There is no reliable fixed price for recovering a hacked website. The cost depends on what was accessed, how long the compromise lasted, the backup state, the hosting arrangement and whether customer data or connected systems were involved. An accurate estimate starts with evidence, not a headline package.
Key takeaways
- Containment and investigation come before a confident recovery estimate.
- Downtime, staff time and disrupted enquiries may matter as much as technical cleanup.
- Get qualified privacy and legal advice if personal data may be affected.
What recovery work can involve
The response may include preserving logs and a clean copy for investigation, restricting compromised access, identifying the entry path, removing unauthorised code, restoring trusted files and data, updating exposed credentials, and checking the site and server after recovery. The work depends on the incident. Reinstalling WordPress alone may leave the original weakness or a separate persistence method in place.
Ask the responder to define the scope: what systems will be checked, how evidence will be retained, what counts as clean, which third parties must act, and what follow-up monitoring is included. A low initial quote may cover only one part of that work. Compare scope and recovery conditions, not just price.
Consider the wider business impact
Record unavailable services, missed orders or enquiries, staff hours, emergency supplier work and any customer support required. These are possible impacts, not guaranteed losses. Measure them from your own records rather than applying generic multipliers.
If personal data may have been exposed, preserve the facts and involve the organisation’s privacy lead and qualified legal adviser. Reporting and notification duties depend on the circumstances and current Malaysian requirements. Do not infer a fine or legal outcome from the presence of malware alone.
Reduce repeat risk
After recovery, confirm the entry path has been addressed, remove unnecessary accounts, rotate affected credentials, restore supported software, review administrator access and test backups. Agree who owns updates, monitoring and incident escalation. Keep a dated incident record so later decisions can be checked against evidence.
WordPress.org’s hacked-site guidance recommends documenting symptoms and actions as part of response. A clean-up is not complete until the site and its important business journeys have been checked.
Common questions
Does every hacked site need to be rebuilt?
No. The response depends on the access gained, changes made, evidence available and ability to verify a clean state. A specialist can assess whether restoration or rebuilding is appropriate.
Can a security plugin calculate the recovery cost?
No. A scanner may identify indicators, but it cannot establish the full scope, business impact or legal duties by itself.
What information helps obtain a useful estimate?
Share the symptoms, times, recent changes, hosting and backup details, affected accounts and known business impact through a secure channel. Avoid posting credentials or sensitive logs publicly.