Reviewed by Nick Oakley, Head of Digital
Nicada Digital has built and looked after more than 800 websites since 2014, almost all of them on WordPress. Hosting is the part clients never see and always feel.
Finding out your website has been hacked is horrible. Customers see warnings, Google may flag the site, and you do not know what has been changed. The good news is that this is common and fixable.
This guide covers what to do first, what professional clean-up costs, and the hosts that include it at no extra charge.
Our affiliate links
We are affiliates for WPX, SiteGround and Kinsta and earn a commission if you buy through our links. We are not affiliates for any of the security companies here. Prices were checked on each company's own site on 1 October 2026.
Signs Your Site Has Been Hacked
WordPress.org lists these as the usual signs:
- Google, Bing or your browser shows a warning before visitors reach the site.
- Your hosting company has suspended the site.
- The site is flagged for spreading malware or attacking other sites.
- Visitors' antivirus software warns them off.
- There are admin users, pages or changes you did not make.
- You can see odd content, spam links or redirects to other sites.
What to Do in the First Hour
Based on WordPress.org's "my site was hacked" guidance:
- Stay calm and write things down. What did you see, and when?
- Tell your hosting company. They may already know, and some will clean it for you.
- Back up the site as it is, infected or not. You may need it later.
- Change every password: WordPress admin, hosting account, FTP and database. Turn on two-factor login.
- Scan the site with a tool such as Wordfence or Sucuri SiteCheck, and scan your own computer too.
- Check Google Search Console for security warnings.
- Clean the site, or get someone to. Then ask Google to review it so the warning is removed.
What Malware Removal Costs
| Service | Price | What you get |
|---|---|---|
| Sucuri one-time clean | $98 per site | One clean, first response within 30 hours. Does not cover re-infection. |
| Sucuri Basic | $229 a year | Unlimited manual clean-ups, firewall and monitoring. |
| MalCare Repair | $299 a year | Clean-up included, expert response within 24 hours. |
| Wordfence Care | $590 a year | Hands-on security service including clean-up. |
| SiteGround Malware Cleanup | About £100 | 2 Expert Care credits at £50 each without a subscription. |
| Jetpack Scan | £3.95/mo year one, then £7.95 | Automated scanning and one-click fixes, not a human clean. |
| WPX hosting | Included in every plan | Daily scans and clean-up by WPX's security team. |
Sucuri, MalCare and Wordfence prices are in US dollars, per site, per year unless stated. The SiteGround figure is our sum from its own price list.
Hosts That Clean It Up for Free
The cheapest way to deal with malware is to be with a host that cleans it up as part of your plan.
WPX: malware removal on every plan
WPX scans every site daily and its security team removes malware at no charge. After cleaning, it tells you where the infection came from, if it can trace it, and what to do next. Its Business plan is $24.99 a month paid yearly, and it moves your site across for free, scanning it for malware on the way in.
The conditions, in fairness: WPX expects you to keep WordPress, plugins and themes updated, and will not clean sites using cracked ("nulled") plugins. If you ignore its advice or refuse to remove a clearly vulnerable plugin, it can decline, give you 7 days to clean the site yourself, and then take it offline. That is reasonable: it is protecting everyone else on its servers.
Hacked? Move to a host that cleans it up
WPX includes malware scans and removal on every plan, and moves your site for free. If it is infected, they clean it during the move. 30 days to change your mind.
See WPX Plans →Already sure? Pay yearly. You get two months free.
Affiliate link. We earn a commission if you buy, at no extra cost to you.
Kinsta
Kinsta also includes free malware removal on all plans. Its entry Launch plan is $35 a month, or $30 paid yearly, for one site. See Kinsta alternatives for how it compares.
SiteGround
SiteGround scans for malware and has strong security, but clean-up is a paid extra: either its paid Site Scanner Premium (one-click clean-up, with "an additional clean up fee" possible if that fails) or its Malware Cleanup service. See WPX vs SiteGround.
How Sites Get Hacked
Most hacked WordPress sites are broken into in the same few ways:
- Out-of-date plugins or themes. By far the most common. A known weakness gets published, and automated bots find every site that has not updated.
- Cracked "nulled" plugins. Free copies of paid plugins often come with malware already inside.
- Weak or reused passwords, especially without two-factor login.
- Old, forgotten sites on the same hosting account, which infect the live one.
How to Stop It Happening Again
- Update WordPress, plugins and themes every week, or turn on automatic updates.
- Delete plugins and themes you do not use.
- Never install cracked plugins.
- Use strong, unique passwords and two-factor login for every admin.
- Keep daily backups somewhere you can restore in one click.
- Choose a host that scans daily and cleans up if the worst happens.
Or hand the whole thing over: our website care plans include hosting, updates, backups, monitoring and fixes.
Frequently Asked Questions
How do I know if my WordPress site has been hacked?
Common signs, from WordPress.org's own guidance: Google or your browser warns visitors away, your host suspends the site, you find admin users or pages you did not create, visitors' antivirus software complains, or you can see strange content or redirects on the site.
How much does WordPress malware removal cost?
A one-off clean from Sucuri is $98 per site. Yearly plans that include clean-ups cost from $229 (Sucuri) to $590 (Wordfence Care). SiteGround's paid Malware Cleanup costs 2 of its Expert Care credits, about £100 without a subscription. Some hosts, including WPX and Kinsta, include malware removal free.
Can I remove malware from WordPress myself?
Sometimes. WordPress.org's guide covers scanning, changing every password, reinstalling WordPress core files and checking key files. But hidden backdoors are easy to miss and the site can be re-infected. If the site matters to your business, a professional clean or a host that includes it is safer.
Which hosts include free malware removal?
WPX includes malware scans and removal on every plan, and so does Kinsta. SiteGround scans for malware but charges for clean-up. Always check the conditions: WPX, for example, expects you to keep plugins updated and will not clean sites using cracked plugins.
How do I stop my WordPress site being hacked again?
Keep WordPress, plugins and themes updated, delete plugins you do not use, never use cracked or 'nulled' plugins, use strong unique passwords with two-factor login, and keep daily backups you can restore.