Hacked…again!

I got hacked (by some Hammad) twice in the past week (Landing page replaced with some obscure page with arab writing).

Not sure where to look for a solution. My Host? (Who is rubbish by the way, and about to be replaced). WordPress?

Can only hope the hacker did not get my wp-config, use my password, into my database and did things there also.

Any advice / tips?