WordPress site hacked? What to do and what cleanup costs

If your WordPress site has been hacked, work in three stages. First contain it: lock the attacker out and stop the damage. Then clean it: remove the malware and every backdoor, and find out how they got in. Then harden it so it doesn't happen again. In 2026 a professional WordPress malware cleanup costs anywhere from about $95 at a flat-rate service to $300–$1,800 for most small-business sites, and $1,800–$6,500 or more when a WooCommerce store or customer data is involved.

I've written this for when it's happening right now. Do the containment steps first. Then use the price and hiring sections to decide whether you fix it yourself or pay someone.

How do you know your WordPress site has been hacked?

The giveaways are spam redirects, pages in Google you never created, browser warnings, a Security Issues report in Google Search Console and admin users you don't recognise. Some hacks are loud. Most are quiet, because the attacker wants your site to keep running so they can keep using it. Watch for these:

• Visitors from Google or on mobile get sent to spam, pharma or scam sites, while you see a normal site when you're logged in.
• Searching site:yourdomain.com shows pages you never made, often in Japanese or stuffed with product spam.
• Chrome shows a red "Deceptive site ahead" or "This site may be hacked" warning.
• Google Search Console lists something under Security Issues.
• There are admin users under Users that nobody on your team created.
• Your host has suspended the account or emailed you about malware.
• PHP files turn up in wp-content/uploads, where there should only be images and documents.
• On a WooCommerce store, customers report card fraud after buying from you.

You don't need several of these. One is enough to treat the site as compromised.

What should you do in the first hour?

Snapshot the site, take it offline if it's hurting visitors, change every password, log everyone out, remove unknown admins and tell your host. I know the urge is to delete everything or restore last week's backup. Hold off. If you don't find out what happened, it'll happen again.

1. 1

   Take a snapshot of the hacked site

   Download a full copy of the files and database as they are now. It's your evidence, and your safety net if a cleanup goes wrong.

2. 2

   Take it offline if it harms visitors

   If it's redirecting people, serving malware or skimming cards, put it in maintenance mode or ask your host to block public access.

3. 3

   Change every password from a clean device

   Hosting panel, SFTP or SSH, database, every WordPress admin and the email account linked to the admin user.

4. 4

   Log everyone out

   Replace the security keys and salts in wp-config.php. That ends every session, including the attacker's.

5. 5

   Note and remove unknown admins

   Write down the usernames and creation dates first, because they help date the breach. Then delete them.

6. 6

   Tell the people who need to know

   Your host, and on a store your payment provider. If customer data may have leaked, check your [reporting duties under data protection law](https://gdpr-info.eu/art-33-gdpr/).

Can't do any of this because a former developer or agency still holds the hosting, domain or admin logins? Fix that first. I've written a separate guide on how to take back your WordPress site when a developer disappears.

How do you clean a hacked WordPress site properly?

A real cleanup does two jobs. It removes everything the attacker left behind, and it closes the door they came through. Cheap cleanups tend to do only the first one, and the site gets reinfected a few weeks later.

Find the entry point. It's nearly always one of four things: an outdated or vulnerable plugin, a nulled (pirated) theme or plugin, a weak or reused password, or another infected site on the same hosting account. The server access logs from around the time the first rogue file appeared usually point you to it.

Replace, don't repair. Download a fresh copy of WordPress from wordpress.org and overwrite the core files. Then delete every plugin and theme and reinstall each one from its official source. Anything unused or nulled doesn't come back.

Hunt for backdoors. Attackers almost always leave themselves a way back in. Look in:

• PHP files inside wp-content/uploads
• The mu-plugins folder, which most people never open
• .htaccess rules that redirect search or mobile traffic
• Extra code in wp-config.php
• Fake plugins with believable names
• Scheduled tasks (cron) that recreate files after you delete them

Clean the database. You're looking for injected <script> tags in posts and options, rogue users and sometimes thousands of spam pages. If the siteurl or home values in wp_options are wrong, that's a classic redirect hack.

Rescan, then ask Google to review. Run a scanner again. When it comes back clean, open the Security Issues report in Google Search Console, explain briefly what you fixed and request a review.

One word on scanners. They're good at spotting known malicious files and weak at spotting custom backdoors and database injections. That's why the manual checks above aren't optional.

How much does WordPress malware removal cost?

Expect anything from about $95 for a flat-rate cleanup, to $300–$1,800 for most small-business sites, up to $1,800–$6,500+ for full incident response. These are market prices from cleanup providers and security firms, in US dollars:

Another 2026 breakdown puts a typical cleanup at $450 to $2,000 or more, depending on how bad the infection is and how long it's been there.

Read the small print on security plans. MalCare's entry-level Protect plan at $99 doesn't include malware cleanup, so it won't help if you're already hacked.

What pushes the cleanup price up?

"Malware" can mean a 30-minute fix or a week of forensic work. What decides which one you've got:

• How long it's been there. An infection that's sat for months has had time to spread and plant more backdoors.
• Other sites on the same hosting account. If one site on a shared account is infected, every site on it needs checking.
• SEO spam. Thousands of injected pages mean database work, redirects and Search Console clean-up on top of the malware removal.
• E-commerce and customer data. A card skimmer on a WooCommerce checkout turns a cleanup into incident response.
• Blacklisting. Google, browser or email blacklists add review time and paperwork.
• No backups and no access. If nobody can find the hosting login or a clean copy of the site, you're paying for the hours spent sorting that out.

How long does recovery take, including Google warnings?

Cleanup services typically promise completion within 6 hours to one business day. Getting Google's warnings removed takes longer. FixMySite says most cleanups finish within one business day once it has access, and Sucuri's fastest plan promises cleanup within 6 hours.

Then there's Google. According to Google's own help page, reviews for malware take a few days. Reviews for spam hacks can take up to several weeks, because they may need manual checks. Once a review is approved, the warnings go within a few days. Don't request a review before the site is genuinely clean. A failed review just drags things out.

Why do WordPress sites get hacked?

Almost always through plugins, and faster than most owners can update them. Patchstack's State of WordPress Security in 2026 report counted 11,334 new WordPress vulnerabilities in 2025, 91% of them in plugins. 46% weren't fixed in time for public disclosure, and the most heavily exploited flaws were being mass-attacked within a median of 5 hours.

Five hours. Updating plugins every few months doesn't stand a chance against that. You need fewer plugins, faster patching, and something that still protects you when a fix hasn't shipped yet.

How do you stop it happening again?

The full list is in my WordPress security checklist. After a hack, these are the ones I'd do first:

• Cut the plugin list. A plugin you don't use is risk with no upside. And never run nulled plugins or themes.
• Patch fast, and add a firewall with virtual patching. That covers the gap between a vulnerability going public and the fix arriving.
• Turn on 2FA for every admin, and give each user the lowest role that does the job.
• Turn off the built-in file editor with DISALLOW_FILE_EDIT in wp-config.php. Then a stolen admin login can't be used to edit PHP.
• Keep daily off-site backups, and test a restore now and then.
• Send HTTP security headers. I built the HTTP Security Header plugin, now at 1,000+ active installs, to add Content-Security-Policy, HSTS, X-Frame-Options and the rest from a settings screen. I'll be honest about what it can't do: headers won't patch a vulnerable plugin. A good CSP does limit which domains scripts can load from, though, and that blocks a lot of injected scripts and clickjacking.
• Check your grade. My free Security Headers Checker fetches any public page, grades its headers from A+ to F and tells you the value to set for each one.

The last layer is a person. Sites that get hacked are very often sites nobody was looking after: no updates, no backups, nobody checking. A maintenance retainer covers updates, backups, uptime and security checks every month, so problems get caught before Google flags them. If the old host was part of the problem, I can also move the site to better hosting without downtime.

What should you ask before hiring someone to clean it?

A low price is worthless if the hack comes back next month. Before you hire anyone, ask:

1. Will you tell me how the attacker got in, in writing?
2. Do you take a full backup before you change anything?
3. Do you check the database, uploads, users and cron jobs, or just run a scanner?
4. Is the Google review and blacklist removal included?
5. What happens if the site is reinfected within 30 days?
6. What access do you need, and will you rotate those passwords when you're done?
7. What should we change afterwards so this doesn't happen again?

If they can't give you a clear answer to the first and third questions, keep looking.

What to do next

Do the first-hour steps now, even if you're going to hire help. They protect your visitors and your evidence. Then send me your site URL and what you're seeing. I'll look at what you're seeing, help you plan the cleanup and harden the site afterwards, and set up the maintenance and hosting that keeps it clean.