(optional but safe): Use a 503 Maintenance plugin or rename .htaccess to block public access while you clean.
Fixing the issue once is not enough. You must lock your site down. Here is the for prank ojol vulnerabilities.
To permanently remove the "Prank Ojol" script and secure your WordPress site, follow these steps: 1. Immediate Cleanup Restore from Backup
