How to automatically prevent WordPress htaccess and index.php from being rewritten by malware with a security plugin

We will explain how to use a security plugin to automatically prevent WordPress htaccess and index.php from being rewritten by malware.

Prevent malware (hackers) from automatically rewriting htaccess and index.php

When infected with malware, hackers may rewrite index.php and htaccess. Even if this rewriting is removed, it may revert immediately.
We will explain how to prevent the rewriting of index.php and htaccess by hackers using plug-ins.

First, download, install, and activate a security plugin that protects htaccess and index.php.

Free WordPress:Malware Scanning & Security Plugin [Malware and Virus Detection and Removal].

In the WordPress admin page, go to Malware Scan→Security tab→Repair and protect .htaccess and index.php Turn on the checkbox for the function and save the settings.

Cautions
Please make sure that index.php and htaccess are not already infected with malware. If they are infected and you protect them, they will be automatically protected forever in the infected state. Please make sure that there is only the initial code as shown below, or the security and SEO posts.

Initial code of index.php

<?php
/**
* Front to the WordPress application. This file doesn't do anything, but loads
* wp-blog-header.php which does and tells WordPress to load the theme.
*
* @package WordPress
*/

/**
* Tells WordPress to load the WordPress theme and output it.
*
* @var bool
*/
define( 'WP_USE_THEMES', true );

/** Loads the WordPress Environment and Template */
require __DIR__ . '/wp-blog-header.php';

Initial code of .htaccess

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress

The WP DOctor plugin also has a function to initialize and protect index.php and htaccess that have already been tampered with. If your index.php or htaccess has already been tampered with, please use this function!

How WP Doctor plugin protects index.php and htaccess automatically

This page explains how WP Doctor plugin automatically protects index.php and htaccess.

1 Start of protection

Malware infecting processes, etc. with malicious code in an infinite loop rewrites index.php and htaccess at high speed. For this reason, this plug-in rewrites index.php and htaccess up to several hundred times in a row to make sure that they are properly saved with the protected code, and starts protection the moment the code is properly protected.

2 Change the permissions to those that are difficult to rewrite.

Next, the plugin changes index.php and htaccess to write permissions that do not allow rewriting of the files. This will make it difficult for malware to rewrite the files.

3 Always monitor index.php and htaccess for rewrites

Each time the site is accessed (each time WordPress is initialized), it is compared to the protected content code stored in the database and monitored to see if any rewriting of index.php or htaccess has occurred.
If rewriting has occurred, rewrite index.php or htaccess and repeat the process 1 and 2 to protect it again.

Should the automatic protection of index.php and htaccess always be enabled?

This function compares the code in index.php and htaccess with the legitimate code stored in the database each time the site is accessed, so the server load is relatively high.
For this reason, we recommend that this feature not be enabled at all times for sites with high traffic.
For sites with high traffic, we recommend enabling it for about a month after malware removal if there are signs of malware infection on the site, or if other sites on the server are infected.

What if the index.php and htaccess rewriting (tampering) does not stop?

The index.php and htaccess protection functions by plug-ins disable the write permission of files, but some malware may further rewrite this write permission and alter the index.php and htaccess files.
In the case of malware that resides in the process, the protection function of the plugin may not be able to remove the tampering, and the normal state and the state where the malicious code is being rewritten may occur repeatedly.

In such cases, malware removal should be performed first. The above plug-ins have a malware detection and removal function, so we recommend that you use this function, and if you cannot handle the problem, we recommend that you consult or request a professional malware removal service as soon as possible.