Web Fix On
Your WordPress, Our Priority – 24/7 Maintenance
What a Hacked WordPress Site Actually Costs (And the $0 Version of Prevention)
Most people find out what a hacked website costs in the worst possible order.
First the cleanup quote. Then the hosting bill. Then, weeks later, the slow realization that the traffic hasn’t come back and probably won’t for a while.
So let’s do it in the right order instead — while your site is still fine and the numbers are just numbers.
Fair warning: the published figures on this vary enormously, and I’m going to show you why rather than picking the scariest one and running with it.
How Much Does It Cost to Fix a Hacked WordPress Site?
Professional cleanup for a typical WordPress site runs somewhere between $300 and $3,000, depending on how deep the infection goes. A single infection point on a small business site sits at the low end. A full compromise with backdoors in the database, theme files, plugins, and possibly the server configuration lands at the top — especially with emergency same-day service.
Some independent specialists offer flat-rate cleanups in the $195 range. Agency and incident-response firms billing hourly go much higher. In the UK, emergency malware removal typically runs £150 to £500.
So far, so manageable. A few hundred to a few thousand dollars is an unpleasant surprise, not a business-ending one.
Then you start seeing numbers like $14,500 as an average small business hack recovery, or $16,000 to $25,000 as a median cost of a cyber attack on US small businesses.
Which is it?
Both, sort of. And understanding the gap is the most useful thing in this article.
The small numbers are cleanup invoices. Someone removes the malware, patches the hole, files the review request. That’s a service with a price.
The big numbers are total incident costs — cleanup plus downtime, plus lost sales, plus SEO recovery, plus staff time, plus in some cases legal and notification costs. That’s not an invoice. It’s what the whole event ended up costing the business.
Treat the published averages with appropriate suspicion. They’re aggregates across wildly different businesses, and a hacked brochure site for a local plumber is not the same event as a hacked WooCommerce store processing 400 orders a day. But the structure of the cost is consistent, and that’s what’s worth understanding.
The Costs Nobody Quotes You
The cleanup fee is usually the smallest line item. Here’s what sits underneath it.
Lost revenue while you’re down
This is straightforward math and it’s the one most owners underestimate.
If your site earns $100 a day and you’re down a week, that’s $700 gone. If you’re a plumber whose site generates leads rather than direct sales, a single missed emergency call could be a $2,000 contract — because someone with a burst pipe clicks the next result in Google, not the one with a security warning on it.
Recovery time varies a lot. A straightforward hack with a clean backup can be sorted in hours. A basic hack usually takes 3–7 days minimum. Complex infections with backdoors across multiple files can take two to three weeks, especially if your backups are also infected.
The SEO damage, which lasts longest
This is the expensive one, and it’s invisible on any invoice.
When Google flags your site, the click-through rate on your search listings collapses — reported estimates put the drop around 95%. Not because you were removed from search, but because nobody clicks a result with a red warning under it.
Recovery isn’t instant. Published estimates range from 2–8 weeks after a correct cleanup at the optimistic end to 3–12 months for full ranking recovery at the pessimistic end. That spread depends heavily on how much spam got indexed and how fast you acted.
During that window, competitors are absorbing the traffic you built.
There’s a knock-on effect too. Other sites that link to you sometimes notice the warning and quietly remove the link to protect themselves. Those links don’t automatically come back when you’re clean.
Customers who don’t return
Around 40% of customers who experience significant site downtime never come back. That’s not people who complain — it’s people who quietly go elsewhere and stay there.
If your site is how customers find you, that number should get your attention more than the cleanup quote does.
Paying twice
Here’s a cost that only shows up in the fine print of the industry: a significant share of professional cleanup work comes from sites that were already cleaned once.
Cheap cleanups often stop at deleting what a scanner flagged. If one backdoor survives, the site reinfects, and you pay again — this time with a Google warning and lost rankings on top.
The things people forget entirely
- Cyber liability coverage isn’t part of standard business insurance. Most small businesses don’t have it, and it usually requires you to demonstrate reasonable security practices before the incident.
- If a hacked WooCommerce store exposed payment data, you’re in PCI compliance territory, which costs more than the cleanup.
- Rebuilding from scratch instead of cleaning sounds appealing until you realize you lose the SEO history, backlinks, and domain authority you spent years accumulating.
The Cost Comparison, Side by Side
| Prevention | Recovery | |
|---|---|---|
| Direct cost | $0–$100/month | $300–$3,000+ cleanup |
| Time investment | About 2 hours setup, 30 min/month | 3 days to 3 weeks of disruption |
| Revenue impact | None | Every day offline |
| SEO impact | None | 2 weeks to 12 months of recovery |
| Customer trust | Intact | ~40% of affected visitors don’t return |
| Chance of repeat | Low | High if the backdoor is missed |
| When you pay | Predictably, in small amounts | All at once, at the worst possible time |
Preventive security tooling generally runs $20–$100 per month. Compare that to the low end of a cleanup, and it pays for itself the first time it works.
But a good chunk of real prevention costs nothing at all, which is the actual point of this article.
The $0 Version of Prevention
None of what follows requires a purchase. It requires an afternoon and then about half an hour a month.
Free, do it today
Delete plugins and themes you don’t use. Not deactivate — delete. Deactivated plugin code still sits on your server and can still be exploited. Most sites are carrying three to six plugins nobody has opened in years.
Check the “last updated” date on everything you have installed. Over a year without an update is a warning. Over two is a replacement decision. WordPress tells you this in the plugins screen and almost nobody reads it.
Remove old WordPress installs. That test site in a subdirectory from 2021 is a live, unpatched entry point sitting in the same hosting account as your real site. On shared hosting, infections hop between sites in the same account.
Delete unused admin accounts. The developer you hired three years ago probably still has administrator access. Every active admin account is another door.
Turn on two-factor authentication. Free in most security plugins. Kills credential-stuffing attacks outright.
Disable file editing in the dashboard. Add define('DISALLOW_FILE_EDIT', true); to wp-config.php. If someone does get into your admin, this stops them editing theme files straight from the browser.
Fix file permissions. Files at 644, directories at 755, wp-config.php at 600. Never 777, no matter what a forum post from 2014 says.
Confirm auto-updates are actually running. Not just enabled — running. They fail silently for boring reasons like permission errors or a broken cron.
Never install nulled themes or plugins. Whoever removed the license check had full access to the code and no reason to be nice. Nulled software is a leading cause of infections, and it never receives real security updates.
Set up Google Search Console and turn on email alerts. Free, five minutes. It’s often how you find out about a problem first — and it’s how you’ll request a review later if you ever need to.
Actually restore a backup somewhere. Not check that backups exist. Restore one, into a staging environment or a subdirectory. An untested backup is a hypothesis. More than half of small business owners have no disaster recovery plan at all, and plenty of those who think they do have never verified it works.
Cheap, worth it
- A firewall with virtual patching ($0–$25/month). Services like Wordfence and Patchstack can block exploitation of a newly disclosed vulnerability before the developer ships a fix. Attackers start scanning within hours of a disclosure; official patches often take a week or more.
- Better hosting ($20–$50/month vs. $5). Budget shared hosting puts you on a server with thousands of other sites, any of which can become your problem. Quality hosting isolates your site and includes off-site backups.
- Off-site backups. Backups stored on the same server as your site are one compromise away from being useless.
- Uptime and file-change monitoring. Finding out from a monitor beats finding out from a customer.
Doing It Yourself vs. Hiring Someone
If it does happen, here’s the honest comparison.
| DIY cleanup | Professional cleanup | |
|---|---|---|
| Cost | $0–$200 for a premium plugin license | $300–$3,000+ |
| Time | 4 to 20+ hours if you’re learning as you go | Usually same-day to 48 hours |
| What it covers well | Obvious flagged files | Entry point, backdoors, database, credentials, review requests |
| Main risk | Missing one backdoor and repeating the whole cycle | Cost |
| Best when | Simple site, clean backup, comfortable with FTP and phpMyAdmin | Store, business site, no clean backup, or it came back before |
The dividing line is honest and simple. Scanners catch known signatures — they’re good at the obvious stuff. Sophisticated attackers use obfuscated code, hide backdoors in the database, or modify core files in ways automated scans don’t flag. Deleting flagged files is maybe a third of a real cleanup. The rest is finding the entry point, digging backdoors out of the places scanners skip, rotating every credential, and filing the review requests that clear the Google warning.
If you’re comparing quotes, ask what happens after the deleting. Cheap options usually stop there.
The Framing That Actually Helps
Most security advice fails because it’s abstract. “Keep your plugins updated” doesn’t compete with the eleven other things on your list this morning.
So try it as a number instead.
Take your monthly revenue and divide by 30. That’s what a day offline costs you, roughly, before you count SEO damage or customers who don’t come back. Multiply by seven for a realistic minimum for a moderate infection.
Now compare that against an hour of deleting unused plugins.
That’s the whole argument. You’ll pay for WordPress security either way — the only question is whether you pay a small predictable amount ahead of time or a large unpredictable amount at the worst possible moment, while your site is down and your competitors are absorbing your traffic.
Where WebFixOn Fits
We handle WordPress maintenance, security hardening, and malware recovery for businesses in the US, UK, Canada, and Australia.
If your site is currently fine, ongoing maintenance is the version of this that stays cheap: updates applied and verified, abandoned plugins caught during routine checks, backups tested rather than assumed, and newly disclosed vulnerabilities handled in hours instead of whenever someone notices.
If your site has already been hit, we find the entry point rather than just the visible symptom — because a cleanup that leaves one backdoor behind means paying for the whole thing twice.
The cheapest cleanup is the one that never happens. The second cheapest is the one where someone had a recent, tested backup.