Website hacked

You need to start working your way through these resources:
https://codex.www.ads-software.com/FAQ_My_site_was_hacked
https://www.ads-software.com/support/topic/268083#post-1065779
https://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/
https://ottopress.com/2009/hacked-wordpress-backdoors/

Anything less will probably result in the hacker walking straight back into your site again.

Additional Resources:
Hardening WordPress
https://sitecheck.sucuri.net/scanner/
https://www.unmaskparasites.com/
https://blog.sucuri.net/2012/03/wordpress-understanding-its-true-vulnerability.html

Hi Esmi – thanks for response. I had to wait for host to unlock site. I read some of this stuff and although I backed up my data base and Wp-content last week – I don’t think it helps me much, Maybe there’s a backdoor or something lurking in the data base. Seems a bit futile to even do a backup. I am leaning towards going into Cpanel – removing entire site and database. And starting all over again. It is a new site and will take a couple hours to do rather than try and fathom out where things are lurking… My problem came in at the first entry to site – namely at host – forgot to change default password. I am now going to be SUPER careful ad follow ALL the tips here ??

Just a quick question. My host reckons that all I need do is download a new fresh version of WordPress and install it and it will overwrite the existing one. Is this correct? Then I change all the passwords and add keys etc …. But he said to leave the database. Bit worried and just checking this.

Your hosts are dead wrong. See https://ottopress.com/2009/hacked-wordpress-backdoors/ for an overview of why this is never the case.

Glad I checked – thanks – scary stuff