What a Rebuild Costs vs What a Hack Costs

As of 23 October 2026, the most useful published figure for a small business is a median, not an average. Verizon's 2026 Breach Impact Study puts the median cyber-insurance claim for small and midsize businesses (under $25 million in revenue) at about $38,000. IBM's widely quoted $4.99 million is a global average across organizations of every size. On the other side of the ledger, eSEOspace publishes website maintenance plans from $250 a month and says "custom projects typically start at $3,000."

So is a rebuild cheaper than a hack? Often, but for most sites that is the wrong comparison. A rebuild does not make a site unhackable, and most sites don't need one. What a rebuild buys is a foundation you can keep patching. A hack has no price tag. It is a range of outcomes with a long, expensive tail. The real choice is usually between paying a known amount to keep a site current and accepting an unknown amount if it isn't.

PHP2Shell, the two critical PHP engine flaws fixed on 21 October 2026, made this concrete. Sites on supported PHP needed an update and a restart. Sites on PHP 8.1 or older had no official release to install. This page sets the published numbers side by side, with each source's year and method, so you can decide with your own figures.

What the Breach Cost Studies Actually Measure

Every headline number below is real, and each measures something different. Read the method before you use the number.

Don't add these together or compare one with another. IBM uses averages, Verizon's claims study uses medians, and the FBI counts self-reported complaints. They answer different questions.

Why the Average Misleads a Small Business

An average adds every case and divides by the count, so a handful of very large breaches pull it up. A median is the middle case: half of claims cost more, half cost less. For a small business, the median is closer to what a typical bad day looks like.

Verizon's claims study breaks the median down by size:

• Small and midsize businesses (under $25 million revenue): about $38,000.
• Mid-market: about $96,000.
• Large enterprise: about $283,000.

The tail matters more than the middle. Verizon says the impact reached "as high as 3% of revenue in the top 10% of cases and over 7% in the more extreme top 2.5%" for small businesses. As an illustration only: for a business with $2 million in annual revenue, 7% would be $140,000. The study also shows costs rising. Comparing 2019 with 2024, the median claim went "from roughly $60,000 to roughly $110,000."

One limit to keep in mind: these are claims that insurers paid. If you have no cyber insurance, or a loss falls outside your policy, your cost is not in that number at all.

What a Website Hack Actually Costs You

The invoice for a cleanup is usually the smallest line. Our guide to what it costs to fix a hacked website explains why. Here are the costs that actually add up, without made-up price ranges:

• Cleanup and finding the way in. Removing malware is one job. Finding how the attacker got in, so it doesn't happen again, is another.
• Downtime and lost leads. Every day the site is offline or flagged by a browser warning is a day of lost inquiries and sales.
• Search recovery. Spam pages and warnings can drag rankings down long after the cleanup. See recovering your rankings after a hack.
• Secrets and accounts. After a PHP compromise, Bitdefender advises rotating "the secrets the PHP process could read: application database credentials, API keys in environment variables or configuration files, and cloud credentials present on the host."
• Notification and legal advice. If personal data was exposed, notice duties may apply. NCSL says all 50 states have breach notification laws, though its page was last updated in January 2022, so check your state's current statute. This is general information, not legal advice.
• Ransom and recovery. Verizon's DBIR says ransomware appeared in 48% of breaches and that small organizations are "disproportionally impacted." Good backups decide how bad this gets. See backups: the control that decides how bad it gets.
• Your team's time. Hours spent on an incident are hours not spent on the business.

What eSEOspace Publishes About Its Own Prices

Here is exactly what our pricing page says, as read on 23 October 2026. "Every plan includes proactive website maintenance, security, monitoring, updates, and technical oversight." There is no separate security tier.

For rebuilds and other custom work, the page says: "No obligation — custom projects typically start at $3,000." That is a starting point, not a quote. The final price depends on the size of the site, the content and the features. The page also says "Nothing is locked into a long contract."

What the page does not publish: a price for hack cleanup, incident response or emergency patching, or an hourly rate. We won't quote one here either.

Side by Side: Known Costs vs Published Loss Figures

With those caveats, here are the numbers in one place. The 12-month figures are simple multiplication of the published monthly prices.

Two honest limits. First, these are different kinds of numbers: a price you choose to pay, and losses spread across thousands of other organizations. Second, we found no study that measures how much a rebuild or a maintenance plan lowers the chance of a breach, so we won't put a percentage on it. What the table does show is scale. A typical small-business claim is several times a basic rebuild's starting point, and the bad tail is far larger.

How PHP2Shell Changed the Math for Sites on Old PHP

For a site on PHP 8.2 or newer, PHP2Shell cost an update and a restart, usually done by the host. For a site on PHP 8.1 or older, the options narrowed. The PHP project published source-only backports for 7.4, 8.0 and 8.1 but no official releases. CISA's 21 October alert said organizations that "continue to use PHP 8.1 or earlier unsupported versions, should take PHP-based systems offline until they can be patched or updated."

Going offline is a cost too. Reuters reported government websites across Europe going dark on 21 October as operators raced to patch. The reports describe precautionary takedowns, not attacks. For a business, a day offline is a day of lost leads, whether or not anyone breaks in.

The wider data points the same way. Verizon's 2026 DBIR says "Exploitation of vulnerabilities is now the most common initial access vector for breaches," at 31%, and 26% for small businesses. CISA, citing the same report, says only 26% of vulnerabilities in its Known Exploited Vulnerabilities catalog "were fully remediated by organizations in 2025," with a median of 43 days to full resolution. An old foundation makes every patch slower, and slow patching is how many breaches start.

The deadline keeps moving. PHP 8.2 gets security fixes only until 31 December 2026, according to the PHP supported versions page. If your site can't run on 8.3 or newer, start with how to upgrade old PHP safely. If you're worried something already happened, check first using how to tell if PHP2Shell hit your site.

When a Rebuild Is the Cheaper Choice, and When It Isn't

Our guide to patch, harden or rebuild has the full decision table and a phased plan. The cost view comes down to this.

A rebuild tends to cost less over time when:

• The site can't run on a supported PHP version without major code changes.
• Key features depend on plugins or modules nobody maintains.
• You are already paying for a redesign, an accessibility overhaul or a move to a new host or CMS.
• No one can tell you what is installed or who can log in.

Patching and maintenance cost less when:

• The site runs supported PHP, a current CMS and maintained extensions.
• The problem is one known flaw with a fix available, as PHP2Shell was for supported branches.
• Updates simply haven't been applied. Paying someone to apply them on schedule is cheaper than any rebuild.

One rule applies either way. A rebuild does not clean a site that is already compromised. Check for compromise first, and when you do rebuild, move content, not code.

Build Your Own Estimate in 30 Minutes

Published averages are a starting point. Your own numbers decide it.

1. Price a day offline. Estimate the leads or sales your site brings in on a normal day. Multiply by a few days of downtime and a few weeks of reduced search traffic.
2. List the data the site holds. Contact forms, customer accounts, patient or client details, payments. The more personal data, the more likely notice duties apply.
3. Read your insurance policy. Check whether it covers website incidents, the deductible and what the insurer requires you to do first.
4. Check your backups. Is there a clean copy stored away from the site, and has anyone tested a restore?
5. Note the support dates. Write down your PHP version, your CMS version and when each stops getting security fixes.
6. Get two quotes. One to keep the current site patched and maintained, one for a rebuild. Compare both with your downtime number and with the $38,000 small-business median.

If the numbers point to staying put, our guide to PHP2Shell for small business owners covers what to do this week.

Conclusion

A rebuild has a price you can see. A hack has a range: a small-business median of about $38,000 in Verizon's insurance data, a tail that can exceed 7% of revenue, and IBM's $4.99 million global average at the top end. Neither number tells you what your site needs. If you're on supported PHP and current software, keep it patched, which costs far less than either. If PHP2Shell showed that your site is stuck on PHP 8.1 or older, price the rebuild now, before the next flaw makes the decision for you. If you need the immediate fix first, our emergency PHP patching team can patch, restart and verify. Every PHP2Shell guide is in our PHP2Shell Resource Center.

Frequently Asked Questions