Uploads directory should be public, or whatever other settings in which the webserver is able to write to it, which in term of website security makes very little difference.
You most likely have an unsecure code or unsecure server and there is not much point in rebuilding your site without first fixing those two issues first.
In addition the content you have currently in your DB can not be trusted as it might include backdoors, therefor after auditing your code you will need to audit the DB content as well.
Related Posts:
- What’s the effect if this malware if infected your WP?
- Malware on site [closed]
- How to find the backdoor of the hack
- My wordpress site was hacked – is my htaccess file compromised?
- My WordPress Blog sends malicious traffic to other sites [closed]
- Hacked WordPress website, as notified by Google Search Console, what to do? [closed]
- How was my WP site hacked [closed]
- If a WP install is hacked, can it spread to other domains on a server?
- Find and Replace text in the entire table using a MySQL query
- Is it a good idea to rename the “index.php” in “wp-admin” folder to avoid being hacked?
- How to fight this wp-info.php exploit? [closed]
- Prevent Hacking of WordPress Site [closed]
- Suspicious URLs being loaded after hack and restore
- Site hacked with malware [closed]
- Copy wordpress website pages and content
- How do I know if my WP Theme is using infamous TimThumb?
- Spam pages hack? [closed]
- Check for malicious code?
- Why would a hacker add this code to each post, and how to do mass cleanup?
- Is the current spate of hacks related to the recent security fix?
- I have removed the malware from our website however, when I tried again to search the word from Google it is still there [closed]
- Have I been hacked? Mysterious code at the top of theme files [closed]
- Strange codes in my wordpress site and my website is running too slow [closed]
- Spam Content Serving from old cached version of site?
- How to solve wordpress redirection (no malware was found)?
- Help determining if the following are legitimate files
- My blog was hacked? WP posting random posts
- Have I been hacked – getting new site setup email for 8 localhost wordpress sites
- Site Hacked – WordPress Divi Site – Cannot find where to fix the issue? [closed]
- malware in wordpress installer on dreamhost. [closed]
- Where I can find a list of WordPress security risks?
- looking for indoxploit hack solution [closed]
- Why functions.php file automatically empty?
- Bruteforce attack from 127.0.0.1?
- WordPress installer attack
- Why wordpress is hitting another url
- Where do hackers usually run their hacking script? [closed]
- Malicious Code in Index.php WordPress [closed]
- WP Site Hacked, Serp Google Spam [closed]
- My site appears to be hacked [closed]
- WordPress Redirect Hack
- Strings of malicious code to look for after a hack
- Hacked/cloaked sitemap [closed]
- Not able to change WordPress admin email. Someone added another admin credentials
- My WordPress Website Redirect to bigbricks.org and other site
- wordpress sites get hacked
- How to fix hacked website
- Verifying that I have fully removed a WordPress hack?
- If a hacker changed the blog_charset to UTF-7 does that make WordPress vulnerable to further attacks?
- WordPress site hacked. Has .htaccess been hacked?
- Tips for finding SPAM links injected into the_content
- Scanning Database for malicious Data
- How Attackers write script into my php files?
- Is this a hacking script in function.php?
- What should I do about hacked server?
- Websites defaced by uploading script using theme editor
- How can I find security hole in my wordpress site?
- Has anyone experience w/ WordPress (MultiSite) hidden users (possibly hacked)?
- Restrict access to xmlrpc.php
- How to prevent bot or someone to modify any file automatically?
- Hacked website redirect, only on desktop, help with restoring it [closed]
- How do i disable/disallow and tags in TinyMCE?
- Change WP-Login or WP-Admin
- hSite has no css on mobile [closed]
- How to mass delete one line from all posts after site hack
- Unfamiliar query string in Google Search Console URL not found
- Strange gibberish JavaScript in Editor – site hacked?
- wp-config.php modified?
- Security issues with WP sites
- Suspicious Files
- Invisible spam post in backend
- How to prevent wp-login brute force attack from thousand of different IP? [duplicate]
- Files automatically added
- How To Clean The Malware Infected & Hacked WordPress Websites? [duplicate]
- You appear to have already installed WordPress. To reinstall please clear your old database tables first
- Increased CPU load due to admin-ajax.php spam
- getting casino links on my woocommerce site [closed]
- How to locate & delete hidden pages on a site
- sitemap contains weird links and does not contain my pages [closed]
- Malware script in database post table only? [closed]
- New user is assigned 2 roles: customer and superadmin
- Verifying that I have fully removed a WordPress hack?
- How can I safely hide the fact that my website runs on WordPress? [closed]
- Hacked WordPress website /Homepage redirect [closed]
- WordPress Footer Missing After Website Hack
- wp-admin folder removed by hacker [closed]
- My WordPress Websites are always under attack
- What is this code in my theme’s footer.php causing chmod permission warnings? [closed]
- Spam users registers even when registration is disabled
- What does this code do? (Injected code hacked)
- My WordPress website was hacked [closed]
- Hack-Proof OR Security in WordPress — is it real?
- How to find exploited wordpress plugin [closed]
- Some one is trying to hack my website, Need guidance [closed]
- Efficient way to check local WordPress php files and Database for malicious code? [duplicate]
- Is wp-app.php or wp-apps.php needed for WordPress?
- What can I do when an outside party hacks into my weblog and changes my display name?
- Troll the hackers by redirecting them
- Any known bugs that could cause disappearance of the wp_users table?
- Is there any pre-existing plugin to track and block IPs with suspicious activity on my site?