WordPress Malware Cleanup

My WordPress site is currently crippled by a hack that is causing unauthorized redirects, filling pages with spam, and throwing periodic 500 errors. I can still reach the dashboard, though many areas are greyed-out or throw “permission denied” messages, so deeper access (SSH, cPanel, or FTP) will probably be needed.

No previous cleanup attempts have been made—everything you find will be in its original compromised state. I need a specialist who can:

• Pinpoint and remove every piece of malicious code or file, whether it’s buried in the database, core, theme, or plugin folders.
• Restore proper core files and update WordPress, themes, and plugins to their latest safe versions.
• Reinstate full admin functionality so I’m no longer locked out of settings or plugin pages.
• Harden the installation (security keys, file permissions, .htaccess rules, malware firewall such as Wordfence or Sucuri, regular backups) so the same exploit cannot happen again.
• Provide a brief post-cleanup report outlining what was found, what was fixed, and recommendations for ongoing security.

I’m ready to hand over hosting credentials right away so you can start scanning with tools like WP-CLI, Maldet, or your preferred security suite. Speed is important because the redirects are damaging traffic and reputation, but I also need the job done thoroughly—no quick band-aid that leaves backdoors behind.

When you reply, please confirm you can begin within the next 24 hours and estimate how long the full cleanup and hardening will take.