Clean Malware-Infected WordPress Site

My business website on WordPress has been flagged as dangerous due to a recent malware attack. I still have full admin-panel access, but visitors now see warning pages and some links redirect to spam. I need a WordPress security specialist to:

• Locate and remove every malicious file, script, and database injection.
• Restore core WordPress, theme, and plugin files so the site loads normally without warnings.
• Implement basic hardening (firewall plugin such as Wordfence or Sucuri, secure file permissions, updated salts, disabled xml-rpc, etc.) to prevent a repeat attack.
• Generate a brief, clear report outlining what was found, what was fixed, and any recommendations for ongoing maintenance.

Once you finish, the site must load cleanly in all major browsers with no security warnings from Google Safe Browsing or other scanners. I will provide cPanel and WP-admin credentials immediately after we agree on the job, along with the latest backup if you need it.