I have a wordpress website always updated. I'v developed a theme from scratch for it, so my theme is clean as it was always. I use strong passwords generated by specific tools. Last 3 days my website is infected by a code that redirect my website to linkbucks ads. I'v found that this was coming from a code injected into header.php or footer.php files of my theme. I'v cleaned my theme, re-uploaded wordpress core file from a new copy, changed FTP username and password, changed my admin wordpress password, but after all that the code reappear! So I try to contact my web-hosting (Godaddy), because the problem maybe coming from a bug on the server or another website hosted on the same server as my website (I'm using shared hosting), but didn't receive helpful reply from Godaddy support. Now I don't know what to do, I just delete the code after the hacker add it, I'v changed passwords several times, but the problem is still present. I'd like to know if I someone know something about this malware, because after googling for 5a9fa481.megaline.co there is no result. Maybe it's something new. If I can deny any modification to header.php and footer.php files I think this can help me until finding an efficient solution. Can you help me please? Any suggestions? (Btw, sorry for my bad English)
If you can view the access logs for the site that can be helpful. I've been able to find the attack vector for wordpress sites this way in the past. If there's nothing there then it's likely it's coming from someone else on the host. Perhaps you could move it to digital ocean ($5 per month for a VPS) to rule out being a problem with the shared host.