Every care-plan agreement has a sentence about security, and almost none say what happens when a site actually gets hacked. That silence is where agencies lose money: a cleanup is 3 to 8 hours of unplanned work, and the client thinks it was covered. Here is how to price it on purpose, with the arithmetic.
What a cleanup actually costs you
Before you price anything, time one. A cleanup on a typical brochure site runs roughly like this: 30 minutes to confirm the infection and put the site behind a holding page; 1 to 2 hours to find the entry point and the payloads (modified core files, a rogue admin user, a backdoor in uploads, injected database rows); 1 hour to clean or restore from the last known-good backup; 30 to 60 minutes to rotate every credential (WordPress users, database, SFTP, hosting panel, API keys); 30 minutes for blacklist reviews; and 30 to 60 minutes to write it up for the client.
Call it 4.5 hours on a good day, 8 on a bad one with reinfection. At a fully loaded cost of $50 an hour, that is $225 to $400 of your time per incident, before any tool you pay for or any outside cleanup service you bring in.
Now the frequency. Across 60 reasonably maintained sites (updates within a week, no abandoned plugins, 2FA on admins), two to four incidents a year is plausible; a portfolio with a long tail of neglected sites can see one a month. You know your own number from the last two years. Write it down, because the whole pricing decision hangs on it.
Model 1: bill per incident
The honest default: monitoring is in the plan, the cleanup is a separate line quoted when it happens, say $300 to $600 by severity, or your hourly rate with a minimum.
What it gets right: the hacked client pays for the hack and nobody else subsidises them. Nobody argues about fairness.
What it gets wrong: timing. You are quoting work to someone whose site is currently redirecting to a pharmacy. They say yes to anything, then remember the invoice for a long time, and the "weren't you supposed to be protecting it" conversation happens with the invoice in hand. The cleanup also competes with billable project work for the same afternoon, so it slips, and a site that stays hacked for three days costs you more reputation than the $400 ever earned.
The fix is a pre-agreed rate card. The contract says, in plain words: "Malware removal is not included in the monthly fee. If your site is compromised we will clean it at $X per incident (or $Y per hour, 2-hour minimum), starting within one business day, and we will tell you the cause." Agreed when calm, invoked when not.
Model 2: a cleanup retainer inside the plan
Here the plan says "we fix it if it gets hacked" and the plan price carries the risk. This is insurance; price it the way an insurer would: expected cost per site per month, a margin for variance, and the hardening that keeps the expected cost down.
The arithmetic for a 60-site book:
- Expected incidents: 3 a year, at an average of 6 hours each, is 18 hours, or $900 at $50 an hour.
- Variance buffer: a bad year with 8 incidents is $2,400, so you want the premium to cover something closer to that than to the average. Take $2,000 a year.
- Spread over 60 sites: $2,000 / 60 / 12 = $2.78 per site per month.
So the "unlimited cleanups" promise costs about $3 a site a month in expected value, and sells for $10 to $15 a site a month as a security add-on, or folded into a mid tier priced $10 higher. On 60 sites at $10 that is $7,200 a year against roughly $2,000 of expected cost. The margin is real, but only if two conditions hold.
First, the sites have to be hardened, because the retainer only works if incidents stay rare: updates within days, no abandoned plugins, 2FA on every admin, a known-good backup before every change. A retainer on a neglected portfolio is a way to buy yourself unpaid weekends.
Second, "unlimited" needs edges: a third reinfection from the same cause in 90 days (a shared password, a nulled theme reinstalled) is billed; custom code from the client's own developer is cleaned once and handed back; sites moved to hosting you did not approve are out of scope.
Model 3: the hybrid most agencies actually land on
Monitoring, hardening and a first-response promise in every plan; the cleanup itself included in the top tier and billed at a pre-agreed rate in the lower tiers. The lower-tier client knows exactly what a hack costs them, the top-tier client buys peace of mind, and your top tier exists for a reason beyond "more pages".
Every tier should include the response, whatever you decide about the cleanup: within a stated time you confirm the compromise, put the site behind a holding page and tell the client what happens next. That hour decides whether the client trusts you. Charging for it is penny-wise.
Where the tools fit
Three tools are relevant and not interchangeable. A security-platform subscription (Sucuri's platform plans run $229 to $549 a year per site with unlimited manual cleanups included and a 30- to 6-hour ticket response depending on tier; MalCare's Repair plan is $299 a year for one site, $899 for five, with cleanup included from that plan up; both from their pricing pages, checked October 2026: Sucuri, MalCare) is the thing that actually removes the malware. Note the per-site arithmetic: $229 a year is $19 a month per site, more than many care plans charge for security in total, so it is a top-tier item or the cost line under your retainer, not a default.
The second tool is whatever tells you a site is at risk before it is compromised: vulnerability scanning of installed plugins and themes, uptime and SSL checks, a change log. The third is a restorable backup from before the incident, on storage you control, which turns a 6-hour forensic cleanup into a 1-hour restore plus credential rotation on most brochure sites.
WPClientHub covers the second and third of those across every client site: vulnerability scanning with plain-English explanations, 60-second uptime checks with SSL monitoring, an activity log, and incremental backups on the client's server plus your own S3-compatible offsite storage, with a restore point taken before every update. It does not clean malware, so pair it with a cleanup service or your own hands for that part. If a CVE notification is what usually starts your security conversations, A CVE in a plugin is not automatically an emergency covers how to triage those without a panic.
The contract wording
Whichever model you pick, write it down before anyone needs it. Four clauses do most of the work: what "compromise" means and who declares it; the response time and what the response includes; what the cleanup costs (included, rate card, or included above a tier) and the edges of "unlimited"; and what the client must do (apply the hardening you recommend, not share admin logins, tell you about developers they bring in) for the promise to hold. Clients rarely object to "break these and the next cleanup is on the rate card" when it is explained before the hack rather than after.
Put the security add-on's price next to your other tiers, so the client chooses it rather than discovering it. The worksheet in how to price WordPress care plans in 2026 has the margin maths for the rest of the plan.
Where this leaves you
Time one cleanup, count two years of incidents, and the choice makes itself: per-incident with a rate card if hacks are rare and your clients are price-sensitive, a retainer at roughly $10 a site a month if your portfolio is hardened and you want the predictable revenue, a hybrid if you have both kinds of client. Whatever you choose, the hardening and the pre-incident backup are what make it profitable. WPClientHub does that half across every site you manage, free for 3 sites, paid plans from $19/month: start with the sites you would least like to clean.