Clean & Secure GoDaddy WordPress

Several WordPress installations on my GoDaddy shared hosting account have been compromised, and the infection appears to span the entire account. I need the environment wiped clean, then fully restored and hardened.

Current state
• No backups exist right now, so the first step is to generate full site-and-database backups before any destructive action takes place.
• After the backups are safely stored off-server, I want the hosting space scrubbed—every directory, database, and configuration file must be inspected and purged of malicious code.
• Once clean, everything should be restored exactly as it is today (same themes, plugins, content, permalinks), followed by a full security hardening pass.

Key expectations
– Create verified, restorable backups.
– Remove all malware and backdoors from files, databases, and cron jobs.
– Reinstate the sites from the clean backups so visitors see no difference except faster, safer pages.
– Apply security best practices: updated core/theme/plugin versions, strong file permissions, firewall rules, Web Application Firewall such as Wordfence or a comparable tool, and ongoing malware monitoring.
– Provide a concise report of what was infected, what was removed, and recommendations to keep the sites secure.

Familiarity with GoDaddy cPanel, SSH, WordPress CLI, and scanners like Sucuri, ImunifyAV, or maldet will make this go smoothly. Downtime must be kept to an absolute minimum; please outline how you intend to stage the work and approximate timelines when responding.