I'm very surprised by the unwise compromise remediation advice: >Remove any files, pages, posts, comments or processes added by the attacker. If in doubt as to

I'm very surprised by the unwise compromise remediation advice: >Remove any files, pages, posts, comments or processes added by the attacker. If in doubt as to whether you got everything, set up a new WordPress site from scratch and then restore your last known good backup into it. >Change all passwords used by the site. Also change your hosting provider and database passwords. All this after showing how easy it is to hide a backdoor. If you have reason to believe your server is compromised, not only should you always wipe the web app and restore from backup (delete all of /var/www or equivalent and repopulate with your backup), you should wipe the server and reinstall the OS (or just request a new image to be spun up if it's a VPS/VM) too, unless you can 100% prove that the attacker didn't get root access, and you know everything they did, and know file permissions are set properly everywhere so www-data (or equivalent) couldn't read or write anything sensitive outside of the web server directories. And even then, it saves you a lot of time, effort, and anxiety to just nuke and reimage by default. This is yet another reason why frequent backups are extremely important. Just make sure you're restoring to a known good backup (hopefully you can confirm the time of compromise).