Notified of compromised account: Where to go from here

A wordpress site on 1 of my hosts running WHM 11.32.3 build 19 was listed as a phishing website. I've disabled the account but I was hoping for advise on where to go from here to try and find as much detail as possible as to how the site was compromised and how to improve my security to stop it happening in the future as I have other wordpress sites.

The site admin of the compromised site can be considered awol

 

Thanks I'll review its suggestions.

Is there anything I can do via WHM to try find how the problem occured and if other accounts might to open to a similar fate?
Is there a best practice guide for these situations?

 

Working my way through Recommended Security Settings