Hack-based file change warnings

Config:
Under construction
No index no follow
WP 4.9.4
Fully configured iThemes Security 6.9.1 including Hide Backend

Issue:
The project has been started recently. Over the past days, hackers have changed and added files using https://[not-in-this-forum]/wp-login.php.

The clean config has been restored and rechecked.
The issue needs to be fixed asap.

• This topic was modified 8 years, 2 months ago by Mike.

The page I need help with: [log in to see the link]