Plugin in Wordpress is automatically installed and activated
You can set limit file permission for .htaccess, wp-config.php for 444. Also, set recommended folder permissions.
You can install Wordfence & scan to see results where the file is affected & fixed it.
You can run also, virus scanner from the Cpanel account.