Ask HN: My web site got hacked, what can I do?

Now the admin account is changed, thanks for the tip. It was hijacked and I could not use it anymore - I deleted the user from the database and made a new one.

And install that wordpress plugin that hides wordpress version meta-tag from page source (there are several of them)

rename the admin account to something not "admin"

close down permissions.

stay updated on the newest versions of things.

make sure you know what each plugin does, and make sure it doesn't do anything naughty or insecure.