I sampled (download several likely folders) and then ran a find using Dreamweaver on base64

Came up with a some hacked code pointing to an ip in germany all loaded up in the header file. I also found some very strange code (still puzzling over) in the 404.php file. I think this was the payload, but haven’t deciphered it yet. From the perspective of clean up, I’ll likely nuke all the files on the site and re-install everything fresh. With so many plugin folders, that are just too many other places things can be hidden.

I had previously searched the db and it seems to be clean, but I’m going to cleanse that anyway running a WP export/import and check the xml file before uploading it to a fresh install on a new db.

This site was running some very very secure settings, one of the best I’ve seen that was still hacked. The only thing I would have done differently was to run the site through CloudFlare. Site originally had Incapsula which I have no personal experience with but is supposedly similar to Cloudflare maybe more of an emphasis on security rather than speed.