WordPress Security Expert Needed – Multiple Sites Infected with Fake CAPTCHA Malware

Description We are looking for an experienced WordPress security expert to clean two WordPress websites that have been infected with the recent Fake CAPTCHA / ClickFix malware. Visitors are being redirected to a fake Google reCAPTCHA page instructing them to press Windows + R and run a command. We need someone who has experience removing this type of malware and identifying how it was introduced. The websites are hosted on DigitalOcean, managed through ServerPilot, and use Cloudflare. Scope of Work The selected freelancer will: Investigate both infected WordPress websites. Remove all malicious code and backdoors. Check WordPress core, plugins, themes, uploads, and the database. Review server files for malicious modifications. Verify that the malware has been completely removed. Check for compromised administrator accounts. Review Cloudflare configuration if necessary. Explain the root cause of the infection. Provide recommendations to prevent reinfection. Deliverables Both websites cleaned and functioning normally. No fake CAPTCHA pages or malicious redirects. Written summary of: Root cause Files cleaned or replaced Recommendations to prevent future infections Environment WordPress DigitalOcean ServerPilot Cloudflare Required Experience Please apply only if you have experience with: WordPress malware removal Website incident response Linux hosting Cloudflare DigitalOcean Experience with the ClickFix / Fake CAPTCHA campaign is a strong plus. Screening Questions Have you removed Fake CAPTCHA / ClickFix malware before? Please describe the project. What would you check first to determine how the websites were compromised? What steps do you take to ensure the malware doesn't return? Approximately how long would you expect this project to take?