I am responsible for a lot of WordPress websites and I secured the cPanel and server (WHM) and WordPress administrator with 2fa so no one will be able to reach them except me.
I downloaded the wordfence plugin and sucuri and I used the fast SSL plugin and nearly every security plugin. I did all the possible security but every time I got hacked in the same way. The hacker changed the index.php and .htaccess files,
So I want to know a way to stop them from being able to change it, their permissions now are 644 would I change it or maybe write any codes in them or what?