Some information: Yesterday I found out that my wordpress page has been 'hacked' (for the lack of a better word). Everyone going to my page was redirected to a http://mywordpresspage.com/NetflixXXX page where the last 3 X are just a number between 101 and 999 I belive.
Logging in to my ftp I discovered all these Netflix folders in my web site root folder + a folder called BOTS, a robots.txt and some other stuff.
I didn't have a running backup yet (amended this the second I realized that I got hacked) so I had to try to revert to a functioning state. Thankfully none of the original files seem to have been touched (apart from index.php - I still have to verify everything to be sure).
I don't believe that they got access via FTP or the damage would have been much bigger so my guess is that they exploited wordpress in some way to inject all these folders and files. Question is: How do you prevent this apart from constantly updating plugins and just keep a backup just in case? Passwords I use are unique and not being used anywhere else.