I cannot access my wp dashboard, I get 403 error,

nicoleta89, hi there!

I’m 99% sure you need to log in via SSH first and try commands ps aux or top -icd1 and check all running stuff, especially PHP scripts.

I bet you’ll find one or two processes like /usr/bin/phpX.X /home/user_dir/path/to/your/website/dir/malware.php – such process launches the instant re-creation of malicious files, mainly /index.php (with malicious code injection) and .htaccess (with special rules in the beginning of the file).

Kill it by using command kill #PID (#PID – malicious unique Process ID) and you’ll be able to make a fresh WordPress install or whatever you want.

my website got hacked, and I need to find and replace the hacker attack code.

Carefully follow this guide. When you’re done, you may want to implement some (if not all) of the recommended security measures and start backing up your site.

More useful sources:
– https://ottopress.com/2009/hacked-wordpress-backdoors/
– https://www.wpbeginner.com/wp-tutorials/how-to-find-a-backdoor-in-a-hacked-wordpress-site-and-fix-it/
– https://www.wpbeginner.com/plugins/how-to-scan-your-wordpress-site-for-potentially-malicious-code/
– Install the plugin Wordfence plugin and do full scan of your site.
– You can also use another scanner: https://www.ads-software.com/plugins/search/malware+database –
– Also, Scan for “some string” using https://www.ads-software.com/plugins/string-locator/

Could someone help me fix this?

I think you’re misunderstanding things here. WordPress is both built and supported for free by volunteers who do this on their free time. We don’t actually run your site or have any form of control over it in any way. So *you* must resolve your problem.

If you’re unable to clean your site(s) successfully, there are reputable organizations that can clean your sites for you. Off hand, couple of names that come to mind are Sucuri and Wordfence.

Message for: m0ze (@m0ze)
where to put that command kill #PID? can you please tell me

nicoleta89, this is a SSH (Secure SHell) command, so you need a SSH access to use it, or you can ask your hosting provider to assist.