Site Hacked? New lines in header.php, and added login.php, ip.php and convert_ip.php
 

My site was hacked. The hacker had added lines to the header.php file that produced links and other text (some english, some appeared to be russian) at the top of pages. Also added three files named above.
I've removed the lines and the files. Header lines are gone.
Embarrassing part, I was still running Atahualpa 3.4.6
Looking into plugin called "System edit restriction" -- as another tool to fight hacks.

check all user id in wordpress
check all FTP accounts
change ALL your passwords: WP, FTP, EMAIL< CPANEL
run antivirus software on your computer

and I would do a full reinstall of the WP code, all plugin's and themes just incase they left some backdoor code in somewhere.

and look at this plugin Sucuri WordPress Security plugin

and upgrade the theme WP and all plugins