What to do if a WordPress website is hacked or infected?

Question

What to do if WordPress website is hacked or infected?

Answer

1. Contact information security experts in order to identify the source of the attack, confirm that it is a not false positive detection and clean up infected files.
2. Reset all system users passwords (FTP users), Plesk users passwords, WordPress users passwords
3. Update web applications like WordPress and their plugins.
4. Follow Plesk security best practices
5. Protect WordPress installation: How to secure WordPress in Plesk?