WordPress Malware Removal, SEO Spam Cleanup & Full Security Audit — Kinsta Hosting

Our WordPress website, https://topdocbrasil.com.br/, has been compromised again after a previous cleanup. The current visible issue is SEO spam: the website is publishing unauthorized gambling and casino articles in multiple languages, including Russian, German, Azerbaijani, and English. Examples can currently be seen at: https://topdocbrasil.com.br/blog/ These are not simple visual redirects. The malicious content exists as individual WordPress pages/posts with indexable URLs, canonical tags, full articles, images, and external links. Therefore, we need an experienced WordPress security specialist who can perform a complete forensic investigation, remove the infection, identify the original entry point, and prevent reinfection. The website is hosted on Kinsta. We do not want to migrate hosting. Required scope of work 1 - Create a safe backup/snapshot before making changes and preserve relevant evidence. 2 - Review Kinsta access, error, PHP and server logs to determine when and how the compromise occurred. 3 - Scan and manually audit the complete WordPress filesystem. 4 - Verify WordPress core files against official checksums. 5 - Audit all plugins, themes, must-use plugins, drop-ins and custom code. 6 - Inspect the custom topdoc theme for unauthorized or obfuscated code. 7 - Inspect wp-config.php, .htaccess, cron jobs, scheduled actions and server configuration. 8 - Check the uploads directory and other writable directories for PHP files, web shells and backdoors. 9 - Perform a complete database audit, including: Unauthorized gambling/casino posts and pages, Malicious JavaScript, iframes and external links, Injected content in posts, widgets and options Suspicious autoloaded options, Unauthorized administrator accounts Modified user roles and capabilities Application passwords and active sessions Spam redirects and conditional malware If possible Identify and document the root cause and original point of entry. Remove all malware, backdoors, unauthorized content and persistence mechanisms. Remove or replace abandoned, pirated, vulnerable or unnecessary plugins and themes. Update WordPress, plugins and themes safely, with regression testing. Rotate or help us rotate all relevant credentials: WordPress administrators Kinsta SFTP/SSH Database WordPress salts and sessions DNS/CDN and related administrator accounts where applicable Configure appropriate file permissions and WordPress security hardening. Check whether other Kinsta environments, backups or connected services are compromised. Clean caches and verify the website from logged-in and logged-out sessions, desktop and mobile. Assist with SEO recovery:Produce a list of all malicious URLs Remove malicious URLs from sitemaps and internal links Return appropriate 404 or 410 responses Help request removals/reindexing in Google Search Console Check for spam pages indexed by Google Required experience Proven experience investigating hacked WordPress websites Manual malware and database analysis—not only running an automated scanner Experience with SEO spam, Japanese keyword hacks, casino/gambling spam and persistent backdoors Experience with Kinsta or similar managed WordPress hosting Ability to analyze PHP, JavaScript, SQL, WordPress cron and server logs