Website Repair and Maintenance: How Broken Sites Get Fixed
What 'my website is broken' usually means, how each problem gets diagnosed and fixed, and what the repair costs with and without a plan.
Website Maintenance Team
Website maintenance since 2010
Website repair means diagnosing and fixing a site that is down, hacked, or misbehaving: white screens after updates, forms that stop sending, expired SSL, spam redirects, broken layouts. Most one-off repairs cost $75 to $300, a hack cleanup runs $150 to $500 or more, and a maintenance plan from $99 a month prevents most of them.
Key takeaways
- The most common repair call by far is a white screen or fatal error right after a plugin, theme, or PHP update.
- Contact forms fail silently more often than any other feature, and owners usually find out weeks later from a customer.
- A hacked site is rarely obvious from your own desktop; the spam pages and redirects are aimed at Google and mobile visitors.
- Simple repairs cost $75 to $300 when billed hourly or per incident, while a malware cleanup runs $150 to $500 and can pass $1,000 for a store.
- In the first hour, confirm the outage from your phone, screenshot the error, find your last backup, and stop updating things.
- Repair without ongoing maintenance fixes the symptom and leaves every condition that caused it in place, so the site breaks again.
Nobody searches for website repair on a good day. You searched because the site is showing a white screen, or a customer just mentioned the contact form has not worked in weeks, or Google is labeling your homepage as hacked. This guide covers what those symptoms usually mean underneath, how each one gets diagnosed and fixed, what you should expect to pay when you hire it out by the hour or per incident, and why a site that gets repaired but never maintained tends to be back on this page within a year.
What 'my website is broken' usually means
'My website is broken' covers about seven different problems, and they have almost nothing in common except that the phone rings. After years of taking those calls, here is what the phrase usually turns out to mean.
- White screen or error after an update. A plugin, theme, or PHP version change conflicted with something else. The site still exists, it just cannot load. The most common repair call by a wide margin.
- Contact form silently failing. The form says thanks and nothing arrives. Usually the host stopped delivering PHP mail or a spam filter ate the messages. Owners find out from a customer weeks later.
- Site down or suspended by the host. An expired card, a missed domain renewal, a resource overage, or malware found by the host's scanner. The host's notice page replaces yours.
- Hacked with spam pages or redirects. Japanese pharmacy pages under your business name in Google, visitors bounced to a casino site, a red browser warning. Someone else is using your site.
- SSL certificate expired. Browsers show 'Your connection is not private' and most visitors leave on the spot. Usually a failed auto-renewal or a DNS change.
- Layout broken on phones. A theme update or a caching plugin serving a stale stylesheet. Desktop looks fine, so nobody in the office notices for a month.
- Checkout errors on a store. A payment gateway plugin update, an expired API key, or a WooCommerce and theme version mismatch. Every hour of this one costs real money.
Before you call anyone, run a free website checkup. In about a minute it tells you whether the site is loading, how it scores on speed, security, and SEO, and when it was last updated. That narrows the conversation a lot.
How each website repair gets diagnosed and fixed
Good repair work is mostly diagnosis. The fix itself is often ten minutes. The time goes into finding which of forty plugins broke, or which of three recent changes caused the redirect.
For a white screen, the technician turns on error logging, reads the PHP fatal error, and finds the plugin or theme it names. If the admin area is unreachable, they connect by SFTP, rename that plugin's folder to disable it, bring the site back, then update or replace the plugin properly. If the host just moved you to PHP 8 and a ten-year-old theme choked on it, the answer is a compatible theme version or a temporary PHP rollback.
Contact forms get tested end to end: submit a test, check the form plugin's entry log, check the mail log, then fix delivery. Nine times out of ten that means routing form mail through a real SMTP service (WP Mail SMTP with SendGrid, Postmark, or your Google Workspace account) instead of trusting the host's mail function. It usually does not work.
Suspensions are a call to the host and, often, a bill. SSL is a renewal, a DNS fix, or, behind Cloudflare, checking that the encryption mode is not fighting the origin certificate. Mobile layout breaks mean clearing every cache layer first, because half the time the fix is already live and the visitor is still seeing last week's CSS. Checkout errors are traced from the gateway's own logs (Stripe, PayPal, and Square all keep one) back to the plugin update that caused them. Most of this is routine work for a website updates service. It only feels like an emergency because nobody was watching.
| Breakage | Typical fix time | Typical one-off cost |
|---|---|---|
| White screen after an update | 30 min to 2 hours | $75 to $250 |
| Contact form not sending | 30 min to 1 hour | $50 to $150 |
| Expired SSL certificate | 15 min to 1 hour | $0 to $100 (the certificate itself is free) |
| Layout broken on phones | 1 to 3 hours | $100 to $300 |
| Store checkout errors | 1 to 4 hours | $100 to $400 |
| Hacked: spam pages or redirects | 2 to 8 hours | $150 to $500, more with a store |
A bad hack cleanup costs about a year of a plan
Professional malware removal from a hacked WordPress site typically runs $150 to $500, and agencies quote $500 to $1,500 for a badly infected store. A plan at $99 a month is $1,188 a year, which is what one bad cleanup costs, and the plan includes the daily backups that turn a cleanup into a restore instead of a rebuild.
Source: General US market rates for malware removal across Sucuri, Wordfence, MalCare, and independent freelancers
How to tell if your website has been hacked
Hacked sites rarely announce themselves. Most owners find out from a customer, from a 'This site may be hacked' label in Google results, or from the host suspending the account. By then the infection is weeks old. Signs worth checking today:
- Google results for your business show pages you never created, often in Japanese or selling pharmaceuticals, watches, or essay writing.
- Visitors on phones get sent to a different site while your desktop looks fine. Redirect hacks often target only mobile and search traffic so the owner never notices.
- A new administrator account appears in WordPress that nobody on your team created.
- Your host emails about malware, outbound spam, or unusual CPU usage on your account.
- Search Console shows a Security Issues notice, or Chrome shows a full-page red warning before your site.
- Files or pages changed on a date nobody worked on the site. If the last updated checker shows activity you cannot explain, look harder.
Removal means more than deleting the bad files. A proper cleanup finds the entry point (an outdated plugin, a reused password, an old developer's leftover admin account), closes it, removes every backdoor, resets every password and API key, and requests a Google review if there was a warning. Skip the entry point and the site is reinfected within days. Our guide to website maintenance and security covers keeping it from happening in the first place.
Do not restore a backup and call it done
Restoring last week's backup removes the visible spam but not the hole the attacker came in through, and the backup itself may already contain the backdoor. Clean first, patch the entry point, and restore only if the cleanup fails. Then change every password, including hosting, FTP, and the database.
What to do in the first hour your website is down
Panic wastes the hour. These steps get you to a fix, or to a technician with everything they need, without making it worse.
- Confirm it is down for everyone. Check from your phone on cellular data, not office wifi. A DNS change or a stale cache can make a working site look dead from one desk.
- Read the error and screenshot it. A white screen, a host suspension page, a database connection error, and an SSL warning are four different problems with four different people to call.
- Check your inbox for the host. Suspensions and expired domains almost always come with a warning email that got filed under later.
- Do not update anything else. If one plugin update broke the site, running five more makes the diagnosis five times harder.
- Find your last backup and note its date. Do not restore it yet. Just know what you have. On managed hosting with daily backups this takes thirty seconds. On a bargain shared host it can take the whole hour.
- Write down what changed in the last 48 hours. A new plugin, a theme update, a PHP version email from the host, a developer's last day. The answer is usually on that list.
Hand that list to whoever is fixing the site and you have just saved an hour of billable diagnosis.
What website repair costs: hourly, per incident, or on a plan
Repair pricing comes in three shapes, and the shape matters more than the rate.
Hourly. Freelancers charge $50 to $150 an hour, and $150 to $250 for emergency or weekend work. Diagnosis is on the clock, so a white screen that takes ninety minutes to trace and five minutes to fix bills as two hours. Agencies run $125 to $200 an hour with a minimum block, and they are not answering at 9pm on a Saturday.
Per incident. Flat-fee repair services and security companies price by the job: roughly $75 to $150 for a simple fix and $150 to $500 for a hack cleanup, more for a large site or a store. Sucuri and similar platforms sell cleanup as part of an annual security subscription that includes removal if you get hit. Predictable, but every incident is a fresh bill.
On a plan. A maintenance plan folds most repairs into the monthly fee, because the plan's whole job is to stop them from happening. Plans start at $99 a month for a basic business site, and the breakages a plan cannot prevent (a host outage, a payment gateway changing its API) get handled as part of the relationship rather than as a new quote. Our website maintenance cost guide breaks down the tiers.
Repair is what you pay for when maintenance did not happen. It is the same work, at a worse time, at a higher rate.
Why repair without maintenance means it breaks again
A repair fixes the symptom. It changes none of the conditions that produced it. The site still has thirty plugins nobody updates, a theme two versions behind, no offsite backup, an admin password from 2019, and a host that will bump PHP again next spring. Every one of those is a repair with a date on it.
We see the same pattern constantly. A site gets a $450 cleanup in March, a $150 form fix in July, and a $400 checkout repair in November, one of them at the weekend rate. The owner has spent close to a year of a plan, and the site spent weeks broken, some of it without anyone knowing. The math is not close. The WordPress maintenance work that prevents each of those (staged updates, tested backups, malware scanning, uptime monitoring, a monthly form test) is boring, which is exactly why it works.
If you are reading this with a broken site right now, get it fixed first. Then take an honest look at whether you want to be on this page again next year.
Fixed it? Do these three things this week
Set up an offsite backup that runs daily and keeps at least 30 days (UpdraftPlus to Google Drive is fine). Turn on uptime monitoring so you hear about the next outage before a customer does. And delete every plugin and admin account you do not recognize.
Not sure if your site is broken or just slow?
Run the free checkup. It scores health, speed, security, and SEO in about a minute and tells you what actually needs fixing.
Run the free checkupFrequently asked questions
A simple repair such as a white screen, a dead contact form, or an expired SSL runs $75 to $300 when billed hourly or per incident. Malware removal from a hacked site costs $150 to $500, and can pass $1,000 for a large site or a store. A maintenance plan from $99 a month prevents most of these problems in the first place.
Almost every hacked site can be cleaned and kept. A proper cleanup removes the malicious files and backdoors, closes the entry point, resets every password and key, and requests a Google review if there was a warning. You only need a rebuild when the site was already so outdated that patching it costs more than replacing it.
Most single problems are fixed in 30 minutes to 2 hours once someone is looking at the site. A hack cleanup takes 2 to 8 hours and a Google warning can take a few more days to clear after the review request. The delay is usually in finding someone available, not in the work itself.
Read the error first. A host suspension page means the host. A white screen or database error means whoever maintains the site. An SSL warning means the host or your DNS provider. If you have a maintenance provider, call them regardless, because sorting out which of those it is takes them minutes and you an afternoon.
Most hosts have stopped reliably delivering mail sent by PHP, so the form submits fine and the email never arrives or lands in spam. The fix is to route form mail through a real SMTP service such as SendGrid, Postmark, or your Google Workspace account. Check the form plugin's entry log to see what you missed while it was broken.
On a proper plan, yes. Updates, backups, security scanning, and monitoring are there to prevent breakages, and when something still breaks, fixing it is part of the service rather than a new invoice. Read the inclusion list before signing, because some cheap plans only run automated updates and bill everything else hourly.
Sources
- Google Search Central documentation on hacked sites and Security Issues reports
- WordPress.org support documentation on common errors and the white screen of death
- Let's Encrypt documentation on certificate renewal and expiry
- Sucuri website security research on malware and reinfection
Website Maintenance Team
Website maintenance since 2010
We have repaired more white screens, dead contact forms, and hacked WordPress sites than we can count, and most of them belonged to businesses whose site nobody had touched in a year.