The research in brief
Flywheel is a good fit, with conditions, for a U.S. WordPress owner who wants host-provided malware cleanup after an infection. Three of seven platforms named Flywheel during ranking discovery, at an average listed rank of 4.3 and a best rank of 3. The strongest reason to consider it is a documented free malware cleanup policy backed by an included edge WAF and automatic WordPress core security updates [11]. The main limitation is that this is not an unconditional guarantee: cleanup requires customer remediation steps, deep scans are request-driven, the process may take 24–48 hours, and no binding incident-response SLA is documented [11].
Research Snapshot
| Field | Finding |
|---|---|
| Platform mentions in ranking stage | 3 of 7 platforms (Claude, DeepSeek, Gemini) |
| Share of included platform responses | 42.9% |
| Average listed rank | 4.3 |
| Best listed rank | 3 |
| Hosting offering | Flywheel Managed WordPress Hosting, Starter and above; security and malware cleanup described as platform-level services |
| Overall use-case fit | Good, with meaningful conditions |
| Research date | 2026-10-03 |
Why Flywheel Qualified for This Study
Questions explored
- Is Flywheel a good choice for hack recovery and malware guarantee compared with other managed WordPress hosts?
- How many AI platforms recommended Flywheel for free malware cleanup, and at what rank?
Flywheel qualified because it was named by three of the seven platforms included in this study, clearing the two-mention threshold used to build the finalist set. Anthropic listed it at rank 4, Gemini at rank 3, and DeepSeek at rank 6, producing an average listed rank of 4.3 and a best rank of 3.
The qualification is not unanimous. Four platforms - ChatGPT, Grok, Perplexity, and Kimi - evaluated Flywheel's fit but did not name it during ranking discovery. Kimi went further and rated Flywheel a weak fit, arguing that the brand does not transparently market a standalone hack cleanup guarantee and that post-acquisition security messaging is ambiguous [4]. Deepseek rated fit uncertain and, notably, ran without search enabled, so its conclusions rest on partial public-page evidence rather than retrieved documentation [1].
The platforms that did name Flywheel converged on the same reason: an explicitly documented free malware cleanup policy for sites infected while hosted on the platform [11]. That policy, not general hosting reputation, is what earned Flywheel a place in this comparison. Buyers comparing the full field can review the hack recovery and malware guarantee consensus index, which ranks all finalists on the same five criteria.
The hosting offering in focus
Questions explored
- Which Flywheel plan should a buyer choose if they need free malware cleanup on a single WordPress site?
- Does Flywheel's free malware cleanup apply to the cheapest Starter plan or only to higher tiers?
The relevant offering is Flywheel managed wordpress hosting on any plan, because security and malware cleanup are described as platform-level services rather than tier-gated add-ons [11]. Platforms consistently pointed to Starter and above as the practical entry point, with Freelance and Agency tiers adding site count and traffic capacity rather than additional security guarantees [6].
Plan naming is genuinely inconsistent across sources, and buyers should treat this as unresolved. The current public pricing page lists Starter, Freelance, Agency, and Custom [6]. Other platform responses reference a Tiny plan and a Startup plan, and one google-cited community thread discusses the disappearance of a $15 Tiny tier from the public pricing matrix [30]. Anthropic's response lists Tiny at $13–$15 per month, Starter at $25–$30, Freelance at $96–$115, and Agency at $242–$290 [25]. The safest reading is that Starter is the reliable current entry point and that legacy or entry-level tiers should be confirmed directly before purchase.
The security stack attached to these plans is consistent across company documentation: an edge WAF using Fastly, Trustwave ModSecurity, and OWASP Top Ten rules; automatic WordPress core security updates; nightly plugin vulnerability scanning with email alerts; locked core files; limited login attempts; two-factor authentication; and encryption at rest and in transit [12]. What is not included by default is automatic plugin and theme patching, which requires the paid Managed Plugin Updates add-on [14].
What the AI Platforms Agreed About
Questions explored
- Do AI platforms agree that Flywheel includes free malware cleanup on all managed WordPress plans?
- Is Flywheel's web application firewall included at no extra cost on every plan?
Agreement was strong on four points and mixed on everything else.
First, free malware cleanup. Five platforms - ChatGPT, Claude, Grok, Perplexity, and Gemini - describe Flywheel as cleaning infected sites at no additional charge, citing company documentation and independent reviews [11]. Independent reviews echo the claim, including a 2026 review that rates Flywheel's security 5/5 and describes free malware removal within 24 hours [25] and a security-focused roundup stating that free hack repairs let owners restore a compromised site without additional charges [31].
Second, included WAF protection. Multiple platforms describe an edge WAF enabled by default that blocks malicious HTTP and HTTPS traffic, including SQL injection, cross-site scripting, and WordPress-specific vulnerabilities [12].
Third, automatic core updates. Flywheel automatically starts WordPress security-release updates within 24–72 hours of release and installs them as soon as possible [15]. Anthropic and Grok describe the same behavior in looser terms, as updates landing within a few days of release [12].
Fourth, the cleanup process is not instant and not hands-off. Platforms agree that a scan and cleaning may take 24–48 hours, may require website changes, and requires the customer to update plugins and themes and change administrator passwords before full cleanup proceeds [11].
Where the AI Platforms Disagreed or Were Uncertain
Questions explored
- Is Flywheel's malware scanning continuous, or does it only scan for vulnerable plugins nightly?
- Does Flywheel guarantee a specific response time for malware cleanup, or is the 24–48-hour window just an estimate?
The sharpest disagreement concerns scanning frequency. Flywheel documents nightly scans that detect vulnerable plugins through Plugin Security Alerts [14]. It does not state that every site receives a nightly full-file malware scan. Google's response is the most explicit on this point: deep-level scans are not run unless the customer provides specific indication of infection, such as screenshots, logs, or replication steps [20]. Grok and Perplexity both note that no specific scanning interval is published [1]. One independent review cited by Claude claims daily malware scanning, but that appears to describe the 24-hour plugin vulnerability cycle rather than continuous site-level malware monitoring [29].
The second disagreement concerns the guarantee itself. Flywheel's marketing language - free malware cleanup, free hack fix - reads as unconditional (official:C1, Evidence ID perplexity:c3). The current malware policy is conditional: cleanup requires customer remediation first, may require website changes, and may involve disabling mail services to protect the server and IP address [11]. Anthropic flags this directly, noting it is unclear whether the "guarantee" is a service promise or an enforceable guarantee, and whether data loss or downtime is covered [11].
Third, response-time commitments. Flywheel advertises 24/7 human support and claims 90% of support interactions are resolved within a single chat session [9]. No cited material establishes a binding incident-response SLA or guaranteed response time for hack-related tickets [7]. Kimi adds that phone support requires the Freelance tier or higher, so critical incidents on lower plans route through chat [5].
Fourth, the WP Engine relationship. Flywheel was acquired by WP Engine in 2019 [22]. Deepseek and Kimi both raise the question of whether Flywheel plans inherit WP Engine's security guarantees, and neither finds public documentation resolving it [22]. Kimi treats this ambiguity as a reason to rate Flywheel weak for this use case; the other platforms do not.
Fifth, customer-sentiment divergence. Anthropic notes a Trustpilot rating of 2.0/5 across 65 reviews against a G2 rating of 4.3/5 and expert security ratings of 5/5, describing the pattern as polarized rather than settled [25].
Features for this workload
Questions explored
- What does Flywheel's free malware cleanup actually include, and what must the customer do first?
- How long does Flywheel take to clean a hacked WordPress site, and can mail services be disabled during cleanup?
Flywheel's cleanup workflow is documented and specific. The owner initiates a malware scan through dashboard support chat, which creates a ticket for the support team [11]. Before full cleanup proceeds, the customer must review and remove extra administrators, update all administrator passwords, delete inactive or disabled plugins and themes, and run all available plugin and theme updates [20]. Limited preliminary assistance is available when wp-admin access is blocked [11].
Timing and side effects are disclosed in the same policy. A security scan and cleaning may take 24–48 hours and may require changes to the website [11]. A backup checkpoint is created before cleaning, and infected sites may have mail services disabled to protect the server and IP address [11]. Google's summary describes the same window as up to 24–48 hours [20].
Prevention features operate at the server level. The Fastly WAF blocks malicious traffic at the edge using Fastly, Trustwave ModSecurity, and OWASP Top Ten rules [12]. WordPress core files are locked down and cannot be edited without support involvement [16]. Intelligent IP blocking detects and blocks attackers within seconds, login attempts are limited to prevent brute force, and traffic is monitored continuously [12]. Encryption at rest and in transit, SSL, SSH access, user-role management, and two-factor authentication are listed as included in every plan [8].
Patching is the weak link. WordPress core security releases are handled automatically within 24–72 hours [15]. Plugins and themes are not updated by default; Flywheel sends vulnerability alerts and offers Managed Plugin Updates as a paid add-on [14]. Backups are retained for 30 days, so an infection that predates the retention window may be unrecoverable [11].
Pricing, renewal terms, and ongoing costs
Questions explored
- How much does Flywheel cost per month, and does the price include free malware cleanup?
- Are there setup fees, overage charges, or cancellation penalties on Flywheel managed WordPress plans?
Flywheel's cited pricing page lists Starter at $25 per month billed annually at $300 per year, Freelance at $96 per month billed annually at $1,150 per year, and Agency at $242 per month billed annually at $2,900 per year, with annual billing including two months free (Evidence ID openai:flywheel-pricing, official:C2). Prices are in USD and may vary by server location (official:C2). Custom plans are quote-based and their security and support terms are not clear from the cited public page [6].
Pricing is not consistent across sources, and this is a material conflict rather than a rounding difference. Some pages show $30, $115, and $290 per month for the same tiers [6]. Anthropic lists ranges of $13–$15 for Tiny, $25–$30 for Starter, $96–$115 for Freelance, and $242–$290 for Agency [25]. Kimi lists Freelance at $92 per month [5]. Google cites a legacy Tiny plan at $15 per month or $13 billed annually, with community discussion about whether it remains purchasable [21]. Buyers should confirm the current price for their specific plan and billing cycle before purchase.
Additional costs are documented. Managed Plugin Updates is $8 per month per site [11]. Additional sites cost $20 per month or $200 per year (official:C2). Overage charges apply at $1 per 1,000 extra monthly visitors and $1 per GB of storage over the plan limit (official:C2). Anthropic also references a Growth Suite add-on starting around $135 per month for client management and billing features [25].
No separate malware-cleanup fee is identified in any cited source; cleanup is described as free for infected sites hosted on the platform [11]. No setup fees are stated [25]. A 60-day money-back guarantee applies to new qualifying hosting plans, excluding Agency and Custom plans and not applying to upgrades or renewals; cancellation requires dashboard action plus an emailed refund request (Evidence ID openai:flywheel-pricing, official:C2, Evidence ID perplexity:c1).
Best Suited For
Questions explored
- Who gets the most value from Flywheel's free malware cleanup and included WAF?
- Is Flywheel a good fit for a small business owner who cannot manage security plugins?
Flywheel fits WordPress site owners who want host-provided malware cleanup without a separately quoted incident-response fee [11]. It fits buyers who prioritize managed hosting with an included edge WAF, automatic core updates, and human support over plugin-based security stacks [12]. It fits recently compromised sites where the owner can regain administrator access or cooperate with the required password, plugin, and theme remediation [11].
It also fits freelancers and agencies managing multiple client sites with security accountability, since cleanup is described as included across plans rather than priced per incident [1]. Small and mid-market businesses that prefer hands-off, server-level protection over managing security plugins are a reasonable match [10]. Sites that fit within Flywheel's plan limits - up to 400,000 monthly visits on Agency - remain in scope (official:C2).
Probably Not Best Suited For
Questions explored
- Who should not choose Flywheel for hack recovery and malware guarantee?
- Is Flywheel unsuitable for a site owner who needs cleanup without doing any remediation work first?
Buyers who need guaranteed automatic cleanup without customer action should look elsewhere. Flywheel requires the owner to update plugins and themes and change administrator passwords before full cleanup proceeds [11]. Buyers requiring a contractual response-time SLA, a defined remediation scope, or guaranteed recovery of data deleted more than 30 days earlier are also poorly matched, because no binding malware-response SLA is documented and backups are retained for 30 days [11].
Sites whose primary risk is outdated third-party plugins and themes, but whose owners do not want to manage updates or pay for the Managed Plugin Updates add-on, face a structural gap: plugin and theme updates are customer-managed by default [14]. Buyers who need continuous deep malware scanning of every site, rather than request-driven deep scans triggered by specific indication of infection, should not assume Flywheel provides it [20].
Organizations with regulatory or compliance needs requiring explicit breach-response SLAs are not served by the cited materials, which do not advertise compliance-specific response guarantees [11]. Buyers who need immediate phone-based incident response should note that phone support is associated with higher tiers, while standard support is chat-based [5].
When Another Option May Be Better
Questions explored
- What is a better alternative to Flywheel for a buyer who needs automatic plugin patching in the base plan?
- When should a buyer choose a separate security service instead of relying on Flywheel's included cleanup?
Choose a provider with automatic plugin and theme patching included in the base plan when the buyer cannot reliably maintain third-party WordPress software [14]. Choose a provider or security service with a written, unconditional malware-removal guarantee when cleanup eligibility, response time, and remediation scope must be contractual [11].
Use a separate specialist security service when continuous full-file monitoring, forensic investigation, blacklist removal, or post-breach hardening is required beyond host cleanup [11]. Choose a provider with longer backup retention when recovery from an infection discovered after 30 days matters [11].
Platforms also flagged capacity and support-channel triggers. Buyers operating high-traffic sites above 400,000 monthly visits need custom pricing (Evidence ID anthropic:c10, official:C2). Buyers who need sub-hour post-incident phone response, automatic plugin patching on base tiers, or bundled incident forensics and cyber liability insurance should compare alternatives directly [11]. Buyers who want a clearly published incident-response SLA or independently verified remediation performance should treat Flywheel's provider claims as claims, not proof [12].
Questions to ask before choosing a provider
Questions explored
- What should a buyer confirm with Flywheel before signing a contract for hack recovery coverage?
- Does Flywheel's free cleanup policy cover infections that began before migration to Flywheel?
Confirm whether the free cleanup policy applies to the specific plan being purchased and to infections that began before migration to Flywheel [11]. Confirm exactly which actions the owner must complete, and what happens if a premium plugin or theme cannot be updated immediately [20].
Confirm whether the 24–48-hour estimate is measured from ticket creation, scan initiation, or completion of the required customer remediation steps [11]. Ask whether any incident-response or cleanup service-level agreement is available in the contract [7].
Confirm what cleanup includes and excludes - files, databases, accounts, redirects, SEO spam, and blacklist issues [11]. Confirm how often full site files, databases, and malware indicators are scanned, as distinct from nightly plugin vulnerability scans [14].
Confirm backup frequency, retention, restore-point limits, and restoration charges [11]. Confirm the current price and eligibility of Managed Plugin Updates and whether it covers all plugins and themes in use (Evidence ID openai:flywheel-malware-policy-2026, official:C2). Confirm whether WAF rules are customizable and whether they could interfere with security scanners, update services, APIs, or login-protected areas [12]. Confirm whether the 60-day refund policy applies to the selected plan and whether renewals, upgrades, onboarding, or custom terms are excluded (Evidence ID openai:flywheel-pricing, official:C2).
The consensus assessment
Flywheel is a good fit, with meaningful conditions, for a U.S. WordPress owner seeking included malware cleanup, WAF protection, automated core security updates, and human support. Three of seven platforms named it during ranking discovery, at an average listed rank of 4.3 and a best rank of 3, and five platforms independently describe a free cleanup policy in company documentation.
It should not be treated as an unconditional hack-recovery guarantee. Deep scans are request-driven and require specific indication of infection [20]. Cleanup requires customer remediation of passwords, plugins, and themes before it proceeds [11]. The process may take 24–48 hours and may involve disabling mail services or changing the site [11]. Third-party plugin and theme security remains partly the owner's responsibility unless the $8-per-month Managed Plugin Updates add-on is purchased (Evidence ID openai:flywheel-plugin-security-alerts, official:C2). Recovery is constrained by 30-day backup retention [11]. No binding incident-response SLA is documented in the cited materials [7].
Platform ratings ranged from strong (Grok) to good (ChatGPT, Claude, Gemini, Perplexity) to uncertain (DeepSeek) to weak (Kimi), so consensus on overall fit is not unanimous. Buyers who can tolerate a one-to-two-day cleanup window, complete the required remediation steps, and verify plan pricing and cleanup scope in writing before purchase will find Flywheel aligned with this use case. Buyers who need contractual response times, automatic plugin patching on base tiers, or forensic reporting should compare alternatives in the broader managed wordpress hosting category before committing.
How This Review Was Produced
This review evaluates Flywheel only for the hack recovery and malware guarantee use case. It draws on structured fit-research responses from seven AI platforms - ChatGPT, Claude, Gemini, Grok, Perplexity, Kimi, and DeepSeek - each of which assessed Flywheel against five criteria: automatic malware scanning frequency, included hack cleanup guarantee, web application firewall inclusion, vulnerability patching speed, and post-incident support responsiveness.
Ranking statistics reflect only platforms that named Flywheel during ranking discovery. Fit ratings reflect each platform's own assessment of the use case. All factual claims are attributed to the platform that supplied them, using the citation IDs in the source block. No personal testing, customer interviews, or independent verification of Flywheel's performance was performed for this review.
Research limitations
Several limitations materially affect how much weight this review can carry.
Company-owned citations outnumber independent citations substantially. Most security, cleanup, and pricing claims trace to Flywheel's own pages, and company claims should not be read as independently verified (Evidence ID openai:flywheel-malware-policy-2026, Evidence ID openai:flywheel-site-security, official:C2).
Platform research dates differ from the authoritative run date of 2026-10-03. Deepseek's response is dated 2026-01-15, roughly nine months earlier, and DeepSeek ran with search disabled, so its conclusions rest on partial public-page evidence rather than retrieved documentation [1]. Platform-reported dates are provenance metadata and do not independently prove freshness.
Pricing conflicts are unresolved. The cited pricing page lists Starter at $25, Freelance at $96, and Agency at $242 per month billed annually (official:C2), while other retrieved pages show $30, $115, and $290 [6], and Kimi lists Freelance at $92 [5]. Plan naming is also inconsistent, with Tiny, Startup, Starter, Freelance, Agency, and Custom appearing across sources [6].
The supplied URLs were collected from platform responses and were not independently validated by the writer stage. No cited material independently verifies Flywheel's cleanup performance, false-negative rate, customer outcomes, or actual support responsiveness [11]. The exact WAF configuration, exclusions, and plan-level differences are not fully disclosed in the cited materials [12]. Whether Flywheel plans inherit WP Engine security guarantees remains undocumented [22]. Agreement among AI platforms does not establish product quality.
Sources
Company-Owned Sources
- Flywheel - Managed WordPress Hosting: https://getflywheel.com/
- WordPress hosting: https://getflywheel.com/managed-wordpress-hosting/
- WordPress Hosting Features - Flywheel: https://getflywheel.com/platform/features/
- Security Features - Flywheel: https://getflywheel.com/platform/security/
- WordPress Hosting Support - Flywheel: https://getflywheel.com/platform/support/
- WordPress Hosting Pricing and Plans: https://getflywheel.com/pricing
- Schedule a demo of our WordPress hosting platform: https://getflywheel.com/schedule-a-demo/
- Security at Flywheel: https://getflywheel.com/security/
- Real help from real humans, 24 hours a day - Flywheel: https://getflywheel.com/why-flywheel/support/
- Security-focused WordPress hosting - Flywheel: https://getflywheel.com/why-flywheel/wordpress-security/
- Flywheel Malware Cleanup Policy: https://getflywheel.com/wordpress-support/flywheel-malware-cleanup-policy/
- Site security on Flywheel: https://getflywheel.com/wordpress-support/how-does-flywheel-keep-my-site-secure/
- Managed Plugin Updates: Plugin Security Alerts - Flywheel: https://getflywheel.com/wordpress-support/managed-plugin-updates-plugin-security-alerts/
- Plugin Security Alerts: Overview: https://getflywheel.com/wordpress-support/plugin-security-alerts/
- WordPress core updates on Flywheel: https://getflywheel.com/wordpress-support/wordpress-core-updates-on-flywheel/
- WordPress Hosting Pricing and Plans - Flywheel: https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEzIG_3m_4aEvAMUOcKndsaOtbaJy7X-7FpGvzKWpp0bmNUgR3ChQd5Bvq5t2sJkHBa3h15ErLOVX7ikkllaXUVuwrrivxAnJo3jeSXfR0WRCP4_SaPgQ==
- WP Engine Acquires Flywheel: https://wpengine.com/blog/wp-engine-acquires-flywheel/
- Threat Defense - WP Engine: https://wpengine.com/platform/security/
- Stay Safe Virus Guarantee - Avast: https://www.avast.com/en-us/virus-protection-guarantee
Independent Sources
- Flywheel Review 2026: Is This WordPress Host Worth the Premium Price?: https://allaboutcookies.org/flywheel-review
- Flywheel Review 2021: https://cloudzat.com/flywheel-managed-wordpress-hosting/
- Cybernews - Flywheel Review 2026: https://cybernews.com/best-web-hosting/flywheel-review/
- How Flywheel Changed My Mind About WordPress Hosting - Karvel Digital: https://karveldigital.com/flywheel-managed-wordpress-hosting/
- Best WordPress Hosting in 2026 (13 Compared by Use Case: https://smartwp.com/best-wordpress-hosting/
- What happened to Flywheel's $15 Tiny plan? : r/webhosting: https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQE4iRp_UJsDlJkG-C-Gq-c2pHSrbBtOhIGHB5pHWXON9qKbfXKFQoS_BKMSt-fIR-wKEPvMf4EDmx0cjK6NkwCSB-WxI8UgwR4ox_vsAZR2FwGEF5R04LEFx5hPy9DjLagdQj0JdvufpXjwrNOMRj5vh-RH3u45fD0BdBuJHjGkV7cD6-XJTG092s-f6uv6lvgyhgQ=
- The Nine Best WordPress Hosting Providers For Security: https://www.cybersecurityintelligence.com/blog/the-nine-best-wordpress-hosting-providers-for-security-9102.html
- Flywheel Reviews (Aug 2026: https://www.hostingadvice.com/hosting-review/flywheel/
- Best Flywheel WordPress Hosting Alternative: Liquid Web: https://www.nexcess.net/flywheel-hosting-alternative/
- Flywheel Review 2026: https://www.websiteplanet.com/web-hosting/flywheel/
ChatGPT
Claude
DeepSeek
Grok
Perplexity
Kimi
Gemini