0

my htaccess have chmod 444 and it's not possible for me as admin with ftp access to edit it. Also if I'm disabling all wp security plugins. When I'm change the chmod to 644 or if I just remove the file and create a new one, it's possible for a short time to edit it. But after a while, wordpress is rewrting the file and change chmod again to 444.

Any idea why this is so?

WP-Version: 4.8.1 Plugins: wordfence, ithemes (deactivated) wp-spamshield

The created File looks like that:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . index.php [L]
</IfModule>
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^wp-admin/includes/ - [F,L]
RewriteRule !^wp-includes/ - [S=3]
RewriteRule ^wp-includes/[^/]+\.php$ - [F,L]
RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
RewriteRule ^wp-includes/theme-compat/ - [F,L]
</IfModule>

The site also became hacked with a japanese url injection. Maybe this is still a problem of that?

closed as off-topic by Rarst, Jack Johansson, cjbj, Mark Kaplun, Howdy_McGee Sep 20 '17 at 14:38

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions that are too localized (such as syntax errors, code with restricted access, hacked sites, hosting or support issues) are not in scope. See how do I ask a good question?" – Rarst, Jack Johansson, cjbj, Mark Kaplun, Howdy_McGee
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Typically when you're hacked the hackers leave behind backdoors to get back in, over and over. It's safest to hire professionals to clean the site. There are several reputable vendors who do so; a specific recommendation would be off-topic but several of the top security plugins offer this service. – WebElaine Sep 19 '17 at 13:34
1

I found the problem. A hacker placed a backdoor (wp-admin/29) and forced to rewrite the htaccess with it! Thank you for the hint @WebElaine

Not the answer you're looking for? Browse other questions tagged or ask your own question.