This might be a broad topic but I am searching and reading but not able to clear my doubts, please advice in answer or links from where I can understand about how codes are injected to WP by attackers.
While clicking on site name from google search it was taking to spam links. After doing some scanning I found there was plugin https://wordpress.org/plugins/pc-google-analytics/ we were using which was outdated. And in wp-config.php there was some code like below screenshot :
Is that means site got hacked ?
I have performed all required updates or core and plugins etc and gone thorugh Verifying that I have fully removed a WordPress hack?
Is that kind of code means site is hacked. We are on shared hosting Bluehost.
I am not sure if that code is due to hosting installation process. I have gone thorugh video https://vimeo.com/153926756 as well.
Please give some valuable thoughts if thats malicious code and how is malicious code like this normally injected into WordPress pages?