My first step is but I was helped by it. I had a good old style pity party. I cried and railed against the evil hackers (that where probably 13 and smarter then me.) And then I did before I started my website, what I should have done. And here is where I would like you to start. Learn how to protect yourself before you get hacked. The attractive thing about fix wordpress malware cleanup and why so many of us recommend because it is really easy to learn, it is. Unfortunately, that is also a detriment to the health of our sites. We have to learn how to add a security fence.
Truth is, if your site is targeted by a competent master of this script, there is actually no way to stop an intrusion. What you are about to read below are some precautionary measures you can take to minimize the threat to an acceptable level. Odds are a hacker would prefer picking another if your WordPress site is well protected.
Exclude pages - This plugin provides a checkbox,"include this page in menus", which can be checked by default. If you uncheck it, the page will not appear in any listings of pages (which includes, and is ordinarily restricted to, your webpage navigation menus).
Black and whitelists pathological-looking phrases based on which field they appear within. (unknown/numeric parameters vs. Check This Out known article bodies, remark bodies, etc.).
I prefer to use a WordPress plugin to get the job done. Make sure the plugin you choose is able to do backups, has restore and can clone. Be sure it is frequently updated to keep pace. There is no use in not working, and backing up your data to a plugin that is out of date.