Scan don't detect vulnerability for deface cyb3rsw0rd

The free version and the premium version both detect the same way. If your themes and plugins are up to date, there could be a vulnerability that hasn’t been discovered yet. Another possibility is a compromised password, which could include your FTP or database passwords. Your host may be able to help you find the logs, to see if someone else logged in, bypassing WordPress itself.

There are some good recommendations in the link below to help prevent a recurrence, if you do not know how the attacker got in:
https://docs.wordfence.com/en/My_site_was_hacked._How_do_I_use_Wordfence_to_clean_it%3F

Thanks.
Ftp: is disabled
The problem is that create an index.html file on each folder

If your themes and plugins are all up to date, it might help to check their support forums to see if they are all still being maintained. Some theme/plugin authors don’t maintain their older works, and they could have security holes even when they are up to date. Changing all passwords associated with your site is still recommended (and the rest of the items in the link above) — you may also want to check that your WordPress users list doesn’t have any new admins created.