Check that you have disabled file editing
If an attacker gets into your site, the first thing they will try to do is edit your PHP files through the Dashboard interface. Preventing this can limit the breadth of an attack.
Add the line `define(‘DISALLOW_FILE_EDIT’, true);` to your wp-config.php file.