My website has been hacked, where do I start?

Question

Phishing

Hey! My Wordpress site has been hacked. I assume that they do this through some kind of XSS vulnerability, because password entry is excluded. The attacker gets access to the files on the server, from there he finds out access to the database and away we go.
Where to begin? What should I pay attention to in the logs?

Answer 1

• Make a full backup
  
• View access logs
  
• Check which external scripts are loaded
  
• Make an audit of plugins and themes