Wordpress Security settings

[sumesh]

Hi guys

Last day I got hold on one such spamming and I removed the spamming file named max.php and immediately after 2 minute that file again got re uloaded and on checking the access logs, it was 2 files in the default wordpress theme twentyfourteen files named erro.php was there.

there will be more or other files names which can be a causing this but just hope to add more on this.

I guess removal of unwanted and unused plugins and disabling php execution in the wp-content folder is a good move against this