How much does cleaning a hacked site cost and what it depends on

When a site is hacked, one of the first questions after the panic is entirely practical: how much will this cost me. The cost of cleaning a hacked site is, however, rarely written clearly anywhere, because most sites that offer the service ask you to contact them for a quote. That makes comparison harder and leaves you guessing whether something is expensive or cheap.

In short: price depends on infection depth and urgency. A fair offer includes cleanup, closing the entry, and an explanation of what was done - not just removing symptoms. See also the pricing section.

In this article we explain what the cost of cleaning a hacked site depends on, why it differs from offer to offer, what should be included in a fair price, and what to watch so you do not pay twice. The goal is that after this text you know how to judge whether an offer you get is reasonable, instead of relying only on who is cheapest.

Why nobody publishes a fixed price

The reason the cost of cleaning a hacked site is rarely fixed is not necessarily secrecy. Cleanup is work whose scope cannot be seen in advance, unlike, say, designing a logo where you know what is delivered. Two sites that look the same from the outside can be completely different jobs under the hood.

One site has a single injected line of code in the theme, which is removed in half an hour. Another has a backdoor in five places, altered core files, injected content in the database, and three hidden administrator accounts, which is several hours of careful work. Until someone looks, you do not know which of those two cases you have.

That is why serious offers almost always take the form of an orientation price marked “from”, confirmed after a short look. That is not a trick, but an honest admission that the exact amount depends on a state that is visible only once you look inside. An offer that gives a fixed price immediately without a single question about the state of the site is actually more suspicious, because it either overcharges simple cases or loses on complex ones and has to make it up somewhere.

Price is not the same as value

Before we get into numbers, one thought that changes the whole angle. When a site is hacked, the real cost is not only what you pay for cleanup. The real cost also includes what you lose while the site is in trouble: visitors who leave with a bad impression, sales that do not go through, the trust of clients who saw spam from your address, and search positions that drop every day while the problem stands.

That is why comparing offers solely by the lowest price misses the point. A cheaper cleanup that leaves a hole open, so the site gets infected again, ends up costing more than everything listed above combined. The value of a good cleanup is not that it is cheap, but that the job is finished once and the site returns to a stable state without repetition. Keep that difference in mind while you read the rest of the text about the numbers themselves.

A rough order of magnitude on the Serbian market

Although the exact amount depends on everything above, it is worth having a rough sense of order of magnitude so you can recognise whether an offer is reasonable. On the Serbian market, one-time cleanup of a simpler site usually starts from a few dozen euros, while more complex cases, urgent interventions, and larger sites go higher, depending on scope.

Monthly maintenance with monitoring is a separate model, usually a significantly lower monthly amount, because it covers prevention and watching rather than a one-time intervention. That model makes sense after cleanup, or for a site you want to keep stable, because it prevents a more expensive emergency case from arising at all.

These are framework orders of magnitude, not exact prices, and we deliberately do not give them as fixed numbers, because that would be exactly what this article warns against. Their only purpose is to help you recognise when something is suspiciously cheap or unjustifiably expensive.

What the price depends on

Several factors decide where in the range a concrete price will fall. It is worth understanding them, because they help you judge whether an offer is reasonable for your case.

Severity of the infection

This is the biggest factor. A surface infection with a single source is a quick job. A deep infection with multiple backdoor files, altered core, and database records is several times more work. Because severity is not visible from the outside, it is also the main reason the price is confirmed after a look.

Urgency

If the site must be back online immediately, because it is a shop or income depends on it, that means the job skips the queue and is done with priority. Priority has its price, as everywhere else. If the site can wait for the regular queue, cleanup is cheaper.

Size and complexity of the site

A site with five pages and three plugins is reviewed faster than a shop with a thousand products, dozens of plugins, and custom code. More files mean more places that need checking, and therefore more time.

Whether recovery after cleanup is also needed

Only removing the code is one job. If Google warnings also need removing, the site needs taking off blacklists, or damage to search positions needs repairing, that is extra work that some include and some charge separately. It is worth asking in advance what is in the price.

Whether closing the holes is needed

Cleanup without closing the entry the attacker used is incomplete work, because the infection returns. A fair offer includes identifying and closing that hole, not only deleting the visible code. That is work you do not see in the result, but it is what separates a lasting solution from a temporary one.

What should be included in a fair price

When you get an offer, it is worth checking whether it covers the whole job, not only the most visible part. A complete cleanup as a rule includes the following.

• A copy of the site before any change, as protection if something goes wrong.
• Review of files, the database, and user accounts, not only files.
• Removal of malicious code from all places where it is found.
• Finding and removing backdoor files and other backup entry points.
• Identifying how the attacker got in and closing that hole.
• Changing passwords and invalidating active sessions.
• A short report of what was found and removed.

If an offer covers only deleting visible malware, and not closing the entry and checking for leftover backdoor files, there is a high chance you will pay again in a few weeks, when the infection returns through a door nobody closed.

Why prices differ so much

If you ask several places, you will get a range that can be confusingly wide. Here is why, so you know what you are actually comparing.

Some offer only deletion, some a full solution

The cheapest offer often covers only removing the visible code. That can be enough for the simplest case, but it does not include closing the hole or checking leftover entries. A more expensive offer that includes those is not necessarily more expensive without reason: it does more work.

Some charge by the hour, some by project

Hourly billing is transparent, but it does not tell you in advance how many hours. Project billing gives you a clear amount, but carries the risk for the provider that the job is bigger than expected, so the price has to cover that. Both models are legitimate; just know which one you are dealing with.

Experience and speed are paid for

Someone who cleans sites every day and knows where to look does in an hour what someone else would spend a day on. That shows in the price, but also in quality and in the chance that nothing is missed. The cheapest hour is not always the cheapest job.

A guarantee raises the price, but also the certainty

An offer that includes a guarantee, for example free re-cleanup if the same infection returns within a period, is usually not the cheapest. But that guarantee means the provider trusts their work enough to take part of the risk on themselves, which is worth it.

Hidden costs to watch for

The cleanup price is not always the whole cost. Several things can appear afterward, so it is better to ask in advance.

Whether recovery after cleanup is included or charged separately. Removing a Google warning and getting off blacklists is separate work. Whether there is a charge if the infection returns, or it is covered by a guarantee. Whether a report on the work is included, because without it you do not know exactly what was done. And whether monitoring after cleanup is part of the offer or a separate cost, because cleanup without monitoring leaves the site exposed to the same risk going forward.

Why urgency changes the price

One of the factors that confuses site owners most is why the same kind of work costs differently depending on how urgent it is. The logic is the same as everywhere there is a waiting queue.

When the site can wait for the regular queue, the job fits into the schedule without moving other obligations. When the site must be back online the same day, because a shop loses sales every hour or ongoing business depends on the site, that request skips the queue and moves everything else. That shifting has a price, like urgent delivery or an emergency repair of anything else.

The practical conclusion for you is that if the site can realistically wait a day or two, the regular queue is cheaper. If every hour costs more than the price difference, emergency intervention pays off despite the higher price. That calculation depends on how much the site actually brings you, and it is worth making soberly instead of in panic.

Cheap that turns out expensive

There is a trap that repeats. A site owner in panic chooses the cheapest offer, gets a quick deletion of visible malware, and the site apparently works. A few weeks later the infection returns, because the hole was not closed and the backdoor was not removed. Now they pay a second time, often more expensive, because the problem has grown in the meantime, and the site’s reputation has taken further damage.

The sum of those two payments, plus lost time and visitors, is usually larger than one more thorough offer at the start. That is why the cheapest number on paper is not always the cheapest outcome. It is worth looking at what is included, not only how large the amount is.

The same pattern appears with free solutions. An owner in panic installs several free plugins and tries alone, spends several days, and in the end still calls for help because the problem was not solved or came back. Then the cost is the same as if they had called for help from the start, plus the lost days and stress. A free solution is not free if it does not solve the problem, because the time you spend also has value.

Five questions worth asking before you pay

When you get an offer, these five questions quickly show you whether the job is complete or only the most visible part. The answers are worth more than the figure itself.

Will you find and close the entry, not only delete the code

This is the most important question. If the answer is not clearly affirmative, there is a high chance the infection returns, because the consequence was removed and not the cause. Closing the entry is what separates a lasting solution from a temporary one.

What happens if the infection returns

The answer tells you how much the provider trusts their work. A guarantee of re-cleanup within a period means they take part of the risk on themselves. Absence of any guarantee does not have to be bad, but it is worth knowing in advance.

Do I get a report of what was done

Without a report you do not know exactly what was found, where it entered, and what was closed. A report is not a formality, but proof that the job was really done and data that helps you if it ever repeats.

Is recovery after cleanup included

Removing a Google warning, getting off blacklists, and similar work is separate. Ask whether it is in the price or charged separately, so you are not surprised.

What afterward, so it does not happen again

Cleanup is a one-time job, and the site stays exposed to the same risk if nothing changes. A good answer includes at least a recommendation for monitoring or maintenance, because a provider who thinks long term does not leave you in the same place you started from.

How to assess your case before you ask

Although you cannot know the exact price without a look, you can roughly estimate whether your case is probably simple or complex, which helps you understand the offer you get.

A probably simpler case is if the symptom is one and clear, if the site is small, if the problem appeared recently, and if you have not had hacks before. A probably more complex case is if the infection has already returned, if the site is large or a shop, if several sites on the same hosting are affected, or if a lot of time has passed and the infection has spread.

This assessment does not give you a price, but it gives you an expectation. If you have an obviously complex case and someone offers a suspiciously low fixed price without questions, that is a reason for caution, not joy.

It is also worth keeping in mind that the age of the infection affects the price in a way that is not obvious. A site hacked yesterday is usually cheaper to clean than a site hacked three months ago and only noticed now, because in that time the attacker may have planted more backup entries, spread code to more places, and possibly infected backups. That is why a fast reaction is not only a matter of less damage, but often also a lower cost of the cleanup itself.

Is it worth cleaning, or building the site again

With seriously damaged sites the question sometimes arises whether it even makes sense to clean, or whether it is cheaper to build everything again. The answer depends on several things, and it is worth weighing soberly.

Cleanup makes sense in the vast majority of cases, because it preserves all your content, the search positions you built over years, and the settings that work. Building again sounds like a clean cut, but it means losing all of that, re-entering content, and a new site that in the eyes of search engines starts from zero. For a site with history, that is often more expensive in total than cleanup, even though on paper it looks simpler.

Building again only makes sense in rare cases. If the site was outdated anyway and you were planning a redesign. If it was built on such poor foundations that it was a problem even before the hack. Or if the infection is so deep and old that there is no reliable clean backup anywhere. In all other cases, cleanup preserves value that a new site would still have to build.

Why our price is public

You will notice that most sites that offer cleanup do not write the price anywhere. We decided differently, and it is worth explaining why, because it also says something about how we work.

A person whose site is hacked is already under stress. The last thing they need is to go through sending an inquiry, waiting for a reply, and negotiating only to learn the order of magnitude of the cost. That is why it is clearly stated from how much the price starts, so you know where you stand immediately, even before you contact us.

That does not mean the price is the same for everyone, because that would be unfair, as we explained above. It means you have an honest starting point, and the exact amount is confirmed after a look, before work begins, without hidden add-ons that jump out at the end. Transparency about price is for us part of the same honesty we try to keep everywhere, including saying openly what a free check cannot see.

A free first step before any offer

Before you even ask for an offer, it is worth having a rough picture of what is happening. A free quick scan reviews the publicly available content of the site and looks for known malware patterns, hidden scripts, and redirects. No account, no installation, usually under a minute. That gives you a starting point for talking about price, because you already know whether something is visible from the outside.

The limit is the same as always, and it is worth saying openly. That check sees only publicly available content, so it cannot measure the full scope of an infection that hides in files and the database. That is why the exact price is confirmed only after a real look, not on the basis of a remote check.

With us, prices are orientation amounts and start from a clearly stated figure, and we confirm the exact amount after a short look, before we start the work, so there are no surprises at the end. If you want an estimate for your concrete case, write to us with the site address and a short description of what is happening, and we will tell you what makes sense and roughly how much it would cost.