• This strange thing keeps happening to my WordPress website.
    Every one week my HTACCESS file gets modified by itself.
    And the website keeps going down because of this.
    The original HTACCESS keeps changing to this:

    # BEGIN WordPress
    <IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /
    RewriteRule ^index\.php$ - [L]RRewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule . /index.php [L]
    </IfModule>
    
    # END WordPress

    from my original HTACCESS file:

    # BEGIN WordPress
    <IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /
    RewriteRule ^index\.php$ - [L]
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule . /index.php [L]
    </IfModule>
    
    # END WordPress

    after I upload the original HTACCESS file to my WP root folder, the website is working again.

    For some reason this RRewriteCond %{REQUEST_FILENAME} !-f comes to my HTACCESS from somewhere, and that seems to be the problem.

    Any ideas, how can I prevent the HTACCESS file to get hacked??
    Thx in advance.

Viewing 2 replies - 1 through 2 (of 2 total)
  • Who is your webhost? Do you have any plugins that run in the background or each week?

    You can try and prevent .htaccess from being changed by setting the permisisons to 444. See Filezilla and FTP Clients ? WordPress Codex and Changing File Permissions ? WordPress Codex.

    But if it’s your webhost, root will override your changes.

    Thread Starter Stephen B

    (@wordpmoon12)

    I’m using the BackUpWordPress plugin to make weekly backups of the website. I use the same plugin for other websites also and it hasn’t caused any problems before. Anyways, I will uninstall the plugin and see if this helps.

    If I change the HTACCESS file permission to 444, and it still keeps changing. Does it mean the problem might be with the webhost company?

    Thanks!

Viewing 2 replies - 1 through 2 (of 2 total)
  • The topic ‘.htaccess file hacked?’ is closed to new replies.