My first step is but it helped me. I had a good old fashion pity party. I cried and railed against the evil hackers (that where probably 13 and smarter then me) And then I did before I started my site, what I should have done. And here is where I want you to start also. Learn how to protect yourself until you get hacked. The thing about fix wordpress malware attack and why so many people recommend because it is easy to learn, it is. Unfortunately, that is also a detriment to the health of our sites. We need to learn how to add a security fence around our website.
There are ways to pull off this, and many of them involve re-establishing databases and more and FTPing files, exporting and copying. Some of them are very complicated, so it's imperative that you go for the one that is right. If you're not of the persuasion that is technical, then you may want to check into using a plugin for WordPress backups.
There is a section of config-sample.php that is headed"Authentication Unique Keys." There are. There's a hyperlink within that part of code. You want to enter that link in your browser, copy the contents that you get back, and then replace the keys you more info here have with the unique, pseudo-random keys offered by the site. This makes it harder for attackers to automatically create a"logged-in" cookie for your website.
You can make a firewall that blocks hackers. The firewall prevents the hacker. You also have to have updated version of Apache. Upgrade your PHP. It is essential that your system is always full of upgrades.
Do your homework and some look at here hunting, but if you are pressed for time and need to get this try the WordPress security plugin that I use. It is a relief to know that my website (and company!) are secure.