WordPress Malware Removal & Hardening

My WordPress site is showing signs of infection—odd text shifts have started appearing even though I’m not sure if other functionality has been affected yet. I ran a malware-scanning plugin which flagged multiple infected files, but I need a dev to remove the infected files and make sure there is no malware anymore.

Here’s what I need from you:
• Perform a full scan via SSH, cPanel, or preferred tools to locate every malicious file, script, and database entry.
• Safely remove or clean those items without breaking the theme, plugins, or core.
• Patch whatever vulnerability allowed the intrusion: update WordPress core, themes, plugins, and tighten file permissions.
• Add lightweight hardening measures—.htaccess tweaks, login-limit, firewall rules—so this doesn’t happen again.
• Supply a concise cleanup report listing what you found, what you removed, and recommendations for future maintenance.

The site should load normally, with no hidden redirects or suspicious code remnants, and must pass a fresh malware scan before the job is considered complete.