WordPress malware removal: do it yourself, or pay someone?

We sell cleanups, so treat this with the appropriate scepticism. But plenty of people should do this themselves, and telling you otherwise would be a bad way to earn $249.

Here is the actual comparison.

Doing it yourself

Cost: nothing, plus four to twelve hours depending on how much you already know.

You need to be comfortable with: SFTP or SSH, phpMyAdmin or WP-CLI, reading PHP well enough to recognise obfuscated code, and your hosting control panel.

The process is documented in full here, and it is genuinely doable. The steps are not secret and the tools are free.

Where people get stuck, in order:

1. Finding the entry point. Cleaning is mechanical. Working out how they got in is the judgement part, and without it you will be doing this again within weeks.
2. The reinstaller. A scheduled task or a file outside the WordPress folder that restores the payload. Miss it and the infection returns looking like the clean failed.
3. The database. Injected code in wp_options and wp_postmeta is easy to overlook and easy to break things while removing.
4. Knowing when it is actually clean. A scanner reporting nothing is not proof, particularly for hacks that only show themselves to Googlebot.

Paying someone

Cost: $100 to $500 depending on the provider. Ours is $249. Emergency and same-day options run higher.

What you should get for it: a backup taken before anything is touched, file and database cleaning, the entry point identified and closed, credentials rotated, blacklist removal requested, a plain-English report, and a re-infection guarantee.

What to check before paying anyone:

• Is there a guarantee, and what voids it?
• Do they find and close the entry point, or only clean?
• Will they tell you what happened, or just say "done"?
• Do they need hosting access? (If they say no, be sceptical — a lot of malware lives outside WordPress.)
• Is the price fixed, or hourly and open-ended?

Which one is you

Do it yourself if: the site is small, you are comfortable with SFTP and databases, it does not directly earn you money, and you can afford a day on it.

Pay someone if: the site earns you money and is currently down or flagged, you have already cleaned it once and it came back, your host has suspended you, you cannot find the entry point, or the time cost simply exceeds the fee. If your hour is worth $50, a six-hour cleanup costs you $300 in time — more than paying for it.

Rebuild instead if: the site is on an ancient WordPress version with abandoned plugins, or you have no backup and no documentation. Sometimes cleaning an old site costs more than replacing it, and an honest provider will tell you so.

The part that matters more than either

Whichever you choose, the cleanup is the smaller half. A site that gets hacked once and then goes back to being unmaintained gets hacked again — usually through the same plugin, usually within a few months.

The fix is unglamorous: update weekly, remove what you do not use, watch for disclosed vulnerabilities, keep off-site backups. That is four hours a month of dull work, and it prevents nearly everything on this page.

If you would rather not do it, that is what our care plans are — from $79 a month, with cleanup included free if it ever happens while you are covered. If you want the cleanup now, it is $249 with a 30-day guarantee. And if you just want to know where you stand before deciding anything, the free plugin will tell you.