Some hosts charge extra to clean up a hacked site. Every paid WordPress.com plan includes malware removal, a firewall, and DDoS protection, plus free migration.

Source