osama001

Sorry accidently replied in wrong thread. Now I can’t delete the comment.

I’m having the same issue. I’m also using the ocean wp theme.

I resolved the issue. it took a lot of time but it get resolved.

Scenario 1
First thing is to restore backup through cpanel if you haven’t made any changes to web because by restoring backups you can get it fixed and you don’t have to get involved in complexities. If that’s not the case you can follow these steps

Scenario 2 (Recommended)
Replace all of your .htaccess files with genuine files. Delete .htaccess files in folders like plugins, themes etc and replace .htaccess from fresh wordpress installation.

Scenario 3

<FilesMatch ".(phtml|php|PhP|php5|suspected)$">
Order Allow,Deny
Deny from all
</FilesMatch>

If your .htaccess file look like this then change it to allow from all to get access to wp-admin

Scenario 4
If your .htaccess file keep changing even if you fix it

1: Make a backup of your root Directory
2: Make a backup of your database
3: Install All in one wp migration plugin (it’s free)
4: Take a backup through that plugin.
5: Install a fresh wordpress in to local machine (Xampp, Wampp, Usbwebserver etc)
6: Install wp-migration plugin in it.
7: Restore backup in localmachine (Using wp-migration will change all of your .htaccess files so issues related to access will get solved. It will also change wp-core files like wp-admin and wp-includes)
8:Test your website by using plugins like scuri, wp cerber and malcare and try to manually delete files through cpanel.
9:Delete all nulled plugins and themes if there are any
10: Try to find and fix loop-holes so no one can access it again
11: Enable live traffic monitoring to catch users
12: disable access to wp-login.php
13: change login URL
14: Stopped user enumeration
15: Protect admin scripts
16: Disable PHP in uploads
17: Disable PHP error displaying
18: Block Access To WordPress REST API
19: Block Non Excising Users
20: Disable dashboard redirection
21: take a new backup with wp-migration or duplicator pro
22: Restore it back at server and harden the server so no one can penetrate it.

I hope it helps someone.

I’m having the same issue with my client website. I can’t even access wp-admin. The virus modified my .htaccess file and make a duplicate of it in almost every folder. I get 403 forbidden error every time I try to login to WordPress.

If you found the solution to your problem then kindly share it as a reply. Thanks