Remove WordPress Malware Traffic Spike

My WordPress install is currently pushing out around 1 GB of data every single day—almost ten times our normal 140 MB. The only visible clue is a surge of strange, automated requests, and the attached screenshot shows how the traffic has ballooned over the past two months.

I have not taken any steps yet: no security plugins are active, no passwords have been reset, nothing has been quarantined or deleted. I’m looking for a specialist who can jump in, locate and remove every trace of the malware or malicious script that’s spamming the site, and then harden the installation so this doesn’t happen again.

To consider the job complete I’ll need:
• A clean scan result (your tool of choice—Wordfence, Sucuri CLI, or similar—showing zero infected files)
• Traffic levels back down to roughly 140 MB/day or lower within a week of your fix
• A short, plain-English report outlining what was found, what was removed, and the preventive measures you put in place

You’ll have full access to the hosting panel (cPanel/SSH) and wp-admin as soon as we start. If a temporary maintenance page is required during cleanup, let me know and I’ll approve it immediately.