Does Wordfence actually protect?

Hi @tinzo,
It won’t help adding a security system to your house if you have burglars hiding in the basement. You need to have the site fully cleaned of malware before Wordfence can protect it properly. Step one would be to figure out how they are getting in. Check the last modified timestamp on malicious files and try to match that up with entries in your raw access logs. This can give you an indication of what is actually happening on the site.

Here are some links to help you along the way

https://codex.ww.wp.xz.cn/FAQ_My_site_was_hacked

https://www.wordfence.com/docs/how-to-clean-a-hacked-wordpress-site-using-wordfence/

If you’re not successful in cleaning the site yourself you may need to hire an expert to clean the site for you.

Best of luck for now!