Nexcess Review for hack recovery and malware guarantee

The research in brief

Nexcess is a good fit for hack recovery and malware guarantee if the buyer is already an existing Nexcess Managed WordPress or WooCommerce customer willing to pay a documented $200 one-time fee per malware incident. Three of seven platforms named Nexcess during the ranking stage (Gemini, Kimi, ChatGPT), with an average listed rank of 5.67 and a best rank of 4. The strongest reason to consider it is a defined remediation workflow with a 14-day repeat-cleanup guarantee, extendable to 30 days when security recommendations are followed ^[4]. The main limitation is that cleanup is paid, not free, and is unavailable to already-infected sites hosted elsewhere before migration ^[5].

Research Snapshot

Why Nexcess Qualified for This Study

Questions explored

• Is Nexcess a good choice for hack recovery and malware guarantee?
• How many AI platforms recommended Nexcess for malware cleanup and hack recovery?

Nexcess qualified because it was named by three of the seven platforms during the ranking stage and because it publishes a documented malware remediation service tied to its managed WordPress and WooCommerce hosting ^[4]. Its listed ranks were 6 (Gemini), 7 (Kimi), and 4 (ChatGPT), producing an average of 5.67 and a best rank of 4. That is a mid-pack showing rather than a top-of-list result, and the ranking-stage identity normalization reported unresolved official-domain conflicts, although Nexcess's official website and documentation were recovered and used for this assessment ^[4].

Fit ratings split across platforms: ChatGPT, Claude, and Perplexity rated Nexcess a good fit, while DeepSeek, Gemini, Grok, and Kimi rated it mixed. That split is the central finding of this review. Nexcess is credible for buyers who want a structured, paid cleanup service, and weaker for buyers whose requirement is free, unlimited, or bundled malware removal.

The hosting offering in focus

Questions explored

• Which Nexcess plan or service should a buyer choose if they need paid malware cleanup with a re-infection guarantee?
• Is the Nexcess Malware Remediation Service available to new customers or only existing hosting customers?

The relevant offering is the Nexcess Malware Remediation Service for Managed WordPress and WooCommerce sites, paired with Nexcess Managed WordPress or WooCommerce hosting ^[4]. It is a one-time service, not a hosting feature, and it is restricted to existing eligible Nexcess hosting customers ^[23]. Nexcess states that malware cleanup is not provided during migration and that an infected site cannot proceed through migration until security issues are resolved ^[5].

The documented remediation workflow includes an initial backup, vulnerability scans for WordPress core, plugins, and themes, removal of infected core files and database infections, core updates, replacement and updating of infected plugins, theme updates, administrator-account review, password and salt changes, hardening, and a final malware scan ^[4]. Nexcess states that if malware is found again within 14 days of the initial service, it will remediate again, and that the period extends to 30 days only if the customer complies with the security recommendations ^[4].

What the AI Platforms Agreed About

Questions explored

• What do AI platforms agree on about Nexcess malware cleanup and hack recovery?
• Does Nexcess include free malware cleanup in its managed WordPress hosting plans?

The clearest point of agreement is that Nexcess does not provide free, bundled malware cleanup. OpenAI, Claude, Gemini, Grok, Perplexity, Kimi, and DeepSeek all describe the remediation service as a paid one-time offering rather than an included guarantee ^[4]. Google states directly that Nexcess requires an extra paid fee for malware scanning and removal compared with competitors who bundle it ^[36].

Platforms also agreed on the core service terms. The $200 one-time fee per incident appears across ChatGPT, Claude, Gemini, Grok, and Perplexity ^[4]. The 14-day repeat-remediation window, extendable to 30 days with compliance, is reported by ChatGPT, Claude, Gemini, Grok, and Perplexity ^[4]. The 24-hour first-response SLA is reported by ChatGPT, Claude, Gemini, Grok, and Perplexity ^[4].

Platforms further agreed that Nexcess managed hosting includes preventive security infrastructure: a web application firewall, daily backups, automatic updates, and 24/7 support ^[26]. Google reports that managed WordPress plans include a WAF, DDoS protection, performance shields, and Kadence Security Pro ^[16].

Where the AI Platforms Disagreed or Were Uncertain

Questions explored

• How often does Nexcess scan for malware, and is that frequency independently verified?
• Is Nexcess a good fit for a buyer who needs free or unlimited malware cleanup?

Scanning frequency is the largest unresolved conflict. Nexcess marketing materials describe nightly malware scans and alerts ^[26], and an independent review repeats the nightly-scan claim ^[33]. Kimi describes automated daily malware scanning ^[30]. But the remediation documentation describes scans performed as part of a one-time service, and the public materials do not fully specify scan coverage, detection technology, or alert thresholds ^[4]. Perplexity states that the exact always-on scan frequency for this hosting use case is unclear ^[4]. Deepseek, which ran without search enabled, found no published scanning frequency at all ^[11].

Independent reviewers add a visibility caveat. Cybernews reports that Nexcess claims malware scans and site monitoring are standard practice, but that this is an internal measure users cannot see or control, so buyers must take the provider's word for it ^[31].

A second conflict concerns whether any cleanup is free. One source indexed by Claude claims that if malware is found, the team cleans it up for free on managed hosting plans, which conflicts with the documented $200 fee for the formal remediation service; it is unclear whether that refers to automated tool cleanup or the professional service ^[4]. Google notes that some promotional listings mention malware detection and removal as standard features while official knowledge base documentation clarifies the $200 per-incident charge ^[1].

Guarantee scope is also uncertain. Anthropic asks whether the 14-day window covers new attack vectors or only residual malware from the same breach ^[4]. No platform located published data on remediation success rates, average resolution time, or customer satisfaction specifically for the malware remediation service ^[4].

Features for this workload

Questions explored

• What security features does Nexcess include for hack recovery and malware guarantee?
• Does Nexcess include a web application firewall and automatic vulnerability patching?

Nexcess documents a defined cleanup workflow rather than a vague security promise. The remediation service covers backup, scanning, infected-file removal, database cleaning, core and plugin replacement, theme updates, administrator-account review, credential rotation, hardening, and a final scan (Evidence ID openai:c1, Evidence ID anthropic:21-7 through Evidence ID anthropic:21-19).

Preventive features reported across platforms include nightly malware scans and alerts on Managed WordPress plans ^[26], a web application firewall ^[26], and ModSecurity deployed on every server as a WAF ^[13]. Nexcess documentation describes firewall integration with Patchstack for real-time vulnerability scanning and virtual patching that applies automatically without manual intervention ^[8].

On patching, Nexcess advertises automatic WordPress core and plugin updates and states that its engineers may scan its fleet and automatically apply critical WordPress patches where possible ^[26]. Version Management automates updates to core, themes, and plugins, with options to apply immediately, delay, or disable for testing, and can automatically apply security fixes ^[6]. When no fix exists, firewall virtual patching provides interim protection ^[6]. An independent security advisory documents proactive vulnerability patching in a 2026 incident ^[34]. Nexcess also acknowledges that automated updates can fail for site-specific reasons ^[14].

Backups are reported as daily and off-site, with retention varying by plan; one independent review states backups are stored off-site for up to 30 days ^[31], and Nexcess documents free daily courtesy backups kept for 30 days ^[3]. Post-incident responsiveness is documented as a 24-hour SLA for the first response to a remediation request, with 24/7/365 support advertised ^[4]. No platform established a guaranteed time to complete cleanup or restore a site ^[4].

Pricing, renewal terms, and ongoing costs

Questions explored

• How much does the Nexcess Malware Remediation Service cost per incident, and is it included in hosting?
• What are the cancellation and money-back terms for Nexcess hosting and remediation?

The documented malware remediation service is a one-time $200 fee per incident and is available only to existing Managed WordPress or Managed WooCommerce customers ^[4]. Hosting is billed separately, and the current public page displays promotional pricing with different monthly or prepaid-term options ^[26]. Anthropic reports a $19/month starting price for managed wordpress hosting ^[4], while Kimi reports tiered plans from approximately $13/month to $700+/month depending on tier, with the remediation add-on price not publicly displayed ^[20]. Google reports high pricing confidence on the $200 fee but describes hosting as a separate subscription ^[1].

Contract and refund terms are mixed. Nexcess advertises a 30-day money-back guarantee on hosting ^[22]. Nexcess states that services bound by contract cannot be canceled until the contract expires, with cancellation requests submitted through the client portal or billing team ^[22]. Google states that one-time technical services like malware remediation are typically non-refundable unless the cleanup guarantee is breached ^[1]. Repeat cleanup after the guarantee period may incur another $200 incident fee ^[4]. The public remediation documentation does not identify separate forensic, data-restoration, business-loss, or third-party incident-response coverage ^[4]. Renewal pricing, taxes, and the exact price for a buyer's selected plan were not independently established ^[26].

Best Suited For

Questions explored

• Who is Nexcess best suited for in hack recovery and malware guarantee?
• Is Nexcess worth it for an existing Managed WordPress customer with an active infection?

Nexcess is best suited to existing Nexcess Managed WordPress or WooCommerce customers with an active malware incident who want a documented, provider-assisted cleanup ^[4]. It also fits WordPress owners who value core, plugin, and theme updates, credential rotation, hardening, and a final verification scan as part of remediation (Evidence ID openai:c1, Evidence ID anthropic:21-7 through Evidence ID anthropic:21-19). Buyers willing to pay a fixed $200 per incident for a defined service with a limited repeat-remediation promise are the clearest match ^[4]. Site owners who want bundled nightly scanning, WAF protection, daily backups, and 24/7 support as preventive infrastructure also fit the profile ^[26]. WooCommerce store owners needing PCI DSS compliance support alongside remediation are another reported fit ^[29].

Probably Not Best Suited For

Questions explored

• Who should not choose Nexcess for hack recovery and malware guarantee?
• Is Nexcess a poor fit for a buyer who needs free malware removal included in hosting?

Nexcess is not a strong fit for buyers whose primary requirement is free malware removal included in the hosting price ^[4]. It is also a poor fit for a newly hacked site hosted elsewhere that must be cleaned before migration, because Nexcess does not perform malware cleanup during migration and infected sites cannot proceed through migration until security issues are resolved ^[5]. Buyers requiring an unlimited or long-term malware-remediation warranty should look elsewhere, since the guarantee is limited to 14 days and conditional for the 30-day extension ^[4]. High-risk sites needing a formally defined incident-response SLA faster than a 24-hour first response are also a weak match ^[4]. Magento sites are excluded, as the service is limited to WordPress and WooCommerce ^[28]. Budget-conscious buyers may find the service pricey and not beginner-friendly, per an independent review ^[37].

When Another Option May Be Better

Questions explored

• What is a better alternative to Nexcess for a buyer who needs free unlimited malware cleanup?
• When should a buyer choose a standalone malware removal service instead of Nexcess?

Another option may be better when the buyer will not accept a per-incident fee and needs free, unlimited malware cleanup included in the plan ^[4]. Kimi names SiteGround, WP Engine, and Flywheel as alternatives that include free malware removal in base plans, and Gemini names Kinsta, WP Engine, and DreamHost for the same reason ^[20]. A specialized incident-response or malware-removal service may be better if the site is currently infected and hosted outside Nexcess ^[4]. Anthropic notes that standalone services such as Sucuri or Wordfence offer cleanup without committing to a managed hosting plan ^[4]. A provider with a stronger written remediation SLA is preferable if a 24-hour first-response commitment is insufficient ^[4]. Buyers needing post-cleanup monitoring, blacklist-removal assistance, forensic reporting, or compensation terms should choose a provider that explicitly offers them ^[4]. Organizations requiring forensic investigation or legal documentation of a breach should look beyond Nexcess, which focuses on cleanup rather than forensics ^[4].

Questions to ask before choosing a provider

Questions explored

• What should a buyer confirm with Nexcess before paying for malware remediation?
• Which guarantee exclusions and scan details should a buyer verify before signing up?

Buyers should confirm whether the $200 remediation service is available for the exact Managed WordPress or WooCommerce plan selected ^[4]. They should ask whether the 14-day guarantee covers reinfection from the same or a different vulnerability and what exclusions apply ^[4]. They should confirm what specific actions are required to qualify for the conditional 30-day guarantee ^[4]. They should ask for the committed time to begin cleanup and the expected time to completion after the 24-hour first response ^[4]. They should verify whether custom themes, custom plugins, database injections, backdoors, SEO spam, and compromised administrator accounts are included ^[4]. They should ask whether the service includes Google Safe Browsing, email-provider, or other blacklist-removal assistance ^[4]. They should confirm the exact malware-scan frequency, scope, retention, and alerting rules for the selected plan ^[4]. They should ask whether the WAF is enabled by default and whether it is server-level ModSecurity, Cloudflare WAF, or another product with separate limits or fees ^[4]. They should confirm backup retention and restore points on the selected plan ^[4]. They should request regular, renewal, annual-prepayment, cancellation, and tax-inclusive costs for the selected U.S. plan ^[26].

The consensus assessment

Nexcess is a good fit for hack recovery and malware guarantee, but it is not a true free-hack-cleanup guarantee. Three of seven platforms named it during the ranking stage, and fit ratings split three good (ChatGPT, Claude, Perplexity) against four mixed (DeepSeek, Gemini, Grok, Kimi). The strongest case for Nexcess is a documented $200-per-incident remediation service with a defined workflow, a 14-day repeat-cleanup guarantee extendable to 30 days with compliance, a 24-hour first-response SLA, and preventive infrastructure including a WAF, daily backups, and automatic updates ^[4]. The strongest case against it is that cleanup is paid rather than included, the guarantee window is short and conditional, no total remediation or restoration time is guaranteed, the service is restricted to existing eligible customers, and cleanup is not performed during migration ^[4]. Buyers who need free, unlimited, or bundled malware removal should compare alternatives before committing.

How This Review Was Produced

This review evaluates Nexcess only for the hack recovery and malware guarantee use case. It draws on seven platform fit-research responses collected for the 2026-10-03 research run, plus the ranking-stage statistics for Nexcess. Platform responses were treated as platform-reported evidence, not independently verified facts. Company-owned citations materially outnumber independent citations in the supplied material, so company claims are described as company claims rather than independently confirmed findings. Where platforms disagreed, the disagreement is reported rather than resolved. The consensus index for this category is available at hack recovery and malware guarantee, and the broader category directory is at managed wordpress hosting.

Research limitations

Several limitations apply. The supplied URLs were collected from platform responses and were not independently validated by the writer stage. Company-owned citations materially outnumber independent citations, so most security and remediation claims rest on Nexcess's own documentation. Platform-reported research dates differ from the authoritative run date: DeepSeek reported 2026-06-13 while the other six platforms reported 2026-10-03, and DeepSeek ran without search enabled, which limits its findings. The deterministic identity audit contains unresolved official-domain conflicts and used an exact-name fallback, so some identity metadata remains unverified. The official fact-source page for this run was unavailable, so no official-page excerpts were retrieved. No platform located independent evidence confirming actual remediation outcomes, scanning detection rates, or cleanup success metrics. Public materials do not clearly define exclusions for severe compromise, custom code, compromised third-party services, data loss, blacklist removal, or business interruption. AI-platform agreement does not prove product quality; it reflects what the included platforms reported for this prompt.

Sources

Company-Owned Sources

1. Malware remediation service for managed WordPress/WooCommerce sites: https://docs.nexcess.com/help-articles/malware-remediation-service-for-managed-wordpresswoocommerce-sites/
2. Migrations - how Nexcess handles websites infected with malware: https://docs.nexcess.com/help-articles/migrations-how-nexcess-handles-websites-infected-with-malware/
3. Website backups and the Nexcess data backup policy: https://docs.nexcess.com/help-articles/website-backups-and-the-nexcess-data-backup-policy/
4. Malware remediation service for managed WordPress/WooCommerce sites: https://docs.nexcess.com/sites-stores/hosting-services/sites-and-stores/malware-remediation-for-wordpress-and-woocommerce/
5. Migrations - how Nexcess handles websites infected with malware: https://docs.nexcess.com/sites-stores/migrations/nexcess/migrating-with-malware/
6. All about the Solid Security Settings - Nexcess Documentation: https://docs.nexcess.com/software/kadence/solid/solid-security/security-settings/
7. All about Solid Security Site Scans - Nexcess Documentation: https://docs.nexcess.com/software/kadence/solid/solid-security/site-scans/
8. All about Firewall with Solid Security - Nexcess Documentation: https://docs.nexcess.com/software/kadence/solid/solid-security/solid-security-firewall/
9. WordPress Hosting: Why WordPress Users Trust Nexcess: https://help.nexcess.com/74095-wordpress/wordpress-optimized-hosting
10. Nexcess Malware Remediation Service: https://nexcess.net/
11. Nexcess Managed WordPress Hosting: https://nexcess.net/managed-wordpress-hosting/
12. Nexcess Support: https://nexcess.net/support/
13. Why do I need ModSecurity?: https://prod-marketing.nexcess.net/help/why-do-i-need-modsecurity/
14. Nexcess Server Status Incident History: https://status.nexcess.net/history
15. Malware Remediation Service for Managed WordPress/WooCommerce Sites: https://www.liquidweb.com/help-docs/hosting-service/nexcess/malware-remediation-for-wordpress-and-woocommerce/
16. Best Managed Hosting for WordPress | Proven Speed and Scale - Liquid Web: https://www.liquidweb.com/products/managed-wordpress/
17. Website Malware Removal - Liquid Web: https://www.liquidweb.com/services/add-ons/security/malware-removal/
18. Managed Hosting for Agencies | WordPress, WooCommerce: https://www.nexcess.com/solutions/hosting-for-agencies/
19. Nexcess Support and Service: https://www.nexcess.net/
20. Nexcess Malware Remediation Service: https://www.nexcess.net/blog/introducing-malware-remediation-service/
21. Fully Managed WordPress Hosting: $4/mo: https://www.nexcess.net/cloud/wordpress
22. How to Cancel a Specific Nexcess Hosting Service: https://www.nexcess.net/help/cancel-a-specific-nexcess-hosting-service/
23. Malware remediation service for managed WordPress/WooCommerce sites - Nexcess Documentation: https://www.nexcess.net/help/malware-remediation-wordpress-woocommerce/
24. Managed Application Support Documentation: https://www.nexcess.net/help/managed-application-support-documentation/
25. Migrations - how Nexcess handles websites infected with malware: https://www.nexcess.net/help/migrations-for-websites-infected-with-malware/
26. Fully Managed WordPress Hosting: https://www.nexcess.net/managed-wordpress-hosting/
27. Enterprise WordPress Hosting | Nexcess: https://www.nexcess.net/solutions/enterprise-wordpress-hosting/
28. Website Malware Removal: https://www.nexcess.net/support/website-malware-removal/
29. Why do I need ModSecurity?: https://www.nexcess.net/type/nexcess/page/39/
30. Nexcess Managed WordPress Hosting Security Features: https://www.nexcess.net/wordpress-hosting/

Independent Sources

31. Nexcess review: managed services for worry-free hosting: https://cybernews.com/best-web-hosting/nexcess-review/
32. Nexcess Web Hosting Review 2024: Our First-Hand Look: https://hacktheentrepreneur.com/nexcess-review/
33. Nexcess Managed WordPress Review (2026) | HostDuel: https://hostduel.com/hosting/nexcess
34. Nexcess Security Advisory: Critical WordPress Vulnerability: https://isdown.app/status/nexcess/incidents/659070-security-advisory-critical-wordpress-vulnerability-click2shell
35. Nexcess Review: Best Managed WordPress Host Platform - ShieldReviews: https://shieldreviews.com/it-security/antivirus-software/nexcess-review/
36. Nexcess Alternative: Cloudways for Superior Hosting Value: https://www.cloudways.com/en/nexcess-alternative.php
37. Nexcess review: https://www.techradar.com/reviews/nexcess