The verdict in three sentences
A WordPress site that redirects to gambling pages is almost always infected through a backdoor hidden in an outdated plugin or theme. A full cleanup costs about USD 300 to 900 (MAD 3,000 to 9,000) in 2026, Google blacklist removal takes 24 to 72 h after a review request, and without hardening (USD 40 to 120/month) reinfection happens in 40 to 60% of cases within three months. If the theme has been abandoned by its developer, a rebuild at USD 2,500 to 6,000 often beats repeated cleanups.
The first 72 hours: what to do and what it costs
Each day on the blacklist cuts organic traffic by 90% or more, because Chrome shows a red warning screen before opening the site. Emails sent from the domain may also land in spam.
| Step | Time | 2026 price (USD, MAD in brackets) | Goal |
|---|---|---|---|
| Maintenance mode + forensic backup | 1 to 2 h | Included in cleanup | Stop redirects, preserve evidence |
| File and database scan | 2 to 6 h | 100 to 250 (1,000 to 2,500) | Find backdoors and ghost admin users |
| Clean and reinstall core and plugins | 4 to 12 h | 200 to 500 (2,000 to 5,000) | Restart from clean files |
| Reset every password and key | 1 h | Included | Cut off the attacker |
| Google Search Console review request | 24 to 72 h processing | 0 to 150 (0 to 1,500) | Remove the red warning |
| Email reputation check (SPF, DKIM, DMARC) | 1 to 2 h | 50 to 100 (500 to 1,000) | Get emails back into inboxes |
In total, a standard cleanup costs USD 300 to 900 depending on site size and number of infections. A WooCommerce store with customer data sits at the top of the range, because order data must be checked.
Clean, harden or rebuild: comparing the options
| Option | Upfront cost (USD) | Monthly cost | Reinfection risk at 6 months | When to choose it |
|---|---|---|---|---|
| Cleanup only | 300 to 900 | 0 | 40 to 60% | Never alone, unless the site is disposable |
| Cleanup + hardening + WAF | 450 to 1,200 | 40 to 120 | Under 5% | Theme and plugins still maintained |
| Move to managed hosting | 200 to 500 | 30 to 90 | Under 5% | Low-end shared hosting |
| Full rebuild | 2,500 to 6,000 | 50 to 150 (maintenance) | Under 3% | Abandoned theme, obsolete PHP, site over 6 years old |
| Do nothing | 0 | 0 | 100% | Lost traffic, emails and credibility |
Hardening means disabling the file editor, limiting login attempts, two-factor authentication for admins, removing unused plugins and a web application firewall (WAF) that blocks known attacks before they reach the server.
Personal data obligations
If the site collects data (forms, customer accounts), local data protection law requires those processes to be secured: Morocco's law 09-08 enforced by the CNDP, or Singapore's PDPA, which requires notifying the regulator within 3 days of assessing a notifiable breach. If you handle European customers' data, GDPR may also apply, with a 72-hour notification.
Mini case study
Youssef runs a medical equipment distributor and discovers his site redirects to an online casino. The site usually generates 30 quote requests a month, 6 of which close at an average margin of about USD 400, i.e. USD 2,400 of monthly margin tied to the site. The theme dates from 2018 and is no longer maintained. Chosen path: emergency cleanup at USD 550 to lift the blacklist in 48 h, then a rebuild at USD 3,800 delivered in 6 weeks, plus WAF maintenance at USD 80/month. First-year cost: USD 5,310. Two weeks of blacklist avoided already preserve USD 1,200 of margin, and the rebuild removes the risk of recurrence.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
FAQ
How long until Google removes the warning?
After a full cleanup and a Search Console review request, Google usually responds within 24 to 72 h. A rejected request because malicious code remains adds 3 to 7 days.
Is a free security plugin enough?
It helps with detection, but it does not clean advanced backdoors or block attacks upstream like a WAF. Budget at least USD 40/month for serious protection.
Can my host clean the site?
Most shared hosts suspend the account and leave it to you. Some offer paid cleanup at USD 150 to 400, rarely with hardening.
Should we report it to the police?
It is advisable if customer data may have been stolen, through the national cybercrime unit. Keep the forensic backup, it serves as evidence.
How do we stop it from happening again?
Weekly updates, two-factor authentication, daily off-site backups and a WAF. This baseline costs USD 40 to 120/month, far less than another incident.
Let's scope your project. Send us the affected site address: we will price the emergency cleanup (USD 300 to 900), hardening and, if needed, a rebuild with a timeline. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
