This is what happens in a Wordpress (Woocommerce) site I've been asked to investigate.

1) I make a modification to .htaccess and save it.

Here's output of the ls -command

% ls -l
-r--r--r--  1 user group   248 Sep  7 11:31 .htaccess

2) Just a moment later

% ls -l
-r--r--r--  1 user group   235 Jul 20 09:42 .htaccess

The changes have disappeared. Note the changed date in the file (apparently it is copied from somewhere).

What is causing this? And how do I stop it from happening?

  • This could likely be a server setup thing - some kind of "feature" - and not a WordPress issue. Commented Sep 7, 2015 at 9:08
  • Could this be a compromised wordpress site? Commented Sep 7, 2015 at 12:01
  • There is no real indication for a compromised site. Make sure that the user has the rights to edit the file. Otherwise, it isn't that easy to tell, because there isn't the one reason, why this could happen. Commented Sep 7, 2015 at 15:36
  • As you can see, the user (nor anyone) has rights to edit the file (rights removed just after edit). Still it gets overwritten. I don't have any idea why this is happening. Commented Sep 8, 2015 at 12:01
  • Something written by someone while nobody can write it is a paradox. While this exists in theoretical logic, it does not exist with common logic. Computer software is grounded and bound to common logic, ergo someone can write it. Which brings me back to your server setup and configuration - and probably your hosting company. Commented Sep 8, 2015 at 12:14

2 Answers 2


I was having a similar problem recently. It turned out it was due to a code injection in the /wp-includes/nav-menus.php file. There was a Base64 malware code injected that was causing my .htacess file to chmod itself to 444. Something called some kind of darkleech malware. See this link for more, maybe it's what's happening in your case as well: https://blog.sucuri.net/2015/03/pseudo-darkleech-server-root-infection.html


As I see, the file has read only for all. Could it be that it is deleted and a new file is added? See this answer, read only files can be removed with rm

To be procise: a plugin, server feature or some other custom code (maybe in functions.php?).

You could analyze the file by checking what updates are made to it using tail or watch You could check who or what last modified the file (applies to user changes) Normally if you disable all plugins step by step and exclude each of them, then it's something with the server.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.