[ad_1]
I have a couple of WordPress website hosted on 2 different hosting provider – Bluehost (shared hosting) and AWS (EC2)
For last 20+ days, someone is injecting malware script on my website every day.
I scan the whole server, remove the script and another day, it’s back again.
To prevent this from happening again, I have completely disabled WordPress admin login from htaccess.php by blocking all IP.
I have installed a malware scanner. I have disabled app Remote Desktop and FTP ports.
I have installed WordFence and yet somehow again the malware is seen when I view the source of the blog html in browser taking me to unknown casino and adult websites.
What are my options now?
[ad_2]
Install wordfence, also change all passwords, database, cpanel, etc… also check for FTP accounts
Try doing an in-place install of WordPress. You may have an infected core file that WordFence isn’t detecting. An in-place install might overwrite the intruder code and stop the reinfections.
Also, install the Black Hole for Bad Bots plugin and make sure your robots.txt file is updated.