Your site is showing a warning, or redirecting somewhere strange, or your host has just suspended it. You have started searching, and every result wants your credit card before it tells you a number.
So here are the numbers. All of them, including the ones that mean you do not have to pay me.
The short answer
A one-off WordPress malware cleanup runs roughly $100 to $1,000, depending on how bad it is. Most ordinary infections land between $150 and $300. Annual security services with cleanup included cost $229 to $549 a year. Freelancers on Upwork charge $30 to $40 an hour for this work.
If your site is small, your backups are recent, and the infection is simple, you can often fix it yourself for nothing. That is a real option and I will explain when it applies.
Option 1: Do it yourself, free
Install Wordfence, which is free or you can run free scan here enter your website url and select malware scanner and then put ftp or sftp creds those all not save anywhere just used for connection that will scan you website all files and database scan. It will show you which files have been modified or added. Replace WordPress core, every theme and every plugin with fresh copies from source. Change all passwords, including database and hosting. Check your admin user list for accounts you did not create.
This works when: the infection is recent, you have a clean backup from before it happened, your site is not an eCommerce store, and you are comfortable in cPanel and phpMyAdmin.
This fails when: you clean the visible files but miss the backdoor. This is the single most common outcome, and it is why people come to me a fortnight later with the same infection back. Malware almost always leaves a way back in. A modified wp-config.php, a rogue admin account, a scheduled task, an injected database row. Removing what you can see is not the same as removing what is there.
Honest verdict: if you have backups and a simple site, try it. You have nothing to lose except an afternoon. If the infection returns, you now know it is deeper than a file scan.
Option 2: A plugin with cleanup included, $99 to $549 a year
The two names you will see everywhere:
MalCare does scanning only on the free tier. Protect is $99/year and still does not include removal, which catches a lot of people out. Repair at $299/year is the first tier that actually cleans your site, with a 24-hour expert response. Fortify is $499/year with a 6-hour response.
Sucuri Platform plans start at $229/year and include unlimited manual cleanups on every tier. Pro is $339 and Business is $549, with the difference being mainly how fast they respond. Their firewall-only plans at $9.99/month include no cleanup at all, worth knowing before you buy the cheap one.
Where this is genuinely good value: you are paying for cleanup and ongoing protection and a firewall, for a year. If your site gets hit repeatedly, or you run something that is an obvious target, this is cheaper than paying per incident.
Where it disappoints: you are in a queue. Response times are measured in hours, and on the lower tiers up to a day. If your site is a shop losing orders every hour it is down, the wait costs more than the plan saved you. And these are automated cleanups first, so genuinely unusual infections still get escalated to a human, which takes longer again.
Option 3: A freelance developer, $100 to $400 per incident
This is what I do, so read this section knowing that.
Live rates on Upwork for WordPress malware work sit at $30 to $40 an hour. Codeable puts one-off removals at $100 to $1,000+ depending on complexity. Most straightforward infections are three to six hours of work.
What you are actually buying is someone looking at your site rather than running a generic scan against it. A person can tell the difference between a file that looks odd and a file that is odd, can trace how the attacker got in, and can tell you afterwards which plugin let them in so it does not happen again.
Where this is right: the site is down or losing money now, the infection has come back after a previous cleanup, it is a WooCommerce store, or your host has suspended you and you need someone who can talk to them.
Where it is overkill: a small brochure site with good backups and a first-time, obvious infection. Try option one first.
Option 4: An agency, $500 to $2,000+
Worth it for large sites, multi-site networks, anything with compliance requirements, or when the hack involves customer data and someone needs to write the incident report. For a normal small business website, you are paying for account management you do not need.
What actually costs you money
Here is the part nobody selling cleanup mentions: the cleanup is rarely the expensive bit.
Google blacklisting. Once Google flags your site as harmful, visitors get a full-page red warning before they reach you. Removing that flag requires cleaning the site, then requesting a review, then waiting. Your organic traffic is gone for that entire period.
Host suspension. Most hosts suspend an infected site rather than clean it. Your site, and often your email, goes dark until you prove it is clean.
Repeat infection. If the backdoor survives, you pay twice.
A $200 cleanup that happens today is almost always cheaper than a $99 plan that gets to you tomorrow. Speed is most of the value.
So what should you actually do
Small site, good backups, first infection, not urgent. Try it yourself. Wordfence, fresh files, new passwords. Free.
You want protection as well as cleanup, and a day’s wait is fine. Sucuri at $229/year or MalCare Repair at $299/year. Reasonable value.
Site is down, money is being lost, or it has been infected before. Hire a person. $100 to $400, done today, with an explanation of how it happened.
Large or regulated site, or customer data involved. An agency.
How I work on these
I built my own malware detection and activity-logging plugins, which means I usually know what I am dealing with within the first half hour rather than the first afternoon. Diagnosis is normally same-day.
Every cleanup I do includes finding the entry point, not just the payload. You get told which plugin or credential let them in, and what to change so it does not repeat. After cleanup I install activity logging so that if anything does change on your site again, there is a record of what, when and by whom, which is the question everybody asks after a hack and almost nobody can answer.
If your site is currently down or flagged, send me a message. I usually reply within five minutes, and I will tell you honestly if this is something you can fix yourself for free.
If it is broken in a more ordinary way, such as a white screen, a plugin conflict or forms not sending, that is my bug fix and emergency support service.
Common questions
How much does it cost to remove malware from WordPress?
Between $100 and $1,000 for a one-off cleanup, with most ordinary infections at $150 to $300. Annual services with cleanup included run $229 to $549. Freelance rates are $30 to $40 an hour.
Can I remove WordPress malware for free?
Often, yes. A free Wordfence scan plus replacing core, theme and plugin files with fresh copies clears many infections. The risk is missing the backdoor, in which case it returns within weeks.
How long does WordPress malware removal take?
A straightforward infection is three to six hours of work and can usually be done the same day. Removing a Google blacklist flag afterwards takes longer, because that depends on Google’s review queue.
Will it come back?
Only if the entry point is still open. Any cleanup that does not identify how the attacker got in is incomplete, however clean the files look afterwards.
The honest bottom line
Malware removal is not expensive work. It is urgent work, and urgency is what people end up paying for.
If you have time and backups, spend an afternoon and keep your money. If your site is down and every hour is costing you customers, pay someone to fix it today, and make sure whoever you pay tells you how it happened, not just that it is gone.
