The problem
The symptoms were inconsistent: some visitors saw the expected site while other traffic was redirected or search results showed pages the business did not create. That pattern often means the infection is conditional, hidden in generated content, or controlled by code that only triggers for certain referrers or devices.
The cleanup path
Contain the site without destroying evidence
The first move is to preserve enough of the site to understand the compromise. Deleting suspicious files immediately can remove the clue that shows how the attacker got in.
Check files, database, users, and scheduled tasks
A useful cleanup looks beyond the obvious infected file. It can include checking WordPress core files, plugins, themes, rogue administrators, injected database content, cron tasks, writable folders, backdoors, and server-level files attackers commonly use to return.
Close the entry point
After removing malicious code, credentials and secret keys should be rotated where needed, vulnerable software replaced or updated, file permissions corrected, and backups or monitoring put in place. If Google or a browser warning is active, the cleaned site can then be submitted for review through the appropriate account.
Why scanner-only cleanup is risky
A scanner can help find suspicious files, but reinfections usually happen because the entry point remained open. Cleanup and hardening need to be handled together.