Website hacked – clearing malcious files

It is the database that will be the main concern. Presumably you have an old copy of the theme files?

You will need to use phpMyAdmin or suchlike to have a look at the raw database entries and assess what damage has been done, whether content has been erased or simply diverted/ added to.

When you say ‘hacked’ I assume you mean through the WordPress interface? or do you mean through FTP (much more serious)?

When was the last database backup performed?

You need to start working your way through these resources:

• https://codex.www.ads-software.com/FAQ_My_site_was_hacked
• https://www.ads-software.com/support/topic/268083#post-1065779
• https://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/
• https://ottopress.com/2009/hacked-wordpress-backdoors/

Additional Resources:

• https://sitecheck.sucuri.net/scanner/
• https://www.unmaskparasites.com/
• https://blog.sucuri.net/2012/03/wordpress-understanding-its-true-vulnerability.html

The procedure to rebuild goes;

Reinstall a clean copy of WordPress
Re-upload your theme
Check your uploads folder locally, then when clean re-upload this
Re-install all plugins

finally re-upload the database using phpMyAdmin

If the database is truly trashed you may find the hosting company has a backup that they will charge you for.

Once you are up and running, install two plugins, one for backing up the database to email you weekly and one to limit login attempts. Also make your main admin user some name other than ‘admin’, ‘4Dministr￡￡ator os some such difficult to guess.

Horse, stable door, bolted, closed comes to mind but better to cope with this once than twice.

Forget about making a strong username, you want to focus on the password.