Contain before you clean
Take the site offline or into maintenance, rotate every credential — hosting, database, FTP, admin users, API keys — and preserve a copy of the current state before changing anything. That copy is your only evidence.
Find the entry point
Check access logs around the first sign of modification, list files by modification time, and compare core files against a clean release. Cleaning without finding the entry point means the attacker returns through the same door.
Restore, then re-secure
Restore from a backup predating the compromise, patch what let them in, then bring it back. Tell affected users if data was exposed — early disclosure is uncomfortable and late disclosure is far worse.
