Help with htaccess security and multisite

Hello, Kevin, & welcome. W/all due respect, Sir, I think changing the .htaccess file is not going to stop the hack.

Since I don’t know if this is a shared, vps, or dedicated server, please be so kind as to let me ramble a bit in order to try to cover the contingencies.

You are clearly very knowledgeable, so some things I say may seem obvious, for which I request pardon ahead of time. However:
* Please make sure any device(s) you use to log onto your website are clean. Changing passwords, etc, as advised below, will do you absolutely no good if malware is sending them home to its command-&-control server.

* The same applies to your network–make certain it’s clean. Please don’t use insecure hotspots, etc, to log into your server. & if you transfer files, please use a secure protocol. All this you know, I’m sure, but just covering bases.

Now, concerning the site–the first thing I’d do if it were I is to lock down the server. This means changing passwords, &, if you have root access, disabling root logins by password & only using SSH keys. If that is not possible, then at least change the password to something that’s beyond tankproof & not something you’ve ever used previously. Secondly, please Change your Plesk password. 3rd, please change your database password, remembering to reflect that change in your wp-config.php file. While you’re at it, please go get some new salts (your wp-config.php file will have instructions on how to do that & replace the ones in wp-config.php w/the new ones. That will log out all users currently logged in.

Next, please log into your dashboard, go to ‘users’ & check to see if there are any users, especially ones w/elevated privileges, that you don’t recognize. Clearly delete these if this is the case.

The next things we want to do are to check if there are any admin accounts created outside of WordPress & to check whether there are executable files in your uploads & other user-generated content. The plugin Wordfence is pretty good in this regard. Here are the scan options I recommend checking, at least in this case. You can note the ones that are unchecked by default & turn them off once this is over.
“Scan core files against repository versions for changes
Scan theme files against repository versions for changes
Scan plugin files against repository versions for changes
Scan wp-admin and wp-includes for files not bundled with WordPress
Scan for signatures of known malicious files
Scan file contents for backdoors, trojans and suspicious code
Scan file contents for malicious URLs
Scan posts for known dangerous URLs and suspicious content
Scan comments for known dangerous URLs and suspicious content
Scan WordPress core, plugin, and theme options for known dangerous URLs and suspicious content
Scan for out of date, abandoned, and vulnerable plugins, themes, and WordPress versions
Scan for admin users created outside of WordPress
Scan for unauthorized DNS changes
Scan files outside your WordPress installation
Scan images, binary, and other files as if they were executable”

Lastly, you should have a look at your database to see if there is hacked content there. Some strings to look for are:

<script
<? php;
base64;
eval 

preg_replace
strrev`

This is not an exhaustive list, & finding some of these strings is not necessarily proof positive that a hack is present, although some are more suggestive than others, ie, strrev doesn’t generally have a purpose in WordPress that I know of.

I hope this proves helpful. Please let us know if you have questions or need additional assistance.