What it is

A rule was found in .htaccess that quietly redirects visitors to a hidden PHP file when a special link is used. Attackers add this so a backdoor stays reachable even after the obvious malware looks removed.

How to fix it

Remove the suspicious RewriteRule/RewriteCond block from .htaccess (keep only the standard WordPress rules), then find and delete the hidden PHP file it points to. If you're not sure how, install the WordPress Plugin: its Security tab applies fixes like this one automatically.

In depth

I found malicious code in your site's .htaccess file, which is a very important server configuration file. Attackers modified it to redirect your visitors to dangerous pages or to maintain hidden access to your site even after cleaning the malware. To fix this, go to the File Manager in your hosting control panel, find the .htaccess file, download it as a backup copy, and then delete all of its content to restore a clean WordPress configuration. If you have any doubts, contact your hosting provider so they can verify that the file is correct. Afterwards, install a security plugin like Sucuri or Wordfence to detect suspicious changes in the future.