Clean Malware On WordPress Site

I woke up to an unexpected “your password has been changed” email from my WordPress installation. Within hours the homepage went totally blank and overall performance slowed to a crawl. I’ve already reached out to my hosting provider, but their generic scan hasn’t fixed anything, so I need an experienced WordPress security specialist to take it from here.

What I need you to do
• Perform a complete malware audit, identify every infected file, and safely remove the malicious code.
• Restore the homepage so it displays normally and make sure all other pages load without errors.
• Resolve the current slowdown by clearing any backdoors, suspicious cron jobs, or resource-hungry scripts introduced by the attack.
• Harden the site: update core, plugins, themes, adjust file permissions, and set up a reliable security plugin or firewall so this doesn’t happen again.
• Provide a short report explaining what you found, what you removed, and any preventive steps I should keep following.

Acceptance criteria
1. Homepage renders correctly on desktop and mobile.
2. Site speed returns to pre-infection levels (or better).
3. No malware flags after running a reputable scanner (Sucuri, Wordfence, or similar).
4. Backups, security plugin, and basic hardening measures are in place.

I can supply cPanel, FTP, and WordPress admin access as soon as we start. Looking forward to getting the site clean and fast again, ideally within the next 48 hours.