Replace beats patching infected core
When an official original is available, WP Cleanr prefers replace over patch. It does not rewrite a few lines inside load.php. It substitutes the file whose MD5 matches local checksums. The official tree cannot be the infected site itself. wp-config.php is never replaced. WordPress users and siteurl/home are not rewritten automatically.
Quarantine is copy-verify-remove
A file is not deleted until a verified copy exists in the quarantine store. Restore is the reverse. Symlinks are not quarantined. Apply requires the dashboard checkbox (or CLI --yes); without it the operation is a dry-run.
Database cleanup is narrow
Optional database work can neutralize high-risk options (empty value, autoload off) or drop autoload on huge options. It does not delete users. Connector and SFTP refuse clean and harden; those stay on SSH.
After cleanup, run a verification scan. Pair with hardening so uploads cannot host PHP again. CLEAN is the plan that includes verified cleanup.