How to prevent hackers to insert html file into /wp-content/ folder

[johannes]

and the DB for hidden admins

 

[Johnws2022]

Only Wordfence? Did not try Maldetect of any of the ones mentioned by others? Could not harm just to be sure.

But it's good you changed everthing to 755 resp. 644.

Yes, I ll try some other software suggested above too, but Wordfence does not scan on my website when doing it manually; it keep scanning for ever, it only scan itself, and found no hacking files. Now I have to remove Wordfence from my website because it added 25 database tables slowing down my website.