Fix Compromised WordPress Security

My WordPress site is flagging “compromised account login” notices and I have already spotted at least one instance of unauthorized access. I changed all administrator passwords right away, but that is the only measure in place at the moment. The security plugin I had installed was blocking legitimate users, so I removed it and the site is now running with no active protection.

I need a specialist who can:

• Perform a full security audit, including file-system and database scans, to confirm whether any malware or backdoors were left behind.
• Trace and close the point of entry that allowed the unauthorized login.
• Clean or replace any infected core, theme, or plugin files without disrupting the live site.
• Re-implement a security plugin (Wordfence, Sucuri, iThemes Security, or a comparable tool you trust) and configure it so real users are not locked out.
• Harden the server and WordPress settings—correct file permissions, disable XML-RPC if needed, enforce strong passwords, and set up rate-limiting on login attempts.
• Provide a short hand-over report outlining what you found, what you fixed, and any follow-up steps I should take.

Successful completion means the site passes an external malware scan, login pages are protected yet usable, and no further “compromised account” warnings appear over a 7-day observation window.

Access can be granted via cPanel, SSH, and WordPress admin as soon as we agree on the workflow.