My Site keeps crashing due to the wp-confg file being deleted

Question

The wp-config.php file keeps on getting deleted. Before this started to happen, extra characters would automatically appear in my database username and password which would take my website down, I'd then notice this and delete those characters - then my site would appear back up. This same cycle happened consecutively before it moved on to deleting the wp-config file.

I am not exactly sure what is causing this deletion of the wp-config.php file, but I have restored it on numerous occasions, changed the database information several times and changed my credentials on both Cpanel and Wordpress; however, the problem still seems to persist. My website is currently down as I am writing this post --> Picture 1 is the current state of my website, and Picture 2 is the frequent error that I have been getting.

If anyone can please help me, advise, or any knowledge on why this could be happening. It would be very much appreciated. I'm just a student trying to make a means for himself. :)

Answer 1

It's probable that your site was hacked. And that will take some manual ('by-hand') investigation. Lots of googles on how to clean a hacked site. But, in general

• change all site/hosting credentials to strong passwords: hosting, ftp, database, WP users
• look for WP admin level users that shouldn't be there
• look at every file for inserted code
• look for hidden .ico file that contain code
• reinstall manually all plugins/theme code (by deleting the files first, then uploading manually via FTP fresh/valid code
• do the same for WP (delete all WP core code except your wp-config.php file, then upload new/fresh version)
• look again at all code (if you have deleted/reinstalled new code, time stamps should be the same, although some malware will mess with the file timestamp, so looking for different timestamps does't always work)
• look inside the wp-posts table for inserted posts, or posts that have code inside them
• always ensure latest updates are installed, including running latest PHP version (7.3)

I have a process that I use here: https://www.securitydawg.com/recovering-from-a-hacked-wordpress-site/ , there are others.

Cleanup can be done. But it will require some effort. There is no 'automatic' process that a plugin can do.

Answer 2

Try each separately:

• Disable all plugins.
• Activate the default Wordpress theme.
• Change wp-config file permission from 644 to 444, and change owner from current user to root.
• Use a security plugin like Wordfence and scan plugin, themes and core files.