Hacked website

There are so many ways a website can be hacked that no single type of prevention will stop all possible ways your site can be compromised.

Develop an internal security policy is your best defense:
1. Change your passwords at least quarterly (dashboard and FTP).
2. Make sure you have only one administrator.
3. Make sure your admin username is not “admin”
4. Try any of the most popoular security plugins, like Better WP Security, Bulletproof Security or Wordfence.
5. Most importantly, make sure to host your website with a web host who will help you fix your site if it’s hacked (and not just suspend you without a second word). There are a few dickish hosts out there that do this, and best to steer clear of that type of customer service.

You need to start working your way through these resources:
https://codex.www.ads-software.com/FAQ_My_site_was_hacked
https://www.ads-software.com/support/topic/268083#post-1065779
https://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/
https://ottopress.com/2009/hacked-wordpress-backdoors/

Additional Resources:
https://sitecheck.sucuri.net/scanner/
https://www.unmaskparasites.com/
https://blog.sucuri.net/2012/03/wordpress-understanding-its-true-vulnerability.html