Keep an audit trail to monitor users and under the hood activity on WordPress. A good indicator of a hacked WordPress website is unusual user activity, such as creation of new users, existing users' password changes, user role changes, unapproved new content and modification of existing content