takes payments or stores personal information, a cleanup can turn into a breach investigation, with notification rules that depend on your state. That costs far more than removing malware.
What does a real WordPress hack look like?
Most hacks we clean don’t look like a defaced homepage. They stay hidden and earn money for the attacker through spam links, redirects or ads, while the site looks normal to its owner.
These are four sites we cleaned. We have left out names, but every detail is from our own cleanup notes.
1. A nonprofit’s site that every scanner called clean
This site was serving hidden casino links on every page, written in Polish, Czech, German, Greek, Hungarian and Portuguese. A scan of 9,626 files came back with 130 alerts, and every one was a false alarm. The WordPress core files matched the official copies exactly. There were no rogue users, no backdoor files, nothing.
The whole infection lived in the database, inside the page builder content. The worst piece was a hidden block in the site’s header template, which put a spam link on every page at once. The sneakiest was inside a real paragraph of the client’s own copy: a link wrapped around a single period, plus a block of German casino text pushed 75,555 pixels off the screen. That paragraph had to be edited by hand, because deleting it would have deleted the client’s content too. We also found six spam pages, four of them live, backdated years to look like old posts. A scanner-only cleanup would have found none of it.
2. A dental practice where the last cleanup never finished
Google Safe Browsing had flagged this site for “social engineering,” and an earlier cleanup had not cleared it. When we looked, the malware from before was still on the server. Someone had “disabled” it by moving it into a folder named plugins_disabled instead of deleting it. That folder held six backdoor packages. We also found a gambling page planted in the wp-content folder, live at its own address, and a hidden file manager script that gave anyone with the link full access to the files.
We see this pattern more than any other when a hack comes back. The visible symptom got removed and the way back in stayed.
3. A small organization’s site that got reinfected in 60 seconds
This one was completely down, with an error on every page. Around 30 plugin files had been cut off mid-code and 60 more emptied to zero bytes. There were webshells (scripts that let an attacker run commands on the server), fake plugins with innocent names, and a malicious “must-use” plugin that WordPress loads automatically.
Two things made it expensive. First, the most recent backup already contained one of the backdoors, so we had to compare backups file by file to find the last clean one. Second, after we restored clean files, the main index file was infected again in about a minute. The attacker had left two processes running in the server’s memory with no file on disk. Restoring files cannot fix that. The processes had to be killed first, then the site restored again.
4. A business site whose login page sent people to ads
The owner noticed that clicking the login link sometimes sent them to an ad. A plugin on the site had been swapped for a trojanized copy that loaded a script from an outside server. The script skipped search engine bots, so the site looked clean to Google and to most scanners, and only redirected real visitors. While cleaning it we also found a 28 MB copy of the entire database sitting in a public folder, where anyone who guessed the address could download it.
Why do cheap malware cleanups come back?
Cheap cleanups remove what a scanner flags and stop there, so a hidden backdoor, an infected backup or an unchanged password lets the attacker straight back in.
Every one of the four sites above had at least one of these problems, and none of them shows up in a quick scan:
- A backdoor gets left behind. Malware that was moved, renamed or “disabled” is still on the server.
- Nobody looks in the database, and file scanners don’t read your page content.
- The backup used for the restore was taken after the break-in, so it reinstalls the hack.
- Malware is still running in the server’s memory and overwrites the clean files within minutes.
- The passwords stay the same. If the attacker logged in with a real account, cleaning files does nothing until every admin password and WordPress’s secret keys are changed.
- Old admin accounts stay open. Accounts left over from former staff or a previous agency are a common way in.
When you compare two cleanup quotes, ask which of these each one checks, because a cleanup that comes back in two weeks means paying twice.
Can you fix a hacked WordPress site yourself?
You can fix a simple, recent infection yourself if you are comfortable with files and databases, but database spam and hidden backdoors are easy to miss without experience.
If you want to try, this is the order we work in:
- Copy everything first. Take a full backup of the hacked site, files and database, before you delete anything. You will want it if you remove something you needed.
- Check the core files against the official copies. WordPress publishes a checksum for every core file, and WP-CLI can compare them for you. Modified, missing or extra files are a red flag.
- List admin users straight from the database. Some malware hides its admin account from the normal user screen.
- Look for PHP files in your uploads folder and anything in the mu-plugins folder you don’t recognize. Neither should hold surprise code.
- Check your page content too. Look for hidden blocks and outbound links you didn’t add, including in header and footer templates.
- Change every password and your WordPress secret keys. WordPress gives you a fresh set of keys here.
- Update everything and remove what you don’t use. Old and abandoned plugins are a common way in.
- Ask Google to review the site. In Search Console, the Security issues report shows what Google found and has the button to request a review once you’re clean.
WordPress also keeps its own checklist for hacked sites. If your site takes payments, stores customer data or brings in your leads, we would hire someone. One missed backdoor puts you back at the start, and the second cleanup costs more than the first.
What does a hack cost beyond the cleanup bill?
The cleanup is often the smaller cost. Browser warnings, lost search rankings, blocked email and lost customers can cost more and last longer than the hack itself.
Browser and search warnings
Google Safe Browsing protects over five billion devices, and Chrome, Firefox and Safari all use it. If your site gets flagged, most visitors see a full-page warning instead of your site. The warning stays up until the site is clean and Google has reviewed it, so a slow cleanup means a longer warning.
Search rankings
SEO spam hacks create pages Google indexes under your domain, often in other languages. Google’s guide to hacked sites covers how it treats them. Cleaning the site doesn’t remove those pages from Google’s index on its own. On the nonprofit’s site above, we set the removed spam pages to return a “410 Gone” status, which tells Google the page is gone for good, and then asked Google to remove them.
Hacked sites are often used to send spam. When that happens, your server or domain can end up on email blocklists, and your real emails start landing in spam folders. Getting delisted means proving the problem is fixed to each list, one at a time.
Customers
Someone who sees a red warning or lands on a gambling page usually doesn’t come back to find out what happened. That loss never shows up on the cleanup invoice.
How do you choose a WordPress malware removal service?
Choose a service that cleans by hand, checks the database as well as files, verifies your backups, changes credentials and asks Google to remove the warnings.
Before you pay anyone, ask them these questions. A good service will answer every one without hesitating:
- Does a person do the cleanup, or only an automated tool?
- Do you check the database and page content, not just files?
- How do you make sure no backdoor is left behind?
- Which backup is clean, and how do you know?
- Will you change passwords and secret keys and review the admin accounts?
- Will you request the Google review and handle blocklist removal?
- If it comes back within a month, is the second cleanup included?
- Do I get a written report of what you found?
If you are comparing ongoing plans rather than a one-time fix, our roundup of the best WordPress maintenance services compares eight providers with verified prices.
How do you stop your WordPress site from being hacked again?
Keep WordPress, themes and plugins updated, remove what you don’t use, use strong unique passwords with two-factor login, and keep daily backups you have tested.
Prevention is cheap next to any of the cleanups above. What actually keeps sites safe:
- Update WordPress, themes and plugins promptly. An outdated plugin or theme is one of the most common ways in, and Wordfence’s vulnerability database lists the known holes plugin by plugin. For the current WordPress releases and how to apply them safely, see our WordPress 7.0 and 7.1 update guide.
- Delete plugins you don’t use. An inactive or abandoned plugin is still code on your server.
- Pick hosting that keeps each site apart from its neighbors and runs a firewall and automatic backups.
- Put a firewall in front of the site. Services like Cloudflare block a lot of attack traffic before it reaches WordPress. Hacked sites are also used to show fake Cloudflare checks that trick visitors into installing malware; here’s how to tell a fake Cloudflare check from a real one.
- Give every admin a strong password and two-factor login, and remove accounts for people who no longer need them.
- Keep daily backups for several weeks, so a clean copy from before the break-in still exists when you need it.
- Have a person look at the site regularly. Automated scans miss what people notice, like new pages you didn’t write, odd links or a plugin you never installed.
This upkeep is also why WordPress needs more maintenance than Wix or Squarespace. The flexibility comes with responsibility. If you’d rather hand it off, our guide to WordPress maintenance plans explains what a good plan should include, and our own hosting and maintenance plans start at $15 a month, with security updates, uptime monitoring and priority support on the $100 plan. Hack cleanup is not included in any plan. We quote it separately, because one site takes an hour and the next needs a full rebuild.
Frequently asked questions
How long does WordPress malware removal take?
A simple file infection can be cleaned in a few hours. Database spam, infected backups or malware running in memory can take days. In our own work, some cleanups take about an hour and the worst need a full 1:1 rebuild of the site. Sucuri, for example, sets cleanup response targets from 30 hours on its basic plan to 6 hours on its business plan.
Does restoring a backup remove malware?
Only if the backup was taken before the break-in. A backup made after it restores the malware too. On one site we cleaned, the newest backup already held a backdoor, so we compared backups file by file to find the last clean one.
Can a security plugin remove malware on its own?
Some can remove common file infections automatically. MalCare’s paid plans and Jetpack Scan offer one-click fixes, while MalCare’s free version only finds malware. Plugins often miss spam hidden in your database or page content, which needs a person to remove.
How do I get rid of the “This site may be hacked” warning in Google?
Clean the site completely, then open the Security issues report in Google Search Console and request a review. Google removes the warning after the review confirms the site is clean. It won’t go away on its own while the hack is still there.
How do I know if my WordPress site has been hacked?
Common signs are redirects to other sites, spam pages or foreign-language results under your domain in Google, admin users you didn’t create, browser warnings, a hosting suspension and Search Console security alerts. Many hacks show no visible sign to the owner, which is why regular checks matter.
Should I buy a security plan or pay for a one-time cleanup?
If you are hacked today, a one-time cleanup by someone thorough is usually the faster fix. Afterwards, keep the site maintained and backed up. A yearly security plan or a maintenance plan costs less than a second cleanup.
What should you do next?
If your site is hacked right now, don’t wait. Every day the hack stays, it digs in deeper, and Google’s warning stays up longer. Back up the site as it is, then get it cleaned by someone who checks the database, the backups and the passwords, not just the files.
If your site hasn’t been hacked, this is the cheap moment. Updates, backups and someone actually looking at the site cost far less than any of the cleanups above.
We clean hacked WordPress sites and keep them clean afterwards. If you want someone to look at yours, get a free consultation or start a conversation with us. We’ll tell you what we find and what it will take to fix it.