1) Scan your site using security plugins like Sucuri or Wordfence, which can help detect malware or compromised files.

2) Take the site offline by putting it in maintenance mode or using a coming soon page.

3) Change all passwords of site and create strong passwords. Go through this link to see what are strong passwords ( https://phoenixnap.com/blog/strong-great-password-ideas )

4) Ensure that your WordPress core, themes, and plugins are up to date and even the inactive plugins . (old versions can be hacked easily.)

5) Remove any unauthorized or malicious code. If you’re unsure, use security plugins that can help identify and remove malicious code.

6) Use online scanning tools to scan your WordPress site thoroughly. These tools will detect malware, compromised files, or security vulnerabilities.

7) Implement security best practices to protect your site in the future:

• Install plugins that provide features such as firewall protection, malware scanning, login security, and more.
• Enable two-factor authentication for WordPress login to add an extra layer of security.
• Limit the number of login attempts using plugins like Login Lockdown or Limit Login Attempts.
• Regularly backup your site and store the backups in a secure location, either on an external server or cloud storage.
• Remove any unused themes or plugins from your site.
• Keep your WordPress uptodate.

Note : Consider implementing a password policy that mandates users to create complex passwords with regular updates.