Clean and Rebuild Hacked WordPress

My small, static WordPress site has been flagged by the host for malicious code. Their system has temporarily disabled the infected files, but the warning persists even after I updated the plugins myself.

What I know so far
• I have NOT pinpointed the exact infected files.
• I do have a recent, clean backup of all content (posts, pages, media).
• I only want to bring back trusted themes / plugins—everything else can go.

Scope of work
I need you to wipe the current installation, scan and confirm it is malware-free, then spin up a fresh WordPress core. After that, restore my content, reinstall only well-vetted themes and plugins, harden basic security settings (file permissions, salt keys, security plugin of your choice), and verify with the host that the account is clear.

Acceptance criteria
1. Host reports zero malicious files after your intervention.
2. Site loads exactly as before (design, content, URLs intact).
3. Dashboard shows only the trusted themes/plugins we agree upon, all updated to latest versions.
4. Written summary of steps taken and simple guidelines for ongoing security.

You’ll receive full cPanel/FTP access plus the backup archive as soon as we start.