.htaccess file changes disappear
This is what happens in a Wordpress (Woocommerce) site I've been asked to investigate.
1) I make a modification to .htaccess and save it.
Here's output of the ls -command
% ls -l
ll
-r--r--r-- 1 user group 248 Sep 7 11:31 .htaccess
2) Just a moment later
% ls -l
-r--r--r-- 1 user group 235 Jul 20 09:42 .htaccess
The changes have disappeared. Note the changed date in the file (apparently it is copied from somewhere).
What is causing this? And how do I stop it from happening?
Answers 2
I was having a similar problem recently. It turned out it was due to a code injection in the /wp-includes/nav-menus.php file. There was a Base64 malware code injected that was causing my .htacess file to chmod itself to 444. Something called some kind of darkleech malware. See this link for more, maybe it's what's happening in your case as well: https://blog.sucuri.net/2015/03/pseudo-darkleech-server-root-infection.html
As I see, the file has read only for all. Could it be that it is deleted and a new file is added? See this answer, read only files can be removed with rm
To be procise: a plugin, server feature or some other custom code (maybe in functions.php?).
You could analyze the file by checking what updates are made to it using tail or watch You could check who or what last modified the file (applies to user changes) Normally if you disable all plugins step by step and exclude each of them, then it's something with the server.