Can your plugin solve my issue ?

@waqar111,

We agree with @nlpro.

While we no longer use iThemes Security, the following may fix your issue:

Procedure:

(1) Select one of your websites and perform a malware scan using the following scanners: Sucuri SiteCheck, VirusTotal, and SiteGuarding (this last one detects Base64 malware).

(2) If any of the above tools detect malware on your site, contact your host and ask them to perform their own malware scan to reconfirm the finding(s). If any detected, well, you know what to do. A major malware cleanup is required.

(3) If no malware is detected, create a backup of your selected website.

(4) Deactivate all of your non-essential plugins.

(5) Replace your website’s current htaccess file with a clean WP htaccess file.

(6) Clear all cache (site, server, and CDN level)

(7) Logout/login into your website.

(8) If your problem is solved, activate each plugin (one by one) and retest your site. If all is OK, then the issue is with your old htaccess file. If not, one of your plugins is causing the issue. Make sure you’re not using NULLED plugins.

(9) If the above is solved (as noted), you will have to recreate your htaccess file based on the offending htaccess code.

(10) After cleaning up your website(s), install iThemes Security to secure your website.

Note: Consider installing SG Security instead. It was released recently. We use it. Gets the job done, effectively!

Best wishes!

@waqar111,

Based on results obtained, and as @nlpro stated, no security plugin will be able to fix your issue. Your website may be infected.

Here’s what we recommend before hiring a malware removal company like Sucuri or your host, Namecheap:

(1) Perform a malware scan using your host’s malware scanning tool. You should also ask your host to run their own malware check — it’s in their best interest! Results?

(2) Perform a plugin conflict check. Very important. A plugin or custom code may be causing your issue. Once you identify the conflicting (or offending) plugin, contact the plugin’s author for a solution or delete it. Note: If you installed a NULLED plugin, it may have injected malware (or similar) into your website so this check may not help much.

(3) Your website’s Directory Listing is enabled (exposed). You need to disable it. Ask your host to disable it. Your website is running on LiteSpeed. Here’s how they can do that.

(4) Adjust and/or clean your website, then re-run the above malware check tools until the results are free from issues. Once done, you can install iThemes Security or SG Security. Of course, nothing is stopping you from installing either one at any time.

(5) If you can’t seem to identify the issue(s), then hire a developer and/or malware removal service.

Best wishes!