We have been approached by business owners with websites that keep getting hacked or infected despite performing a cleanup, security hardening and changing all passwords.
One client even deleted every file and rebuilt their website from scratch. At first we suspected that the problem might be with the host, but after investigation we found a devious trick the hacker had employed to ensure the website would remain hacked.
They scheduled a task that ran in the background to re-infect the site using the web hosting CRON jobs. The ability to run scheduled tasks is a feature of Linux, which is the operating system that runs all web servers.
Most commercial hosting provides an easy to access interface to setup and manage CRON jobs. If you website is every compromised then checking for unknown CRON jobs is a must to be on the check list.
Checking the CRON job tab for alterations should also be part of routine maintenance performed by your web administrator.
How is your Web Security? Take our quick 10 question assessment to see if your website if vulnerable to hacking.