A hacked site cleaned, and why it got hacked

An agency sent over a customer site that had gone down after a compromise. I cleaned it for a fixed price and told them plainly what had let it in, so it wouldn't just happen again.

The objective

This client resells web work and sends customer sites my way when something breaks. This one was down, and the customer behind it was a business that needed it back.

They asked two things in the same message: what it costs to fix, and how to stop it happening again. Cleaning a site doesn't, on its own, stop it getting reinfected, so the second question is the one worth a real answer.

What I did

I cleaned the compromised site and got it serving again.

I quoted a fixed price for the cleanup rather than an hourly rate, since you can't know the real floor on that kind of work until you've looked.

Then I named the cause plainly. Themes and plugins pulled from resale sites instead of their actual authors, extensions left unupdated for ages, and plugins that hadn't had a release in years. I told them to run security software rather than count on somebody noticing.

When I wasn't going to be available, I said so rather than sitting on the job, because the client had a customer waiting on it.

The result

The site came back for a flat twenty-five dollars. That client and I have done twelve orders between 2020 and 2025, across site builds, server work, transfers and cleanups.