Website Malware Removal Cost: What You Pay For and What to Expect

The cost of website malware removal depends less on the malware and more on the work around it: how many sites share the hosting account, whether a clean backup exists, how many back doors the attacker left, and whether Google has already flagged the site. A proper job is priced on hours of careful work, not on a scan, and it must include a backup first, removal of every back door, a reset of all passwords and login sessions, closing the way in, and a written report. A cheap "scan and delete" that skips those steps often ends up costing twice, because the site is reinfected.

This guide is for business owners comparing quotes for hacked site repair, or deciding whether to pay for a yearly security plan. It explains what drives the price, what a proper cleanup includes, the red flags in cheap offers, the questions to ask, how hourly work compares with subscription services, and when doing it yourself is realistic.

#What actually drives the cost

Malware removal is priced by effort, and effort depends on the situation, not on the name of the malware. Two sites with the same fake pop-up can take very different amounts of work.

The fake Cloudflare "verify you are human" campaign is a good example of why depth matters. On the cleanups I handled in October and November 2026, the visible pop-up came with hidden plugins, must-use plugins, a rogue admin account recreated by theme code and attacker login sessions still active weeks later. The article on the fake Cloudflare verification pop-up explains that campaign in detail.

#What a proper malware removal must include

A proper cleanup is a sequence of stages, and each one exists because skipping it leads to a repeat infection or lost data. When you compare quotes, check every stage is covered.

1. Outside check. Confirm what visitors actually see, on which pages and devices, before changing anything.
2. Full backup first. Files and database, stored outside the website folder, so nothing can be lost and the evidence is kept.
3. A hunt beyond the scanner. Files compared with clean official copies, plus users, plugins, scheduled tasks and the database reviewed.
4. Ordered removal. Injected code, hidden plugins and back doors removed in an order that stops them recreating each other.
5. Clean software. WordPress, plugins and themes replaced with fresh copies from trusted sources.
6. Full access reset. Every password changed, database password and security keys renewed, and every active login session ended.
7. Entry point closed. The weak plugin, outdated theme or stolen password that let the attacker in is dealt with.
8. Caches cleared. So the old infected page is not served after the source is clean.
9. Outside check again. The same view as step one, now clean.
10. Review request, if flagged. A request in Search Console once the whole site is clean.
11. Plain report. What was found, what was removed, what changed and what to watch.

WordPress.org's own FAQ My site was hacked (opens in a new tab) supports several of these stages: take a snapshot before cleaning even if it is infected, change every access point including hosting, database and FTP, log out every active user, change passwords again after the site is clean, and find out how the attackers got in so they cannot use the same route. My hacked site cleanup guide walks through the same stages from the owner's side, with what you can safely do in the first hour.

#Why "scan and delete" is not a cleanup

A scan finds known patterns; it does not find everything, and it never tells you how the attacker got in. An offer that consists of running a scanner and deleting what it flags leaves out most of the list above.

Here is what that approach usually misses:

• Code that does not match a known pattern. Attackers change their code to pass scanners. On my own cleanups, I have seen scans come back clean while infected code remained, and only a comparison with official copies found it.
• Back doors. A hidden admin account, a plugin that hides itself from the plugin list, or theme code that recreates a deleted user.
• Live login sessions. WordPress.org advises forcing everyone out by renewing the site's secret keys, because a stolen session can survive a password change.
• The way in. If the outdated plugin or stolen password is still there, the attacker simply returns.
• Caches. The infected page keeps appearing to visitors even after the source is gone.

The result is a familiar pattern: the site looks clean for a few days, then the pop-up or redirect returns, and you pay for a second cleanup while losing another week of visitors.

#Red flags in cheap offers

Some offers look attractive because they skip the parts that take time. These signs suggest a quote covers less than it seems.

• A fixed price before anyone has looked at the site. Without an outside check, nobody knows the scope.
• No mention of a backup before work starts.
• "We will scan and remove the malware" with nothing about back doors, users or login sessions.
• No plan to find the entry point. If they do not ask how it happened, they will not stop it happening again.
• A request for your passwords over chat or email. A careful provider asks for a separate account or access you can remove afterwards.
• No written report at the end.
• A guaranteed Google warning removal date. Google decides the timing; its Security issues report help page (opens in a new tab) says reviews can take from a few days to a few weeks.

#Questions to ask before you hire

Five questions separate a cleanup from a patch. A clear yes to each is what you are paying for.

1. Will you take a full backup before changing anything, and keep it outside the website folder?
2. Will you check files against clean official copies, not only run a scanner?
3. Will you reset every password and end every active login session?
4. Will you find and close the way the attacker got in?
5. Will I get a written report of what was found and changed?

Ask too about other sites on the same hosting account, and what happens if the infection returns within a short period. For general hiring questions, my guide on questions to ask before hiring a web developer covers how to judge the answers.

#Hourly work compared with yearly security plans

Hourly work and yearly security plans solve different problems. Hourly suits a one-off cleanup on a site you will then look after properly. A plan suits owners who want monitoring, a firewall and unlimited cleanups bundled together, paid every year, per site.

The table below shows public list prices for two well-known services as they appeared on their own pricing pages in November 2026. Prices change, so check the current page before you buy.

Sources: Sucuri plans and pricing (opens in a new tab) and Wordfence plans and pricing (opens in a new tab). Sucuri lists unlimited cleanup requests on every Platform plan.

Plans are good value if you run a site where downtime is expensive and you want a firewall and a fast response target on call all year. They are less good value if your site is otherwise well maintained and you only need one thorough cleanup, or if you run several small sites, because plans are priced per site.

#A planning estimate at my rates

My rate for this work is USD 10 to 15 an hour, as listed on the pricing page. The table below comes from the cleanups I have done recently, most of them sites hit by the fake "verify you are human" pop-up. It is a planning guide, not a price list. I give a real estimate after a first look at the site, which needs no access and takes a few minutes.

These times are the work itself. Calendar time is often longer: getting server access from the host is usually the slowest part, and if Google shows a warning, its review runs on Google's schedule after the cleanup.

Whatever you choose, ongoing care afterwards matters more than the cleanup itself. A maintenance and support plan covers updates, backups and checks, and the article on what a website care plan includes shows how to judge one.

#Do it yourself or hire help?

Doing it yourself is realistic in a narrow case: a small site, a backup you know is from before the hack, and a clear idea of how the attacker got in. Restore that backup with your host's help, update everything, reset every password, end every login session and remove unused plugins and accounts.

Hire help in these situations:

• Visitors see a fake pop-up, a redirect or spam you cannot trace.
• Google, a browser or your host has flagged or suspended the site.
• The site takes payments or holds customer data.
• It has been cleaned before and came back.
• Several sites share the hosting account.
• You have no backup you trust.

If a plugin conflict or broken feature appears after the cleanup, that is normal clean-up fallout and usually quick to fix; plugin conflict fixes cover it. For the security basics that prevent the next incident, read WordPress security for business owners.

#A simple next step

Before you request quotes, write down what you or your customers saw, when it started, how many sites share your hosting, and what backups your host holds. Send the same notes to every provider and compare their answers against the five questions above.

If you would like me to look at your site, an urgent WordPress fix starts with an outside check and a backup, and you can reach me through the contact page for a time estimate.