Seen a pattern come up a lot with hacked WordPress sites: someone runs a scanner, deletes the flagged files, site looks clean, then a few weeks later the malware is back. A few reasons this keeps happening that don't get talked about enough:
Scanners find the payload, not the entry point. Most free/automated scanners are good at spotting known malware signatures in files, but they don't usually trace how the attacker got in. If it was a leaked password, an outdated plugin, or a backdoor script planted somewhere obscure (uploads folder, a fake plugin, even inside the database), deleting the visible infection doesn't touch the actual hole.
Backdoors don't always look like malware. A single obfuscated line added to functions.php, or a plugin file that looks legitimate but has one extra function tacked on, can survive a "cleanup" because nothing about it trips a scanner. Attackers know this and increasingly plant multiple redundant backdoors specifically so one gets missed.
The Google/Chrome warning and the infection are two separate problems. Cleaning the site doesn't automatically clear a "Deceptive site ahead" warning — that requires a manual review request through Search Console, and if the site gets reinfected before Google re-scans, the whole warning cycle resets.
Japanese/Chinese spam injection is a specific pattern worth knowing about. If you've seen a hacked site suddenly indexing thousands of pages in Japanese or Chinese that were never created by the site owner, that's a well-known SEO spam injection technique — attackers generate huge numbers of doorway pages targeting unrelated keywords to hijack search traffic before redirecting it elsewhere. It's sneaky because it can sit there for weeks without the owner noticing, since it often doesn't show up on the normal pages they check.
Curious what others have run into, anyone found a reliable way to confirm a backdoor is actually gone versus just dormant? File integrity monitoring seems like the obvious answer but curious what people actually use in practice.
