Hacked? Bad Code in root/index.php

Hello Forum,

in the last weeks there were several “attacks” or something on my WP-Installation.
Users reportet that if they visit my website, their kaspersky find a virus. I watched the code and there was a javascript from some russian spam website…
i searched for the code in my wp-files and found it in the root/index.php (CHMOD 644)
I deleted it and everything was okay but it happened again. I allready installed Plugins like wp-security.
What can i do do prevent bad people from putting bad code into my website?!

Thanks a lot for help

Sumit

( https://www.sumit-online.de )