Remain calm and carefully follow this guide. When you’re done, you may want to implement some (if not all) of the recommended security measures.
Don’t forget that the free online sucuri check (and others like it) judge malicious content solely by what content the server sends out. If an infection breaks the site so no content is seen, sucuri sees nothing alarming and reports the site clean.
Premium scanners that install on the server have a higher chance of finding infections because they can access the underlying code. Regardless of whether an infection is reported or not, the signs are there and the response is the same, as outlined in the above resources.
Installing a firewall is a great security measure, but you cannot expect it to do it’s job until the site has been cleaned. Hacks invariably include backdoors which can circumvent the best firewall measures. Sure they can help, but don’t believe you are totally protected until your site is clean.
