I built a custom theme for a client's site and it keeps getting hacked, I guess. What I'm finding is a bunch of gibberish code at the top of each theme file and plugins as well. It's all super-compressed and not very easy to read, but it just looks like a bunch of numbers. It's not outputting anything on the site itself. The only reason I know it's happening is because the addition of the code to the plugins breaks the plugin and WP auto-disables it. This has happened about 5 or 6 times.
After the second time I realized that the default setup was not cutting it. So I installed WordFence and for a month it worked perfectly. WordFence started to paint a picture of just how many attacks are attempted against a site at any given moment. It's insane. I also changed all passwords (users, FTP, etc.), changed the table prefix, block wp-admin and used a different URL to access the dash, and followed pretty much every single item on the Hardening Wordpress article. Also took the advice of a few posts here.
All for nothing though it seems. After a solid month of success, the plugin and my measures stopped working. The useless strings started appearing at the top of theme files. But oddly enough, not plugin files. I cleared things out and tried the iThemes security suite instead of WordFence. NOPE! Woke up to find the site had been hacked again.
In addition to the above I've also narrowed down my plugins list to a select trusted few that have proven harmless on other sites: Formidable and Advanced Custom Fields. I'm worried I screwed up something in my theme somehow, but I've coded a dozen or so and never had this issue on any of those sites at all.
I'm at a loss for what to do. I feel like if I understood what the 'hack' did I'd be able to combat it better, but I'm at a loss. These things are very difficult to google. Any guidance would be appreciated.