Spam pages showing up in Google, a host suspension notice, visitors getting redirected somewhere they didn't ask for. The fastest fix is someone who can get into the actual code, find exactly what changed, and close the door it came through, not just run a scanner and hope.
Triage comes first. What's actually visible right now, what the host has already flagged, whether the site is fully down or just compromised in the background. That tells me how urgent the rest of this is before I touch anything.
From there it's a full sweep across the file system, comparing core and plugin files against known clean versions rather than trusting a single scan result. Most infections leave more than one file behind, and a scanner that only catches the obvious one leaves the site reinfected within days.
Once it's clean, I patch or replace whatever let the attacker in, and only then move to hardening, login protection, firewall rules, permission fixes, because none of that matters if the original hole is still open.
That's the second step, not the first. Once the site is verified clean and the entry point is closed, I request a review through Google Search Console. The warning clears once Google re-crawls and confirms it, usually within a few days of a verified request.
Not always. It depends on where the compromise actually came from. A cross-contaminated shared hosting account is a different problem than an outdated plugin or a leaked password on an otherwise clean server. I check which one happened before recommending a hosting change.
Initial cleanup usually happens within a day once I have access to the site and hosting. Full hardening, tested backups, and monitoring go in right after, once the site is confirmed clean rather than just visibly quieter.