My site is repeatedly hacked and I can't seem to stop it

You get repeatedly hacked because you did not remove all the scripts/ backdoors left by the hackers through which they can walk in freely again. While strong passwords and similar steps can help, you need to look for all the malicious scripts, strings, links, etc. and remove them. Though you may use the same themes and plugins make sure that you delete them first and upload freshly downloaded copies only. Similarly, you should delete all files and folders in your site’s server reinstall WordPress and restore your site. These are just a few things. Go through the following resources and work through them:
https://codex.www.ads-software.com/FAQ_My_site_was_hacked
https://www.ads-software.com/support/topic/268083#post-1065779
https://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/
https://ottopress.com/2009/hacked-wordpress-backdoors/

Anything less will probably result in the hacker walking straight back into your site again.

Additional Resources:
https://codex.www.ads-software.com/Hardening_WordPress
https://sitecheck.sucuri.net/scanner/
https://www.unmaskparasites.com/
https://blog.sucuri.net/2012/03/wordpress-understanding-its-true-vulnerability.html

Thanks Krishna, but what I don’t understand is that the plugin ‘Wordfence’ appears to be quite responsible and reliable. It scans my entire site every day and reports on dodgy scripts etc and keeps coming back completely clean. Wouldn’t any problems have been picked up in their scans?

Or, what I’m wondering, is could this be nothing to do with wordpress, but somehow they are exploiting a weakness in my hosting provider Site5?

You may need to check the file permissions on your web server. Most of the time, CHMOD 777 files are the one which gets hacked as the 777 permission makes it easy for the hacker to edit your files.

Most of the WordPress security plugins don’t check the file permission for every file and folder in the setup.

You can do one thing, which is disallow directory browsing on your hosting account.

Edit the .htaccess file and add the following code into it.

# Disable directory browsing
Options All -Indexes

Do talk to your host and let them know that your wordpress site is hacked on regular basis. They’ll check the server logs and decide what is good solution for you.

but somehow they are exploiting a weakness in my hosting provider Site5?

Not ruled out. Insecure server configurations and inadequate security settings at servers are often found to be responsible for such hacks.

Thanks again Krishna – but how would I find this out?

There may be no need to go to the considerable effort in securing a wordpress site that may already be secure. Is there any way I can find out how I’m getting hacked?

Site5 support are fast and friendly, but not really very forthcoming on how i’ve been hacked. When they run a security audit for me, it always comes back clean.

Sorry to be firing off the questions but it is a great unknown for me, and I just want to sort it!

I use Wordfence Security and all but one of its fine features, and I also have BulletProof Security as my first line of defense and to handle that one thing I do not ask Wordfence to do since it already does so much. But where Wordfence is continually watching current traffic on the inside, BulletProof keeps all the doors tight in relation to all outside traffic hoping/trying for enter. Also, it could be a good idea to reset your passwords at your host, database and any FTP (or preferably SFTP) accounts.

Is there any way I can find out how I’m getting hacked?

Sorry, I do not know the answer – perhaps you too will never know even if you spend your entire time to become an expert on this topic, just because hackers never use the same techniques or entry routes. They keep on changing their methods and ways to gain entry to hack sites. You can only get to know what infected your site by looking at what is in your site and remove malware and harden your site from further attacks.

Review these links and try to protect your site:
https://codex.www.ads-software.com/Hardening_WordPress
https://codex.www.ads-software.com/Brute_Force_Attacks

Leejosepho, Custothemes and Krishna thank you all very much. I shall implement the measures you suggest. This forum has been a great resource, thanks again.