Wordfence has the article 3.2: Finding and Removing Backdoors.

Backdoors can be difficult to find as they are often obfuscated code. Usually if there is one backdoor, there are others that may or may not look the same.

I know I have this sort of stuff on my site, but I have never been able to find it. This gives me a better idea of what to look for. Someday, I might give it another try to look for this.

Here is an article about the kind of thing I actually know I have on the site. 3.3: Removing Spam Pages From WordPress Sites.

Spam pages are files added to your publicly available web site with the intent of manipulating search engine result pages.