How to clean a hacked WordPress site