Hi @todofitt,

Yes, it seems like your website is hacked. Most probably an exploit of your website was found either via an outdated plugin, theme or the WordPress version itself.

What I can recommend is to restore from a backup where you were able to enter your backend without a problem and take it from there. This doesn’t mean you’ll need to leave it like that as it most probably going to be hacked again if no steps are taken to prevent this.

If you don’t have a backup, in situations like these, I usually recommend people to contact a security specialist or firm to help them secure their website and remove all malicious content.

As for the Droplet, if you believe it has been accessed by a third party, then I’ll recommend creating a new one, cleaning your websites, and then migrating them over to the new droplet.

Regards,
KFSys