WordPress admin hack

The Sucuri scanner doesn’t show any malware on your site, but if you’ve restored the altered file, that would explain why. The fact an unauthorized person altered your files is almost certain evidence you’ve been hacked. Just clearing out the damage is not enough. As you’ve experienced, it just keeps happening again. This is because the hackers installed a hidden back door somewhere, allowing them access any time they want regardless what you do with the obviously altered files.

These back doors can be very hard to find and eliminate. Please work through the steps in esmi’s linked FAQ_My_site_was_hacked article.