0

my htaccess have chmod 444 and it's not possible for me as admin with ftp access to edit it. Also if I'm disabling all wp security plugins. When I'm change the chmod to 644 or if I just remove the file and create a new one, it's possible for a short time to edit it. But after a while, wordpress is rewrting the file and change chmod again to 444.

Any idea why this is so?

WP-Version: 4.8.1 Plugins: wordfence, ithemes (deactivated) wp-spamshield

The created File looks like that:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . index.php [L]
</IfModule>
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^wp-admin/includes/ - [F,L]
RewriteRule !^wp-includes/ - [S=3]
RewriteRule ^wp-includes/[^/]+\.php$ - [F,L]
RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
RewriteRule ^wp-includes/theme-compat/ - [F,L]
</IfModule>

The site also became hacked with a japanese url injection. Maybe this is still a problem of that?

Improve this question
1
  • 1
    Typically when you're hacked the hackers leave behind backdoors to get back in, over and over. It's safest to hire professionals to clean the site. There are several reputable vendors who do so; a specific recommendation would be off-topic but several of the top security plugins offer this service.
    – WebElaine
    Sep 19, 2017 at 13:34

1 Answer 1

Reset to default
1

I found the problem. A hacker placed a backdoor (wp-admin/29) and forced to rewrite the htaccess with it! Thank you for the hint @WebElaine

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.