WordPress website hacked: Handling methods and questions

On April 6th, I found that I could not log into my website, and I immediately suspected it had been hacked.

1. Restore the backup immediately.
2. I noticed on the site that thousands of Japanese links have been indexed.
3. I scanned the site with third-party software and found virus-infected files.
4. Changed the server, restored the backup to March, and after self-checking, found no issues.
5. Upgraded the WordPress system and plugin versions, as the previous system was outdated, and I had been neglecting to audit the plugins.

Now, the site index still has many Japanese links and product links, and I have applied for removal in Google Search Console (GSC). What other methods can be used to save the website, or how do you handle such problems when you encounter them?

Only method that works is don't use nulled plugins and themes and keep plugins, wp and theme updated.