PHP2Shell, October 2026: two critical flaws in PHP itself (CVE-2026-109618 and CVE-2026-109619) were fixed on 21 October 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Any site running on PHP needs the server updated. See our PHP2Shell Resource Center.
The honest answer is that the cleanup is rarely the expensive part. What costs money is how long the site was compromised before anyone noticed, and what that time did to your traffic and your customers.
This page is about how to think about the number, because the range quoted for "malware removal" hides most of what actually determines it.
What the published plans tell you
The mainstream security vendors publish their pricing, and reading it carefully is instructive. Sucuri, for example, sells its Security Platform in annual tiers at $229, $339 and $549 a year, and every tier includes unlimited manual cleanups.
So the cleanup is not what separates the tiers. What separates them is the first response time: 30 hours on the entry plan, 12 hours in the middle, 6 hours at the top. The premium is for how long you wait while your site is serving malware to your customers.
That is the right way to read every emergency quote you receive. You are buying a response window.
What actually drives the cost
How long it ran. A site cleaned the same day is a technical job. A site that quietly served cloaked spam for four months is a technical job plus a search recovery, and the second is bigger.
Whether money moved through it. A card skimmer changes the category entirely. There are notification obligations and potentially a forensic investigation whose scope you do not control. See card skimmers and cryptojacking.
Whether the entry point is findable. Most compromises come through something known and unpatched, which is quick to identify. A cleanup where nobody can establish how they got in is open-ended, because it will happen again.
Whether there is a usable backup. A clean backup from before the compromise turns hours of forensic file comparison into a restore. Sites without one pay for the difference. Website backup and recovery covers what actually restores.
How much custom code there is. A stock installation can be compared against known-good core files. A heavily customised site cannot, and every custom file has to be read.
The costs that are not on the invoice
These usually exceed the cleanup fee, and they are the reason speed is worth paying for.
Traffic lost while a browser warning is showing. A warning does not reduce your traffic, it very nearly ends it for as long as it stands.
Rankings that do not return by themselves. Covered in recovering rankings after a hack.
Time. Yours, and your team's, spent on this instead of the work you had planned.
Customer trust, which is real but resists a number.
Doing it yourself
Viable, in specific circumstances: you have a clean pre-compromise backup, the site is not taking payments, you can identify how they got in, and nothing has been indexed. Then the cost is your time and the sequence in how to remove malware from your website.
Less viable when payments are involved, when you cannot find the entry point, or when the compromise has been indexed — because at that point the cleanup is the smaller half of the work.
What to ask before you pay anyone
Ask what the response time is, in hours, and what starts the clock. Ask whether the price includes finding the entry point or only removing the payload. Ask what happens if the site is reinfected the following week, and whether that is covered. Ask whether search recovery is included or whether the engagement ends at a clean scan.
That last question is the one that most often separates a quote that looks cheap from a quote that is.
If you have not yet worked out what you are dealing with, start at the triage guide.
