What each host documents
| Host | Scanning | Cleanup cost | Conditions and limits |
|---|---|---|---|
| Kinsta | Continuous monitoring for suspicious activity; firewall and DDoS filtering at the edge | Hack-fix guarantee on every plan at no extra cost; malware found during migration cleaned free | Security page lists no exclusions, but the terms say malicious activity introduced during a customer-performed migration that you do not promptly remove is removed for a fee; no fee is stated |
| WP Engine | Deep scan run by Support on request | The cleanup article does not state a price | Needs a specific indication of infection; infections from before migrating to WP Engine are excluded; can take up to 24 hours; backup checkpoint created before cleaning |
| SiteGround | Site Scanner Basic: daily URL and blacklist checks, weekly file scan. Premium: daily file and URL scans | Basic: link to paid manual cleanup. Premium: automated one-click cleanup, extra fee may apply if automation fails. Expert Care malware cleanup: 2 credits | Credit price is set per plan; the catalog article does not state a dollar figure |
| Liquid Web | FAQ lists malware removal as an add-on for managed applications | $200 one-time fee | Only for managed WordPress and WooCommerce customers; free re-clean if malware returns within 14 days, 30 days if recommended practices were followed |
| KnownHost | Every WordPress account protected by Imunify360 real-time scanning and a web application firewall | Hosting overview lists Malware Cleanup for managed WordPress; no price or scope stated | Terms make the customer ultimately responsible for backups; we found no cleanup terms for VPS plans |
Reading the fine print
The WP Engine exclusion matters if you are moving a site because it was hacked. The support article says that an infection which did not happen on WP Engine's platform will not be submitted for a deep scan or clean. In that case clean the site first or use a third-party service, then migrate. Kinsta's security page takes the opposite approach, saying malware found during migration is cleaned for free, but section 6.4.2 of its terms says malicious activity introduced during a migration the customer performs, and not promptly removed by the customer, is removed for a fee. Ask Kinsta which applies to your move, and whether its own migration team or you will do it, before relying on the free cleanup.
Scanning is not cleanup. SiteGround's Basic scanner and KnownHost's Imunify360 description both emphasise detection. SiteGround's Basic tier sends you to paid manual cleanup options when it finds something, and even Premium notes an additional fee may apply when the automated cleanup cannot resolve an issue.
Liquid Web's $200 service lists full backups, malicious code removal, infected plugin removal, admin audit and removal, new passwords, updated salts, updated core, themes and plugins, and a final restoration. That deliverable list is a useful benchmark for what any cleanup should include, whoever performs it.
Why membership sites are harder to recover
A brochure site can often be restored from yesterday's backup with nothing lost. A membership or course site changes every hour: new orders, renewals, lesson completions, quiz attempts and password resets. Restoring an older backup removes the attacker's changes and your customers' changes at the same time.
That makes the choice between cleaning in place and restoring a business decision, not only a technical one.
| Approach | What you keep | What you risk |
|---|---|---|
| Host or specialist cleans the live site | All orders, members and progress | A missed backdoor leads to reinfection; check the re-clean window |
| Restore a backup from before the infection | A known clean state | Every order, signup and progress record since that backup; you must re-enter or reconcile them |
| Rebuild on fresh core and plugins, then import content and data | Clean code and your data | Most labour and the longest downtime |
Recovery checklist for a hacked membership site
- Download your own copy of the current site and database before anyone changes anything; WP Engine says it creates a checkpoint before cleaning, but keep one you control.
- Open a ticket with evidence: WP Engine asks for screenshots, logs or steps to replicate.
- Change every password: hosting portal, SFTP or SSH, wp-admin, database, and any payment gateway and email service API keys stored in the site.
- Audit administrator accounts and remove any you do not recognise.
- Update WordPress core, themes and plugins, and delete inactive ones.
- Run an antivirus scan on the computers used to manage the site, as WP Engine recommends.
- Compare orders and subscriptions in your payment processor against the site for the infection window, and re-send failed webhooks.
- Check that enrolment and password reset emails still send from the correct domain.
- Check whether personal data may have been exposed; notification duties depend on your jurisdiction, so take advice rather than guessing.
- Record what happened, when it was found and what was changed, so the next incident starts from a written baseline.
Questions to ask a host before you buy
- Is cleanup included on my plan, and is there a per-incident fee or credit cost?
- Do you clean infections that existed before I migrated to you?
- What evidence do you need before you will scan?
- How long does a cleanup usually take, and is the site taken offline during it?
- Is there a re-clean guarantee if malware returns, and for how long?
- Do you clean the database as well as files?
Questions before you decide
Will WP Engine clean a site that was hacked before I moved it there?
Its support article says no: an infection that did not happen on WP Engine's platform will not be submitted for a deep scan or cleaning.
Is SiteGround malware cleanup free?
Not on Site Scanner Basic, which links to paid manual cleanup. Premium adds automated one-click cleanup, with a possible extra fee if automation cannot fix it. Expert Care lists malware cleanup at 2 credits.
What does Liquid Web's reinfection coverage include?
If malware is found within 14 days of the initial $200 cleanup, Liquid Web says it will clean again at no cost; the window extends to 30 days if you followed its recommended security practices.
Sources & verification
Product details and prices can change. Check the linked provider before buying.
- Kinsta: Secure WordPress hosting Accessed 29 Oct 2026
- WP Engine: How to fix a hacked WordPress site Accessed 29 Oct 2026
- SiteGround: How does the Site Scanner protect my website? Accessed 29 Oct 2026
- SiteGround: Expert Care services catalog Accessed 29 Oct 2026
- Liquid Web: Website malware removal services Accessed 29 Oct 2026
- Liquid Web: FAQ Accessed 29 Oct 2026
- KnownHost: Managed hosting for WordPress Accessed 29 Oct 2026
- KnownHost: Hosting overview Accessed 29 Oct 2026
- KnownHost: Terms of Service Accessed 29 Oct 2026
- Kinsta: Terms of Service Accessed 29 Oct 2026
Sources link directly to providers. Product buttons may use separately labeled affiliate links. Read our disclosure.