Want your site kept updated after cleanup
Plugins, themes, and WordPress core on a regular update schedule. $149 / $249 / $399 a month.
TN 423-888-0252 · NC 828-484-1257
After cleanup · hardening vs a Care plan
After malware cleanup: hardening vs a Care plan (what is different)
Your WordPress site was hacked, and now it has been cleaned. The spam is gone, the warning is gone, and someone says you should "harden it" and also "get a maintenance plan." It is fair to ask whether those are the same thing, and whether you need both.
Avery Parker · principal
Support since the early 1990s
Networks & security since the late 1990s
Linux since ~2000
Johnson City office · you talk to the same person
They are different jobs. Cleanup removes what was planted. Hardening closes doors once. Care keeps the site updated and watched over time. Here is what each one does and where each one stops.
1. Cleanup: remove what was planted
Cleanup finds and removes the injected files, rogue users, scheduled tasks, and spam content, and it looks for the original way in. It ends with a written report. Published cleanup packages start around $2,500; ranges are on the incident response page.
Cleanup does not make the site harder to attack by itself. It puts the site back to a clean state. If you are still deciding whether you need one, start with the first 24 hours and why not to wipe the host first.
2. Hardening: close doors once
Hardening is a one-time set of changes that make the same kind of attack harder next time. Typical items include:
- Locking down file permissions and turning off file editing from the dashboard
- Tightening settings in the WordPress configuration file (see wp-config hardening)
- Removing plugins, themes, and users that are no longer needed
- Two-factor sign-in and unique passwords for every administrator
- Limiting what the login page and XML-RPC will accept
Hardening is a project with a start and an end. Cleanup plus hardening options are shown on the incident response page, with hardening from about $2,000. Our before-the-patch hardening checklist shows the kind of thinking behind it.
Hardening does not stay current on its own. A site hardened in March and never updated is still an old site by autumn.
3. Care: keep it updated and watched
A Care plan is ongoing: plugins, themes, and WordPress core are kept on a regular update schedule, so known holes get patched instead of sitting open. Care plans are $149 / $249 / $399 a month depending on the tier.
Care does not replace cleanup while a site is still compromised, and it does not replace the one-time hardening work. It is what keeps the cleaned and hardened site from drifting back.
Side by side
| Cleanup | Hardening | Care | |
|---|---|---|---|
| Job | Remove what was planted | Close doors once | Keep updated over time |
| Happens | Once, after a hack | Once, usually right after cleanup | Every month |
| Does not do | Make the site harder to attack | Keep itself current | Clean an active infection |
Which do you need?
- Still seeing spam, warnings, or unknown users: cleanup first. Nothing else helps until the site is clean. Our compromise checklist covers the first day.
- Clean now, and the cause was an outdated plugin, a weak password, or too many old accounts: hardening fits, because it fixes those.
- Clean and hardened: Care is what keeps it that way.
- Not hacked, but worried: a site health review and Care are the usual starting point.
Nothing here is a guarantee that a site will never be attacked again. It makes the next attempt harder and makes problems visible sooner.
Work with us
Work is remote nationwide; Tri-Cities and Western NC onsite is by appointment. Call TN 423-888-0252 or NC 828-484-1257.
Keep it updated after cleanup vs still need cleanup first
Hacked and need cleanup first
Published cleanup packages with a written report. Hardening options on the same page.
First day and want to move carefully
Download the printable first-24-hours compromise checklist. Evidence, access hygiene, and stop-lines. Not a full clean or full hardening by itself.
Hardening vs Care after cleanup questions
If my site was cleaned, do I still need hardening?
Often yes. Cleanup removes what was planted, but the way in may still be partly open. Hardening closes it and tightens settings so the same kind of attack is harder.
Is a Care plan the same as hardening?
No. Hardening is a one-time project. Care is ongoing updates and upkeep. They work together.
Can Care clean a hacked site?
No. Care is for keeping a healthy site current. A site with an active infection needs cleanup first.
Can the free checklist harden my site?
No. It helps you preserve evidence and tighten access in the first day. It is not a full cleanup or a full hardening.
Want your site kept updated after cleanup? See WordPress Care plans.
Tri-Cities 423-888-0252 · Western NC 828-484-1257