Why do php files appear with a redirect?

Question

PHP

Good day!
Faced with the problem that my sites began to redirect to different advertising sites.
After searching what was the matter, I found that .php files began to appear in the interior of the site, after deleting which everything fell into place.
But THEY are showing up again!
I've never experienced this before and don't know how to fix it.
Help guys, maybe someone knows what it is and how to deal with it.
Hosting is hosted on windows server 2012, apache 2.4
I would be very grateful.
Why I use windows server and apache - it was configured before me and no one wanted to change the whole thing ...

Answer 1

The attacker has access to the server:
- login/password ftp. Change password. Use sftp. It is better not to use a password at all, but to log in by key
- a windows vulnerability. Download all patches. It's better to switch to CentOs
- site injection. Because of a crooked programmer, this often happens. On Toaster, every second example of code
is shitty code with holes. Hire a competent developer and conduct an audit (for starters, automatic, and then manual).
- login-password from the site admin panel. Change password. Use https. Update all third party modules (e.g. phpBb)