wp-config.php being written by attacker

I would do the following things –

1) Check if any malicious content lives on the site. You can use free tools like – https://sitecheck.sucuri.net/

2) Change folder permission of your WordPress installation to 755 if it’s not set to that already. Also change the wp-config.php file permission to 755 to be on the safe side.

3) You can also try to protect wp-config.php file by using the following rule in your .htaccess file. You have to put it at the bottom of the file; after all other rules

<files wp-config.php>
order allow,deny
deny from all
</files>

Related Posts:

  1. Should I remove install.php and install-helper.php?
  2. Securing a multi-user permission structure
  3. Is it good security advice to install wordpress in subdirectory but link to root?
  4. Renaming install.php for security?
  5. What is the difference between a cer, pvk, and pfx file?
  6. How to solve “Kernel panic – not syncing – Attempted to kill init” — without erasing any user data
  7. Is it possible to decrypt SHA1
  8. How does the SQL injection from the “Bobby Tables” XKCD comic work?
  9. Error `sec_error_revoked_certificate` when viewed in Firefox only
  10. Convert .pfx to .cer
  11. Why should I use the esc_url?
  12. From a security standpoint, should bloginfo() or get_bloginfo() be escaped?
  13. Where to securely store API keys and passwords in WordPress?
  14. Why escape if the_content isnt?
  15. Full path disclosure on rss-functions.php
  16. What to use instead of wp_kses() in user output
  17. Are the default salts secure?
  18. is_email() VS sanitize_email()
  19. Is there a way to force ssl on certain pages
  20. Subscribe to email for security fixes?
  21. How to escape custom css?
  22. Understanding SVG vulnerabilities in WordPress related to a specific fix
  23. Moving wp-config.php: Can this be done after site launch?
  24. How to secure or disable the RSS feeds?
  25. What are the pros and cons of using a custom front-end to retrieve content from a WordPress back-end
  26. Do Cookies Need to be Sanatized Before Being Saved?
  27. Disable external access to REST API Endpoint
  28. Make password invalid once logged out of password-protected page
  29. How to get WordPress to save upload file beyond web root [closed]
  30. Is security a problem in WordPress?
  31. Moving wordpress out of the public directory
  32. Encrypt emails?
  33. WordPress salts set in config and database
  34. Logout via Subdomain, non-wordpress page on a different server?
  35. Disallow file edit not preventing plugin install
  36. Protecting HTML5 video [closed]
  37. How can I tell who changed the password?
  38. WordPress website Security [closed]
  39. Do I need to use the esc_html() function on hard coded links?
  40. Can’t reset WordPress password
  41. Is the “lost password” feature truly a vulnerability?
  42. Frontend Password change
  43. Restrictive File Permissions
  44. Is it possible to reduce the minimum character length for passwords?
  45. Handling email piping attachments and detecting unsupported file types
  46. Downloading File from Outside Web Root
  47. site get login attempts after htaccess ip restriction
  48. Why was my blog post inserted lot’s of ad links by others?
  49. wp-config.php modified?
  50. Moving wp-config.php up 2 levels
  51. How Could I sanitize the receive data from this code
  52. WordPress SQL Injections through User Agent
  53. Should I Worry About SQL Injection When Using wp_insert_post?
  54. Is there a way for a user to have an alias?
  55. How to prevent wp-login brute force attack from thousand of different IP? [duplicate]
  56. What permissions should I give directories if I want to make WordPress more secure?
  57. How to protect wp-admin through .htaccess?
  58. Something is unescaping all html entities before output to browser [closed]
  59. my wordpress website is suspended [closed]
  60. Is wp_kses the right approach in sanitizing this string?
  61. iTheme Security always lockout my account [closed]
  62. Is it sensible to worry about sanitizing admin input in plugin custom CSS?
  63. Limit Login Attempts BEFORE PHP is executed?
  64. Which Versions of WordPress Ship with the Patched TimThumb?
  65. Safe to say WordPress security releases don’t have database upgrades
  66. Use global variables or function that returns said variables for site-wide private-ish WP settings?
  67. fail2ban to prevent Brute Force Attacks on WordPress?
  68. Is it safe to give wordpress directories ownership to www-data?
  69. Use Google authentication for pages within a website [closed]
  70. How to give the same error message when the wrong password or wrong username is used?
  71. should I escape a literal url added in functions.php
  72. Someone keeps changing my SITEURL (mysql injection or xss?) [closed]
  73. Moving wp-config.php outside root folder where we have multiple wordpress websites for enhanced security [duplicate]
  74. Adding Security Keys?
  75. How might I sanitize an XML file before WP Import? (Does wordpress verify or clean text when importing from an XML document? )
  76. Secret keys in SCM
  77. Secure Server after configuration
  78. Uploading attachment (pdf) and prevent download for anonymous user
  79. After limiting the access to my wp-login.php by IP through .htaccess, all my password-protected posts stopped working. What’s the best solution now?
  80. Specific Page/Post Need to Stay Non SSL
  81. Block JSON access over the net
  82. Can someone do something to my website if I posted a snapped image of the header and covered my logo? (On reddit, when explaining a question)
  83. Scan multiple websites for malware that are in same webhost root?
  84. The in-famous Unable to locate WordPress Content directory (wp-content) and the Direct Method
  85. Security: AWS (shared hosting) claims template file malicious
  86. Why are the latest visits to my website originating from my own website?
  87. How to check whether a site has been compromised without browsing into it?
  88. My site thinks it’s secure when it is fact not
  89. Is it possible to only have the admin interface bind to the local loopback?
  90. PHP Code Sniffer – WordPress VIP Coding Standards
  91. Trying to understand nature of hacking
  92. How to rename the WordPress wp-login.php running on IIS6?
  93. Default installation permissions for wp-config.php
  94. Correct setup to block file modifications from hackers
  95. Is my WP site being hacked?
  96. How do you search for backdoors from the previous IT person?
  97. Possible to change email address in keypair?
  98. Why is SSH password authentication a security risk?
  99. Is wp-cron.php vulnerable to external attacks and how to protect it?
  100. How to address security vulnerabilities: LUCKY13, BEAST, and BREACH
techhipbettruvabetnorabahisbahis forumutaraftarium24edueduedueduseduedusedueduseduedus