Skip to main content

Public_html and other sub folder index.php and htaccess file issue

shaktis
I recently noticed my server domain public_html index.php and htaccess file is overwritten by someone without permission and the same thing happens on several subfolders. On some websites, new subfolders are created on public_html all of them have index.php file. Sometimes Wordpress related folders are created. That updated index file has this on public_html On subfolder .PHP file has this code Automatic cron are setup on the server which I have never created. I have checked the log this I get 66.248.202.40 - - [11/Nov/2022:09:25:59 +0000] "GET /.well-known/themes.php HTTP/1.1" 200 - "

Comments

5 comments

Date Votes
  • cPRex Jurassic Moderator
    Hey there! Do you have SSH access enabled on the account? If so, the user could have come from anywhere with a stolen password. The first place I would echeck would be the cPanel access logs, specifically looking for access to the Cron or File Manager of the cPanel interface. If you can find access that isn't authorized, you can block that IP address. It would also be a good idea to have any users with access to the cPanel account scan their local machines for malware, as keylogging software to steal passwords is common.
    0
  • shaktis
    Thank you for your response, I have checked both access log file via terminal and raw access log but haven't found any instance or activity of adding cron file or adding index.php and .htaccess file on the server itself. Can you please provide more details and suggest how we can prevent that from happening going forward?
    0
  • cPRex Jurassic Moderator
    The best way to check that is to recreate the process inside cPanel. For example, I would watch /usr/local/cpanel/logs/access_log while opening the File Manager inside of a cPanel account, and then you'll know what to search for in the log to see that same action from other IP addresses. If you really don't see anything there, it could be a malicious script inside the account that is creating these files, so you'd want to investigate the account for malware. We recommend Imunify for scanning your machine, and there are details on that process here:
    0
  • shaktis
    Thank you for the detailed information, I will review that and will also consider the anti virus option you suggested. One more question: Is there any settings I can make to open file manager, FTP, ssh, cpanel etc. from allowed IP address only? Please suggest.
    0
  • cPRex Jurassic Moderator
    There isn't a way to further restrict areas of the cPanel interface - once a user is logged in, they can see all areas.
    0

Please sign in to leave a comment.

Didn't find what you were looking for?

New post