WordPress website hacked again and again

It could be your backup is not clean, hacks can sometimes be in place a long time before discovery. I’ve heard of a few hacks that sit quietly without doing anything for some time before dropping their payload. Thus their backdoor is still in place in backup files going back some time.

When recovering from a hack it’s important to change all meaningful passwords. With a mySQL password (easily available on a hacked site) one has control over all site content, including WP users. That password would allow one to add themselves as a WP admin user.

It’s possible your theme or one of your plugins had a security vulnerability. After restoring your site update everything to the latest version.

In general, work through the steps in FAQ My site was hacked. Be very thorough, skipping steps (like not reseting mySQL password) leaves holes that render your other efforts inconsequential. Consider using an older backup.