First, contain it
Every credential rotated: hosting, database, admin, FTP, API keys. A copy of the infected state kept for analysis before anything is touched. If the site is actively serving malware to visitors, it goes into maintenance mode while the work happens.
Cleaning it properly
Core files replaced from verified originals rather than edited. Plugins and themes reinstalled from source. Uploads searched for PHP that should never be there, the database checked for injected scripts and rogue admin users, and cron jobs and .htaccess rules inspected, the two places reinfection usually hides.
Finding the way in
An outdated plugin, a reused password, a writable directory, a forgotten copy of the site in a subfolder. The report names the entry point, with evidence from the logs where they exist. Then it is closed, the rest is hardened, and review requests go to Google and any security vendor still flagging the site.