shamratdewan

its at the first dir not inside any folder. what file you see just after log in using FTP. the file is has a notepad icon .htaccess where all the folder names wp-admin,wp-content, wp-includes are…

to work permalink you need RewriteEngine On. as far as I know. good practice change your permalink to default. then delete your existing htacess file then go back and change the permalink to one you like. WP should be able to create a fresh one itself with proper code. try to set the permalink 2/3 time as you may already know.

at the root dir using FTP inside public_html or www whatever it is. where wp-admin, wp-content folders are

have you solved the problem yet? if not: have you tried deleted the exiting .htacees file, upload all three wp themes like twenty ten, twelve, thirteen… check you wp-option file for current theme location which theme its saying. also plan c was clearing the wp-active plugin in the same table assuming you have already deleted all the themes already. clear that filed as well on wp-option table.

OK.. take a backup then delete everything under wp-plugin folder and on theme just leve twentythirteen delete rest. must work… Good Luck. have you tried plan C yet??

then where are you now?

have you tried clearing browser cache, remove everything from redirect_to=…

check your php info how much memory you have from your hosting. then add something like max_memory_size in your wp-config (please google the actual code). if something that you are getting is not enough for your site then its time to upgrade or move to better hosting

on you wp-admin you need to activate the wp-theme first. if its not in the WP-content folder alrady then you can download it from here and upload it under WP-content folder using FTP.

Best think is to use hard passwords and updated WP. other then that i also tried blocking IP, some plugins but none work so far for some reason. so learn living with it may be..

deactivate your theme use WP theme like 2013 or something.. then see if you can see the site. or deactivate the plugins as per PLAN C:. was the the site used to work in current hosting?

best to replace all the files except theme folder under wp-content. then search for different different words from the text you have put above. on the theme folder as well. they usually add this code using base64 and JS files. may be you downloaded the theme/plugin recenty from some torrent or something where the code was injected first..Good luck

google analytic usually goes on footer.php of your theme. you need to rename the theme folder to something else headlessHOLD is not a code!!! or go to wp-user table in your DB find the admin user then change the email to something you have access on. plan C: on wp-option table clear everything inside wp-active plugins

widgets if you cant find under appearance. then you need to go via your themas function.php file it must or usually there depending on theme structure.

to clean up your site i would suggest to: delete everything except wp-content (your theme). then upload fresh copy. then go to DB>wp-user find admin user edit and change the email to one of yours delete the encrypted password field. also delete all/unknown users. then go back to your site and reset the password. also check your theme folder as they also hide hack codes in different variations there as well.