My first step is not one you have to take but I was helped by it. I had a good old fashion pity party. I cried and railed against the evil hackers (that where probably 13 and smarter then me) And then I did before I started my website, what I should have done. And here is where I want you to start as well. Learn how to protect yourself before you get hacked. The thing about how to fix hacked wordpress and why so many of us recommend because it is so easy to learn it is. That can be a detriment to the health of our websites. We have to learn how to add a security fence around our site.
No software system is resistant to vulnerabilities and bugs. Security holes will be discovered and bad try this out guys will do their best to exploit them. Keeping your software up-to-date is a fantastic way to stave off attacks, once security holes are found because their products will be fixed by software sellers that are reliable.
There is a use this link section of config-sample.php that's headed"Authentication Unique Keys." There are. A hyperlink is website here within that part of code. You need to enter that link in your browser, copy the contents that you return, and replace the keys you have with the unique, pseudo-random keys offered by the website. This makes it harder for attackers to automatically create a"logged-in" cookie for your site.
As I (our untrue Joe the Hacker) know, people have way too many usernames and passwords to remember. You've got Twitter, Facebook, your online banking, LinkedIn, two blog logins, FTP, web hosting, etc. accounts which all include logins and passwords you need to remember.
These are three very simple things you can do to keep WordPress safe without plugins. Put a blank Index.html file in your folders, run your web host security scan and backup your entire account.