Not a good day today as I discovered that despite a lot of hard work and Wordfence two of my sites were still being hacked.
One I managed to clean up but my main one is now blacklisted by Google. Before I go and invest $200 for Sucuri I was wondering if anyone else has come across this.
When I run site:smartfitnessmakeover.com in Google I get a whole bunch of dodgy urls pointing to non-existing pages and directories on the domain. For example: smartfitnessmakeover.com/forum/profil/fidmais (all the pages appear to be in French).
The free version of Sucuri helped me identify a number of php files that didn't belong to WP which I have removed but am still getting the urls and also I see a link to a website yummly.com in the status bar bottom left of the screen whenever I load a blog post. Where would I look for code injection or other possible reasons for this behaviour?
Neither Sucuri or Wordfence are detecting this...
Many thanks,
Cristina