This had been added to our wordpress site, specifically in the footer.php.
It is malware as defined by google, i belive it is tracking code.
We have complex passwords and use https for /wp-admin. We do not however block access to /wp-admin using htaccess - but that would not have stopped this ?
How do they occur, how can I stop them ?