WordPress incident response
We clean hacked WordPress sites for anyone we can reach. Brochure sites, membership sites, and stores that need to stay online while we work. Hosting can be ours or yours. Johnson City is the office, not a limit.
People who need the site cleaned carefully, not wiped and rebuilt. Larger installs, several staff logins, or a store that should keep taking orders. Boards and Google want a written report, not “should be good now.”
If you have a small personal site and a host-included cleanup is enough, say so when you call. We will tell you if a lighter option fits. The published rates below are for a full incident-response job.
Fixed packages, not an open timesheet. A more complex site can land higher in the range. Existing clients and nonprofits may receive a courtesy off these rates — ask when you call.
From $2,500 typical $2,500–$4,500
Identify what was planted, full backup of files and database, remove malicious material, restore hijacked pages, written report you can show a board, insurer, or Google. We check the homepage (and the store) before we call this phase done.
We do not replace the whole database to chase a keyword. We do not update every plugin in one click. We do not take the whole site offline because one inner page was spam.
From $2,000
Cleanup is not the same as “it cannot happen again.” Phase B resets remaining administrator passwords, changes host-side secrets we can reach, turns off the in-dashboard file editor, blocks a common remote-login door, adds login protection, patches low-risk plugins, and can add monitoring if the same files return.
From $4,200
Cleanup and hardening in one engagement. Recommended after a real compromise.
Not included in the starting rates (quoted separately): rotating keys that exist only in your Amazon or Google account, requesting a Google recrawl once you can open Search Console, and large plugin upgrades that can change how the site behaves.
Most of this work is remote. We need access to the site files and database — not a street address. Onsite is available in the Tri-Cities and Western North Carolina. Ongoing hosting and Linux/VPS care live on the Linux & VPS page. If the WordPress site is the front door to a larger business compromise, that is emergency incident response.
Tri-Cities 423-888-0252 · Western NC 828-484-1257
