Thanks Heidi. Unfortunately, the brute force attack used against our server was doing a few login attempts from thousands of different IP addresses, so it wasn’t tripping the login limits. We had to find another solutions.

Backups are a lifesaver and webhosts who backup for you makes sense, esp if I can go in and click a button to go back.

I always backup before updating WP sites. One theme had a big update, changing short codes, and not until that was done, did I see we needed to update the theme’s support to get a new code. Meanwhile the site looked horrible with broken shortcode all over the place. One click and everything was back to normal. Updated the theme’s support, put up maintenance page then went through the update process.

Many hosts do not work at removing malicious files. That is good thing.