I have a site built on the ModX Evo CMS. I have noticed that almost every day the .htaccess file is deleted meaning the FURLs no longer work. I have scanned for viruses and found nothing. Does anyone know what this means or what I can do?
How to Investigate
I'm assuming that you are using CHMOD 744 or 777, there is no reason why the owner group would require write access, so it's time to revoke write permissions.. this will mean that the file can not be deleted, can't be altered, unless you login via control panel or FTP and chmod before hand.
Change the CHMOD of the htaccess to 444, this will disable write permissions on public, group and owner. Additionally if your CMS uses a config file that is used to content to the database you can also use this to further your security. As I normally say in another of answers on Pro Web Masters.. Never under estimate the power of CHMOD, it causes problems for hackers, malware, and just generally stuff you don't want happening to your site.