WordPress News Malware Cleanup and securing it

My news-focused WordPress site has recently begun generating unfamiliar files and scripts in the theme and uploads directories. I need those malicious pieces completely removed and the installation hardened so this doesn’t happen again.

I can supply full WordPress admin credentials along with FTP if you need to trace anything server-side. Once the cleanup is done I want the site scanned again to confirm it is 100 % clean and then have essential security measures put in place—firewall rules, login-attempt limits, core/plugin/theme updates and a scheduled malware scan—so I receive an alert long before any future compromise takes hold.

Deliverables should be clear and verifiable:
• Detailed log of every infected file you remove or repair
• Confirmation scan showing zero traces of malware or suspicious scripts
• List of security steps you implemented and how to maintain them going forward

Feel free to use tools such as Wordfence, Sucuri, or any CLI scanners you prefer, as long as the final result is a clean, fast, and secure news site ready to serve readers without interruption.