Because of the identity of the website, I don't want to give too much identifying information about the actual organization, but I can try to provide as much server background information as possible.
I am managing a Word press site and all seemed to be going well until this past August when the site first got hacked. Because of the quantity of compromised files, it appeared that there was some sort of vulnerability that allowed a robot to mass inject code into all of the php files. Before each opening <php?
tag, there was a block of encrypted code that I have shown here.
The above link shows the tidied up php code, depicting the workflow of the script. If I further attempt to decode the strings, it becomes more legible, but it seems very difficult to discern exactly what it does.
Here is a bit decoded with unphp's "Eval + gzinflate + Base64" tool and here is a but decoded with unphp's "Recursive De-Obfuscating" tool that seems to be an html advertisement for someone else's website.
The contents, though, is relatively unimportant. After this initial hack, I restored from a back up on github and made sure the site was clean of any script. I also made a new user with a new password and changed the domain's root file to this new user.
I thought this solved the problem, but the website has been hacked in a very similar fashion 2 more times. Each time I've resorted a back up from Github and made sure the directory was clean.
At first I thought maybe the hacks correlated with Word press updates and they were Wordpress vulnerabilities, so I made sure I kept the site up to date in terms of Plugin and Wordpress updates. In the end, that is seeming like it wasn't the problem.
OS: Debian 3.1.9
Hosting Provider: Dreamhost
It is also worth noting that I inherited administration of the site from someone, so there is a lot of legacy code that is kind of sloppy.
tl;dr My question is how can I diagnose this? What steps can I take to find the source of the vulnerability? I am really at a loss right now and really frustrated that this keeps happening.
Thank you for any advice or support you can offer, I am desperate at this point.
UPDATE:
In the time since this post, I attempted a restore. About two hours afterwards the site was compromised in the same way. The differences this time around are that I had secured all file permissions and deleted a suspicious user from the wp_user
table. Clearly, neither of those things seemed to help.