My WordPress site has slowed to a crawl over the past week and every performance check hints at hidden malware rather than resource-heavy plugins—I have not added any new plugins or themes recently. I’m looking for a thorough cleanup that removes every malicious file, patching any backdoors and tightening core, theme, and plugin code so the site loads swiftly again. Here’s what I expect: • Full scan using your preferred security tools (Wordfence, Sucuri or similar) • Manual inspection of wp-content, database tables, .htaccess and wp-config.php to locate obfuscated or injected code • Safe removal of malware without disturbing existing functionality or design • Hardening steps: updating salts, resetting passwords, locking file permissions, configuring a Web Application Firewall, and setting up scheduled scans • Brief report outlining what you found, what you removed, and the preventive measures you put in place Once complete, the site should return to normal speed, no malicious processes should re-appear after 72 hours of monitoring, and Google Safe Browsing or any security scanner should flag the domain as clean.