WordPress Malware Removal & Security Hardening — Compromised Site Cleanup

Our WordPress site has been compromised. A malicious third-party script was injected into a footer widget (an SEO-poisoning / spam-link injection), which means an attacker has gained write access. We need a thorough cleanup and hardening — not just removal of the visible script. Scope: Remove the injected script and any other malicious code Full malware scan and backdoor removal (Wordfence, Sucuri, or equivalent) Identify and close the entry point (vulnerable/nulled plugins, themes, outdated core) Audit for rogue admin users and unauthorized changes Guide us through rotating all credentials (admin, hosting, FTP/SFTP, database) Harden the site against reinfection If the domain was flagged by Google Safe Browsing, prepare it for a review request This is a professional law firm site, so discretion and reliability matter. We'll provide access once we've agreed on scope. Please share relevant WordPress security experience and your typical cleanup process. Skills: WordPress, Web Security, Malware Removal, PHP, Wordfence, Sucuri Experience level: Intermediate–Expert Project type: One-time project, urgent Duration: Less than 1 week Hourly: $25–45/hr (estimate time)