1. Isolate
Take the site offline or put it into maintenance mode.
2. Restore
Restore a backup from before the infection — this is the fastest, most reliable route.
3. Close the hole
- Update WordPress, the theme, and every plugin.
- Delete unused plugins and themes.
- Change every password: admin, FTP, database.
4. Prevent
Turn on 2FA and automatic updates.