Malware. Overwrites index.php and .htaccess?

Question

Malware

Caught something on the WordPress site, constantly overwrites two files in public_html, has already deleted everything completely, but they are recreated. index like this

spoiler

htaccess is standard for WP, but even when deleted, they are recreated, you can’t change them either, permission restrictions of 0.0.0.0 do not work. Maybe someone had something similar?

Thanks

Answer 1

1. Copy the backup archive from the hosting and scan the archive with an antivirus. Maybe the hosting server itself is infected from the inside.
2. Monitor (write) all external requests to the log.
3. Understand the rights to run scripts and .htaccess.
4. Write the necessary filters in .htaccess