1

I am responsible for a lot of WordPress websites and I secured the cPanel and server (WHM) and WordPress administrator with 2fa so no one will be able to reach them except me.

I downloaded the wordfence plugin and sucuri and I used the fast SSL plugin and nearly every security plugin. I did all the possible security but every time I got hacked in the same way. The hacker changed the index.php and .htaccess files,

So I want to know a way to stop them from being able to change it, their permissions now are 644 would I change it or maybe write any codes in them or what?

Improve this question
1
  • Make the files "immutable" - $ sudo chattr +i .htaccess. But more importantly, you need to find out how they are getting in or whether or not there is some code now present that is causing this. Otherwise you are not only going to be chasing your tail trying to fix it, but you are potentially putting the whole server at risk.
    – Steve
    Apr 1 at 0:27

0

Reset to default

Browse other questions tagged or ask your own question.