Hi bbb,
Install the following security plugins, after you’ve cleaned your site up:
- WordPress › Wordfence Security (scans files for exploits, scans WP core files, plugs and themes against original WP repository files. Blocks fake Google bots and also blocks anyone trying to brute force into your admin area. This is a must have for any WP site).
- WordPress › Growmap Anti Spambot Plugin (anti spam tool)
- WordPress › Break Out of Frames (stops anyone framing your site and running their banners atop and below your site.
Here are couple of other which are good to have:
- WordPress › WP-Optimize (delete saved drafts etc etc also optimizes your database)
- WordPress › WP Minify (crunches coding etc etc which speeds up load times).
Also change your Admin login name from “admin” to something else. You can do this via your database (easy if you have CPanel). Also change your password too. 15 alpha/numerical/special characters is what I use.
In addition I suggest hardening your WordPress with some tricked up htaccess commands. If you need these let me know 