When business owners picture a hacked website, they picture the cleanup fee. That’s real — but it’s the smallest line on the bill. Here’s the whole invoice.
Line 1: The cleanup — R3,000 to R15,000
Professional malware removal, closing the entry hole, rebuilding what was damaged. Costs climb if the site was hacked repeatedly before anyone noticed (common — the average hack goes undetected for weeks).
Line 2: The downtime — your daily revenue × days down
If your site takes bookings or sales, count them. If it generates leads, count those. And cleanups aren’t instant: between discovering the hack, finding someone to fix it, and completing the work, small businesses commonly lose three days to two weeks.
Line 3: The Google penalty — weeks of lost traffic
Google flags hacked sites with a “deceptive site ahead” warning that turns visitors away at the door, and can drop your rankings. After cleanup you must request a review, wait for re-approval, and then rebuild the rankings you lost. Traffic can take weeks or months to recover fully.
Line 4: The email fallout
Hacked servers send spam. Spam gets your domain blacklisted. Suddenly your quotes and invoices land in customers’ junk folders — and delisting takes days after the cleanup is done.
Line 5: Trust, and possibly the law
If customer data was exposed, POPIA requires you to report the breach and notify affected people. Even without legal exposure, “their website gave my phone a virus warning” is not a sentence you want customers saying.
The prevention column
Against all that: maintenance at R499–R999/month. Updated software closes the holes bots exploit. Daily off-site backups turn a catastrophe into a restore. Security scans catch infections in hours, not weeks. Monitoring means you know before Google does.
The maths isn’t subtle. One hack costs more than years of prevention.