Yes i faced this issue multiple times, when i faced this issue i really got frustated because all of my client website’s and my own websites got hacked, atleast 5-6 websites was hacked.
And i found the root cause of this problem.
I was doing these things wrong that lets hackers easily hack my website.
1) I installed gpl free plugins just to get paid plugins in free from some websites. Delete all if you any.
2) I didn’t installed any wordpress security plugins like all in one security plugin, which i recommend. ( Its free ), and you need to configure all of the features of plugin, you can watch any video on youtube.
3) I hosted multiple sites in one hosting, which results in all website hacked when my one website was weak.
So never ever use one hosting for multiple websites.
4) I didn’t changed my wp username, if it default “admin” then you arw inviting hackers.
5) Change the wp-login to something unique that noone can guess.
If your website is already hacked then i would recommend that you go on fiverr and find a security expert, because it is not easy to remove the malware from already hacked website.
When my website was hacked, and i didn’t had money to pay expert to remove the malware then i had to redevelop all the sites that were hacked from scratch with now following all the precautions i mentioned above.