What does it cost to recover a hacked WordPress site?

The cost of recovering a hacked site cannot be expressed in a fixed amount upfront, because no one knows what has happened until the investigation reveals it. What you can know: which model is used, what the minimum is, and which factors determine where you end up above that.

This article therefore does not give a price, but it does provide the insight you need to understand why a fixed price does not work here and what the scope depends on.

Why a fixed price upfront does not work here

With other jobs, a quote is logical. You describe what you want, the provider calculates what it costs, and you sign. With a hack, it works differently.

At the moment you report it to us, we do not yet know how the attacker gained access. How long the infection has been present. Which files have been affected. Whether integrations have been compromised. That is not unwillingness, but the nature of the work.

A fixed price upfront inevitably means a safety margin is built in. You pay that margin even if it turns out not to be needed, and the party setting the margin has no reason to keep it tight.

Working via a credit-based system resolves that. You pay the hours actually spent and see afterwards what they were spent on. No hidden buffer, no long-term obligation.

How recovery works with us

Recovery with us almost always runs via a credit-based system, because it nearly always involves new clients. There is no existing relationship and therefore no prior agreement to fall back on.

Credit packages come in four, eight, twenty, and forty hours. They have a validity period that is shorter for a small package than for a large one.

For a smaller site, four hours is achievable. For larger sites, the investigation determines the scope, and that cannot be given in advance. Only once it is clear where the infection is and how the attacker gained access can the cleanup effort be estimated. Most sites are back online within a day. That is based on experience, not a commitment.

If you have an SLA in place, action is taken within four hours in the event of an emergency. That shortens the period the site is offline, which affects the total damage.

Which factors determine the scope of the work

The factors below determine in practice whether you get by with a small package or not.

Size of the site. A small site without integrations is investigated more quickly than a web shop with a large catalogue, active payment integrations, and a link to an accounting system. More to search through means more hours.

Whether integrations have been affected. If an attacker had access to the integration with a payment provider or an external system, that requires additional investigation and sometimes coordination with that party. That counts towards the time spent.

Whether the backend is still accessible. Sometimes the admin environment is blocked or inaccessible. That requires a different approach than when you can simply log in.

How long the infection has been present. A hack that has been present for weeks has typically reached more files than a recent one. The older it is, the more there is to search through.

Whether the cause is clearly identifiable from the logging. Sometimes the logging points directly to an outdated plugin or a leaked password. In other cases, additional logging is needed to rule out an internal cause. In our practice, an outdated plugin has been the access route in approximately 75 per cent of cases.

The consideration made during the work

Thorough investigation is not always the fastest or most efficient route. For a small site where the infection cannot be clearly isolated, exporting the content and rebuilding on a clean installation may be faster than going through everything file by file.

We have made that consideration ourselves with a site where the infection proved persistent. Which approach works out cheaper cannot be said in advance and depends on what the investigation reveals.

This choice is made during the work, not before. That is one of the reasons why a fixed quote structurally does not fit here.

Costs that may run alongside the recovery

The technical work is one side of the equation. With a web shop that is offline for a day, revenue is lost. That damage is separate from what the recovery costs, but it is part of the same situation.

If personal data was stolen during the hack, there may be a reporting obligation. The Information Commissioner’s Office (ICO) is the relevant authority for what you need to do in that case. Rules and enforcement obligations change, so for the consequences in your situation a solicitor is the appropriate party.

For everything you need to do at the moment you discover you have been hacked, we refer to My WordPress site has been hacked: what now?. Preventive measures are covered in How do you secure WordPress preventively?.

Recovery is a one-off, the cause is not

Recovering a hacked site solves the immediate problem. But the situation that made the hack possible still exists afterwards if nothing changes.

In our practice, an outdated plugin has been the access route in approximately 75 per cent of cases. If nothing changes about the maintenance after recovery, that situation persists. The consideration you need to make is not recovery versus doing nothing, but recovery plus structural maintenance versus recovery that repeats itself.

More about what is needed after a hack to prevent recurrence can be found in the overview WordPress security and recovering a hacked site. How we handle recovery and ongoing maintenance is described at our WordPress support.

The remaining decision is yours: what does it cost if the site is offline for a day, what is structurally needed to prevent recurrence, and which of the two weighs more heavily in your situation?

Frequently asked questions

What does it cost to recover a hacked WordPress site? That cannot be expressed in a fixed amount upfront, because the scope only becomes clear once the investigation reveals how the attacker gained access and which files have been affected. Recovery with us works via a credit-based system. For a smaller site, four hours is achievable. For larger sites, the investigation determines the scope.

Why do I not receive a fixed price upfront? A fixed price upfront requires knowing what went wrong. With a hack, that is unknown until the investigation reveals it. A provider that does give a fixed price builds in a safety margin that you pay even if it turns out not to be needed. A credit-based system covers precisely the hours actually spent, nothing more.

Can I resolve it myself to save costs? That depends heavily on your technical knowledge and the nature of the infection. If the access route remains open, the problem is not gone. The question is then not whether it is cheaper to do it yourself, but whether you are certain the cause has been removed.

How do I know afterwards what the hours were spent on? With a credit-based system you receive an overview afterwards of what the hours were spent on. You pay the hours actually worked, not a predetermined package.

What does it cost if the site becomes reinfected? Recurrence goes through the same process: investigation again, recovery again, hours again. The question is whether the underlying cause was removed after the first recovery. Without structural maintenance, the situation that made the first hack possible often continues to exist.

Are there costs that do not belong to the recovery itself? Yes. With a web shop that is offline, revenue is lost. If personal data was stolen during the hack, there may be reporting obligations and legal follow-up steps involved. Those costs are separate from the technical work but are part of the total impact.