My WordPress Website Was Hacked: What to Do in the First 24 Hours
Stay calm, do not delete things in a panic, change passwords, take a copy of the site, and clean the malware and the cause together. Cleaning only the files without fixing the hole usually means the hack comes back.