A hacked WordPress site is a public page, a user, or a file that someone else changed. The first job is to stop new damage. The second job is a written cleanup. Mixing those two, or paying a stranger who emailed you about the hack, makes it worse.
Stop the bleeding
Take a note of the strange URL or the Google warning. Ask the host to suspend public access if the page is sending people somewhere ugly. Change the email password, the host password, and the registrar password from a different device. Do not type those passwords into the hacked site.
Do not delete random folders because a forum said so. A deleted upload folder can remove the photos the business needs, and it does not prove the back door is gone.
What a real cleanup includes
A backup of the damaged site, so there is a record. A comparison against a clean copy where one exists. Removal of the files and users that do not belong. A new set of passwords. A check that the homepage, the form, and the checkout show your content again. Then a short note of how the door was likely opened: an old plugin, a reused password, or a leftover admin account.
That note is the scope. WordPress malware removal is billed when that cleanup matches the note, not before anyone looks. If the site is too damaged to trust, the honest next milestone is a rebuild, not another patch.
If the only symptom is a white screen after an update, start with the critical error note instead.
Questions
How do I know the site was hacked?
Pages you did not write, a Japanese or pharma keyword stuffed into titles, a new admin user, or Google warning visitors. A slow site alone is not a hack.
Should I pay a message that offers to fix it?
No. Pay the host or a studio you chose, not a stranger who wrote to you from the hack. Change the important passwords from a phone or another computer, not from the infected site.
Is malware removal the same as monthly maintenance?
No. Monthly care is updates and small edits. A cleanup is its own milestone after the public damage is stopped.