Most people clean the malware first, the site works again, and it is reinfected within days — because the way in was never closed. Do it in this order instead.
1. Take it offline
Not because the site is embarrassing, but because a compromised site is usually being used against other people: sending spam, hosting phishing pages, attacking someone else. Every hour it stays up makes your domain reputation worse.
Put up a maintenance page or suspend the account while you work.
2. Change every credential
All of them, and in this order: hosting control panel, FTP and SSH, database user, every WordPress admin account, and the email addresses those accounts recover to.
Then force all WordPress sessions to log out — changing a password does not invalidate an existing session, so an attacker with a live cookie stays logged in while you congratulate yourself.
3. Find out when, before you clean
Once you clean, the evidence is gone. Before that, look at file modification times and pick out what changed and when. Check the access logs around that date for the request that landed.
You need this date for one practical reason: it tells you which backup is safe. Restoring the copy from last night when the compromise was three weeks ago just reinstalls the problem.
4. Restore, do not scrub
If you have a clean backup from before the intrusion, restore it. That is faster and far more reliable than trying to find every injected file by hand — backdoors are usually plural, and one survivor is enough.
If you have no clean backup: reinstall WordPress core fresh, reinstall every plugin and theme from source rather than repairing them, and keep only wp-content/uploads — checking it for PHP files, because nothing in uploads should ever be executable.
5. Close the door
Almost always one of three things: an outdated plugin with a known exploit, a weak or reused admin password, or a stolen FTP credential from an infected local machine.
Update everything. Delete plugins and themes you are not using — an inactive plugin is still a file on disk and still exploitable. Turn on two-factor for admin logins. And scan the computer you upload from, because if the credentials leaked from your laptop, cleaning the server changes nothing.
6. Afterwards
Check Google Search Console for a security notice and request a review once you are clean. Check whether your domain landed on a mail blocklist, which usually shows up as email suddenly bouncing. And take a fresh backup immediately — your clean state is worth keeping.
If a site on our servers gets hit, tell us early — we can pull logs and older backups that make the clean-up far quicker. Every plan keeps automatic backups.