Cleanup, done by hand.

Most “WordPress security” services are scanners with a logo. They catch the obvious signatures, miss the obfuscated PHP loaders, and bill monthly for the privilege.

threatover exists because the alternative — a real person reading diffs, auditing the database, and closing the actual entry vector — shouldn't require a five-figure incident response engagement. It should be one flat rate, done carefully, with a written report you can hand to a client or insurer.

One thing. Done well.