WordPress Malware & Spam Cleanup

My WordPress site has been compromised and is now publishing unauthorized posts. I need a thorough malware sweep, removal of every malicious file or script, and a fix that prevents the spam content from re-appearing. There are currently no security plugins running, so after you clean the installation I’ll also rely on you to harden the setup with a reputable solution (Wordfence, Sucuri, iThemes Security, or another you trust) and configure it for ongoing protection.

Please work directly on the live site, keep all legitimate content intact, and provide a concise report of what you found, what you removed, and the steps you took to secure everything.

site is sachkhand.ca