My sites regularly got injected with malicious code and files.

Code injected to cored wp files like index.php or functions.php file of theme, and php files in root directory of web app, themes, wp-admin dir…

I have no idea where they come from, how to prevent them. The impact is that requests to my sites will be randomly redirected to other sites