horoskopy

But there is need to find what was changed to prevent future attacks. Restoring old files means restoring wordpress with same vulnerability.

I uploaded 10 days old backup and start taking a look at all files, if I’ll find something interesting I let you know.

But still will be good to find a reason why it is and classic solution, is it hiding somewhere in mysql ?

Sure, same was here, index.php was changed (not by myself – but link was leading nowhere) and returning it back was without results – but I take a look at probably all files at directory and there is no change ! they have old date so I don’t know how restoring from backup can help.

what hosting are you using ? I have same problem and I am on bh

Same problem here, hope there will be someone who knows what is going on