.htaccess hacking attack

[hajusinuyo]

i have prestashop site. that site hacked by someone. it was only .htaccess file change. when we log into mobile device it redirect to other site. the .htaccess file generate every directory. when i change the code it will fix. but again and again the hacker change the .htaccess file. how to fix it.

[selectshop.at]

You should strengthen your server. Speak with your provider. Use a firewall, disable access and fileuploads by third partie, i.e. disallow file changes. Furthermore your .htaccess should have not more than chmod 0755 writing permissions.

For to avoid .htaccess are read and directories are listed add the following lines to Prestashops .htaccess

# secure htaccess file
<Files .htaccess>
 order allow,deny
 deny from all
</Files>

# DO NOT SHOW DIRECTORY LISTING
Options -Indexes

You can also add this further line to prevent crucial files changing from third partie:

# DENY ACCESS TO PROTECTED SERVER FILES AND FOLDERS
# Files and folders starting with a dot: .htaccess, .htpasswd, .errordocs, .logs
RedirectMatch 403 \.(htaccess|htpasswd|errordocs|logs)$

Add these lines to your .htaccess BEFORE Prestashop block and not inside of it !