Where do we start to look for problems when malicious codes or files are found.
1. Clean EACH site inside hosting account
2. During cleaning, do a fresh WordPress installation replacing wp-admin and wp-includes folders completely as well as other core files.
– wp-content folder
and CHECK them manually if they do not have malicious codes inside.
Clean if needed.
3. Set 444 permission in root folder of each web-site folder for:
4. Check all other permissions. Folders should have 755, files 644.
5. Update all plugins and themes.
6. Get rid of unused plugins and themes.