Work in this order. Skipping ahead is how sites get reinfected a week later.
1. Change every password. cPanel, FTP, database, website admin, and the email address those accounts recover to. Do this before anything else, or you will be cleaning while the attacker still has the keys.
2. Take a backup anyway. Yes, of the infected site. You may need it later as evidence of what was changed.
3. Find the entry point. Check when files were modified in File Manager, sorted by date - the cluster of changes tells you roughly when it happened. Then look at your access logs around that time. Nearly always it is an outdated plugin, a stolen password, or an old forgotten install.
4. Clean or restore. Restoring a known-good backup from before the intrusion is faster and more reliable than hunting individual files. If your only backups are already infected, replace core files and all plugins and themes with fresh copies from source, and inspect uploads for anything ending in .php - nothing in an uploads folder should be executable.
5. Close the door. Update everything. If the entry point was a plugin, that plugin does not come back.
6. Ask for a rescan. If your site was flagged by Google, request a review in Search Console once it is genuinely clean.
Open a ticket at any point. We can tell you what changed on disk and when, which is usually the fastest way to a real answer.
