A cleaned site that gets reinfected was almost never re-hacked by luck. One of five things was missed.
The five causes
The entry point was never found. The vulnerable plugin is still installed at the same version. Cleaning removed the payload, not the door.
A credential was still valid. Attackers keep what they steal. If you cleaned files but did not rotate the database password, the hosting login and the salts, they can walk back in.
A backdoor survived. Web shells hide in uploads, in fake plugin directories, and in files with plausible names. Reinstalling from source beats hand-cleaning for exactly this reason.
The backup you restored was already infected. Infections are usually weeks old before anyone notices, so the “clean” backup often is not.
The neighbourhood is the problem. On badly isolated shared hosting, another compromised account can rewrite your files.
The routine that holds
Patch on a schedule you actually keep, and verify versions afterwards.
Delete what you do not use — the smallest attack surface wins.
Scan monthly so an abandoned plugin becomes a scheduled replacement rather than an incident.
Keep backups off the server, and restore one occasionally to confirm it works.
Two-factor authentication on every administrator, permanently.
Reinfection is an operations problem, not a malware problem. The site did not fail; the patching routine did.
Hardening reduces the damage. Patching removes the hole. Scan your site free to see what still needs patching.
