config.php file get accessed
 

So I'm at a loss as to what to do about this. My website is getting hacked everyday (probably by the same person). I fix it, it gets hacked within a day or so.

From the looks of it, they are somehow being able to view the config.php file and thus getting database access and changing template entries to deface the forum.

Does anyone have any clue as to how they are doing this?

I also made a ticket but the response was saying i needed to give all sorts of login information. I can repair the forum myself I just need advise on how to secure it. I tried fully reinstalling the forum to make sure folder permissions were right, and also adding the htaccess file to deny all from config.php. You can't access it from the browser, but I'm guessing they are downloading the file and viewing it that way.

The forum is www.co3s.org and right now its hacked because my host's (host might be a cause of the problem) control panel isn't working right now so i can't fix it, but you'll clearly be able to see the config.php file contents in there. Maybe it's a possible issue on the host's side? Like outdate apache or something?

And to be clear, they are not editing any of the files via ftp. They are simply VIEWING the config.php file and then getting the login info to access the database and changing stuff.

Any help on this would be greatly appreciated as I'm at a loss.

EDIT: I changed the homepage to be something a little less messy then a hacked site. But essentially what the hacker put up there was the contents of my config.php file with a witty little addition up top saying "im uber, blah blah blah"