Forensic WordPress Data Extraction & Security Cleanup (Back-end Only)

I am rebuilding a WordPress content website on new infrastructure and need an experienced security/SecOps specialist to forensically extract my data from an infected backup, migrate it to a fresh install, and lock down my peripheral accounts. Please read carefully: There is no live site to log into. I no longer have access to the previous hosting. I have a full backup (files and database) and domain control. The backup is infected, and it is the only backup I have (no clean copy exists). I am not sure i even have admin credentials of "WordPress login" SITE VITALS: Compressed Backup Size: around 9.5 GB -Most of that are images in listicle type posts, and few GB of random backup files and logs Database Size: 18 MB THE SCOPE (Function & Security ONLY - No Design): I DO NOT care about the old theme, and old plugins do not matter. I am not looking for a visual redesign or for the site to "look as it did." You will install a basic, default WordPress theme. What matters is the clean extraction of my data (Posts and Images) and the preservation of my URL structure. Crucial Note: My old site had a specific structure of paginated posts. I do not know exactly how it was built in the backend. You will need to identify how that pagination structure was built from the old database and ensure that functionality/URL structure survives the migration to the clean site so my links and links in my posts don't break. REQUIRED TASKS: Forensic Extraction: Extract ONLY the text content/database (wp_posts, wp_options, etc.) and the /wp-content/uploads/ directory in a local offline sandbox. You must manually or programmatically scrub the database and media folders for injected scripts, base64 payloads, and hidden .php files disguised as images. Do not blindly import the old DB. Fresh Rebuild: Set up a clean site on my new hosting using a fresh WordPress core. Import ONLY the sanitized data, media, and paginated post structure. Platform Audit: Audit and secure my existing owner-controlled Cloudflare/DNS, Google Search Console, Google Tag Manager, and Google Analytics accounts. Remove unknown users, API tokens, Workers, malicious rules, tags, and integrations. Rotate all credentials and document everything changed. Or we migrate it to new google account if you advise that is safe or no and pros and cons. Handover: Harden the fresh WP install. Once the clean site is deployed and external accounts are audited, hand over the keys. WHAT IS NOT REQUIRED: No visual design or CSS work. If it looks like a plain text blog, that is perfectly fine. I will provide a copy of the backup and account access only after we agree to terms and you pass vetting. HOW TO APPLY: Please skip the boilerplate cover letter. To filter out AI bots, start your proposal by answering these two questions: When you find a .php backdoor disguised as an image file in the /uploads/ folder, what tool do you use to convert it back into a normal, safe image? How will you locate and preserve my custom paginated post structure from the raw database? Let me know if you have any questions, negotiations etc.