Urgent WordPress Malware Cleanup

My WordPress site has suddenly stopped opening—browsers time-out or throw security warnings, so I strongly suspect a malware infection. I haven’t added any new plugins or themes recently, which leads me to believe the intrusion came through an outdated core file, an insecure extension already in place, or even a compromised server account.

I need an experienced malware-removal specialist to:

• Perform a full scan (WP core, themes, plugins, database, .htaccess, wp-config) and identify every malicious file or injected script.
• Clean and restore the site so it loads normally, without redirects, pop-ups, or other hidden payloads.
• Patch vulnerabilities: update WordPress, tighten file permissions, remove unused themes/plugins, and configure a firewall (Wordfence, Sucuri, or similar).
• Generate a brief, plain-English report of what you found, what you removed, and the steps you took to harden security.

Please work directly on the live environment (I’ll provide cPanel, SFTP, and wp-admin credentials) and aim to finish within 24 hours, as downtime is costing me visitors and SEO rankings.

If you have handled similar WordPress rescues—especially when the site is completely inaccessible—your expertise will be invaluable.