Any semi professional can hack your wordpress site, the two most important weak leaks are:
your wp-admin url and wp.config.php, a hacker can easy read that file to insert malware in your mysql database.
Note: when a hacker adds malware code (who redirects to spammy websites) based on my experience with clients, all the free malware scan tools not find them.
In the past this happened on one of my clients, I done a deep research of spammy file names, then search each table in mysql manually to find and delete them, hide the wp admin url, activate direction protection- problem solved, client is happy still today and not laugh it was a fiverr seller, but I not gave them mysql access I wonder how this could happen, he modified the free elementor plugin code, maybe through this way the elementor malware code found the way to the mysql database .....
When possible never give a fiverr seller you hired the whole access to your website/ webhosting
When you have this problem and can not find out the names of your malware files, the only chance here you have is to create a new database, clone your website theme and design, graphics, images and text, and import that to a new site with a new database, a hell lot of work.
I bet these expansive cms systems like Sitecore, Wordpress VIP and whatnot, who are used by big giant media news sites, not have this problem.
Best WP protection you can do is:
hide the admin url and have directory protection with user and password (you can activate this in the cpanel).
With that a hacker not knows your real wp-admin url and not have any access to read your wp directories files.
And then after that, you can add a more secure layer to your site ; WAF, Firewall etc, etc, .....
Happy Sunday !
)
