Substitution of index.php where to look?

Question

Malware

index.php in the root of the site is changed to an infected one. server tools. Only 1 file. Almost instantly, less than a second. I delete via ssh, update, it is already in place. Those. it is copied from somewhere.

Not via ftp. Not over http. checked.
The crontab is empty.

Where to dig? Regular hosting.

Updated:
A line is also added to .htaccess. .htaccess, unlike index.php, is not completely replaced, only a line is added.

RewriteRule ^\/(balladic)([0-9]+)(.*)\/bs([0-9]+)\/(.*)$ ?balladic$2=$4&%{QUERY_STRING}[L]

Answer 1

Upload files to the server and remove edit permissions for the web server and php.
In addition to the uploads folder, leave the rights.
Try changing the subject, maybe your legs grow from there.
PS. But WP will not be able to update, so you have to do it manually.