If your WordPress website has been hacked, the first decision is not whether to redesign it. It is whether you can safely recover the existing site, what evidence must be preserved, and whether the underlying installation can be trusted again.
For a Nigerian business in 2026, my initial project-scoping allowances would be ₦150,000–₦450,000 for a contained cleanup, ₦450,000–₦1.2 million for a business-critical recovery with deeper investigation and testing, and ₦900,000–₦3 million+ for a controlled replacement of a compromised or unmaintainable website. These are illustrative planning bands, not surveyed market averages or fixed quotes. A specialist incident investigation, data-breach response or complex WooCommerce restoration can cost substantially more.
The important question is: what would you need to prove before customers should trust the site again?
First, confirm what has actually happened
A broken WordPress website is not necessarily hacked. A failed update can cause a white screen; a DNS mistake can redirect visitors; a compromised account can create spam pages without visibly changing the homepage.
WordPress’s official hacked-site guidance describes warning signs such as unauthorized users, malware alerts, unexpected changes and hosting-provider suspensions. Google’s Security Issues report can identify certain malicious pages or deceptive behavior, but an empty report is not proof that the entire installation is safe.
If you suspect active compromise, contact your host and a qualified security professional promptly. Consider temporarily disabling checkout, account registration or other sensitive transactions until the risk is assessed. Do not keep taking payments simply because the homepage still loads.
What does hacked WordPress recovery cost in Nigeria?
| Recovery scope | My initial planning allowance | What the quote should cover |
|---|---|---|
| Contained cleanup | ₦150k–₦450k | Diagnosis, affected-file cleanup or trusted restore, credential rotation, essential verification |
| Business-critical recovery | ₦450k–₦1.2m | Wider investigation, account and hosting review, persistence checks, WooCommerce/form testing, monitoring and handover |
| Controlled website rebuild | ₦900k–₦3m+ | Clean replacement, content/data migration, URL preservation, customer-journey testing and deployment |
| Specialist incident response | Separately scoped | Forensics, potential data exposure, regulatory advice, multiple affected systems or legal evidence requirements |
A small informational site with a verified clean backup can be much cheaper to restore than a shop with orders, customer accounts, abandoned plugins and no reliable backups. Conversely, a high quote is not automatically evidence of a better cleanup. Ask what will be inspected and how the result will be verified.
These bands describe how I would frame a project conversation, not a promise to personally perform specialist digital forensics. Where compromise involves sensitive records or suspected data theft, a qualified incident-response and privacy team should lead that work.
Clean the existing website or rebuild it?
Recover the current installation when you have a trustworthy recovery point, can identify and close the entry point, control the hosting and administrator accounts, and can test the important functions after cleanup.
Consider a controlled rebuild when reinfection keeps recurring, the original developer or hosting account is inaccessible, the theme and plugins are abandoned, the site contains extensive undocumented modifications, or the existing architecture is no longer safe to maintain.
A rebuild does not automatically remove a compromise. Importing infected files, unsafe plugins or compromised credentials into a new installation can reproduce the problem. A new design is not a security control.
| Decision | Cleanup and hardening | Rebuild and migrate |
|---|---|---|
| Best fit | Sound website with a bounded, diagnosable compromise | Untrusted or obsolete implementation |
| Main risk | Missing persistence or the original entry point | Reintroducing infected assets, losing content or breaking URLs |
| What to preserve | Clean content, legitimate accounts, orders, site configuration | Verified content and business records, important URLs, domain ownership |
| Proof of completion | Repeat scans, permission review, key journeys tested | Clean environment, migration checks, redirects, end-to-end tests |
If the problem is a non-security malfunction, my general website repair cost guide is the better starting point.
What a responsible recovery project should actually include
1. Preserve evidence and regain control
Record the first symptoms, affected URLs, warning messages and approximate times. Have the host preserve relevant logs and a protected snapshot where feasible before destructive changes. WordPress specifically recommends documenting indicators and taking a backup even when the current state may be infected.
Review ownership of the domain, DNS, hosting, WordPress administrators, email, payment gateway and backup storage. Change or revoke compromised credentials through trusted devices and access channels, with an appropriate sequence agreed by the incident responder.
A business should not discover during an emergency that the only person who can access its domain is an unavailable freelancer. My website ownership guide explains what should remain under the business’s control.
2. Establish a trustworthy recovery source
A backup is useful only if it is complete, recoverable and old enough to predate the compromise. Check both the database and files. WordPress’s database backup documentation explicitly distinguishes database backups from themes, plugins, uploads and configuration files.
Before restoring, determine how the attacker entered. Otherwise the same vulnerable component or credential can compromise the restored site again. A professional should also check unauthorized users, scheduled tasks, redirects, uploads and other possible persistence mechanisms.
3. Verify the journeys that earn money
For a service business, test a real enquiry from mobile submission through receipt in the business inbox. For a hotel, test availability requests and booking confirmation. For a WooCommerce store, test product pages, checkout, payment verification, order creation, notification delivery and refunds where relevant.
This is where my product-building approach is useful: a successful deployment or clean-looking homepage is not proof that the complete business workflow works. The acceptance test should cover both successful and failed states.
4. Repair search visibility without destroying useful URLs
Hacks can create spam URLs, malicious redirects or Google security warnings. Check Search Console, inspect affected pages and remove injected content across the site rather than fixing only the homepage.
Google’s Security Issues documentation says to fix all reported issues, test the repairs and then request a review. That review can take days or weeks. No provider should guarantee an immediate removal of Google’s warning.
If a rebuild changes URLs, map important existing pages to appropriate destinations. Follow Google’s site-move guidance and my SEO migration checklist rather than deleting indexed pages and hoping Google adjusts.
5. Close the incident with documented ownership
The handover should include what was found, what changed, which credentials were rotated, what could not be verified, which pages and workflows passed testing, the location of clean backups, and who monitors the site afterwards.
Ongoing support is a separate purchase. See my website maintenance cost guide if you need a recurring plan after recovery.
How to compare recovery quotes without buying false reassurance
Ask every provider to answer the same questions:
- Is this a confirmed compromise, or is diagnosis still needed?
- What evidence and backups will you preserve before modifying production?
- Which accounts, plugins, databases, files and hosting layers are in scope?
- How will you identify and close the entry point, not just remove visible spam?
- Who handles suspected customer-data exposure or specialist incident response?
- How will you test forms, payments, bookings and email delivery after recovery?
- Will you inspect Search Console security issues and document the review process?
- What happens if the infection returns, and what follow-up monitoring is included?
A quote that says only “remove virus and install security plugin” leaves too many questions unanswered. A good proposal separates diagnosis, containment, recovery, verification and ongoing support, with exclusions clearly stated.
What to send when requesting help
Share the website URL, symptoms, when you first noticed them, any host or Google warning, whether you still control hosting and domain accounts, whether you have backups, and which business functions are affected. Do not send passwords, secret keys or customer records in the initial message.
If your site has been compromised and you need to decide whether a controlled recovery or rebuild is the sensible investment, tell me what happened. I can help scope the website, ownership, migration and business-workflow side of the project, and identify when specialist security investigation is necessary. If a clean replacement is already the right decision, see my web design service.
The goal is not merely to make the website appear normal again. It is to restore a business system that customers and staff can safely depend on.
