Protect Wordpress website from adding spam scripts?
<p>Once found a spam script on site, I removed it, changed all ftp and wordpress passwords and installed Sucuri Security plugin. And now, after 3 weeks, again spam messaging is detected and I found in Sucuri Security logs this record: </p>

<p><code>system 127.0.0.1   New file added: (multiple entries):
wp-admin/.htaccess (size: 244)
wp-admin/ms-default-constants-stat.php (size: 11674)
wp-content/.htaccess
wp-content/wlwmanifest_backup.php</code></p>

<p>In last login logs, there was no successful logins in these 3 weeks.
And I doubt that hackers guessed ftp password.
Changed all passwords anyway but now I would like to prevent this in future. Are there ways to prevent this from happening again? </p>