No security tools can detect & remove all possibly harmful content. You could complement the WordFence by some other scanning tool. Knowing how the malware typically gets installed on WordPress sites is also helpful. As the malware may not show as a distinct add-on, a powerful way to clean it up might be:
- installing the WordPress from scratch
- reinstalling all the plugins from trusted source and
- migrating the content from the current database.
You could also find the extra files by comparing the files on the site with files on clean installation packages.
Sometimes the harmful content is hiding from the administrators. You could try to explore the site without signing in and see whether it differs from what you see when signed in. Looking at the source code (Ctrl+U) or the Network tab on the browser's developer tools (F12) might also reveal something.
I have also seen content that could be considered harmful but is only visible to Google. Changing the User-Agent to one of the Googlebot User Agents might make the harmful content visible. This was used for generating links for the Google Bot to follow and increasing their rank on the Google results. However, this has been decreasing since Google started handling this link spam the opposite way.
Finally, it might be a good idea to delimit on a firewall level the external sites your site can access. That way you can avoid your site from spreading any malware to other sites. Infected WordPress installations are used to infect more WordPress sites.
