You probably have a shell (AKA: backdoor) script on your site somewhere. Possibly some system/script on your site has a vulnerable hole which allows the hacker to upload a malicious script to your site. This is done through RFI (Remote File Include), XSS, ect. You probably have a script on your site that allowed the attacker to upload a shell script such as the c99 shell (most widely known, but detectable).
Another possibility is you downloaded a RAT (AKA: Trojan, backdoor, keylogger). A RAT is a virus that allows the attacker to connect/control your computer at any time. They can do whatever they what, so long as it is a feature of the rat. Such as log keystrokes, pull up saved passwords, turn on webcam, microphone, lock keys, mouse, run/upload files.. Basically they control your entire computer. They could have gotten your login details for your site (cpanel, whm, or FTP) by logging your keystrokes.
Another possibility, if your on a shabby hosting service and someone else on the same server as you got rooted (a shell uploaded, or some other method of gaining root access to the server), and the web hosting provider sucks as security, allowing them to traverse to your user account as well. This is less likely, but possible.
I am sure there are some other possible explanations as well. Maybe some weird wordpress plugin you added to a site...? Who knows, theres dozens of ways. The above are generally the most common.
Oh, also, if the server is not secured properly, they could have public FTP access allowing this as well.
DO THIS:
If you have root access (ie: on a dedicated server) you can install a rootkit detector or backdoor detector (same thing). It is kind of like an antivirus scanner, only for your web server. It will detect most rootkits (unless, encrypted/obfusculated and not publicly spread). Remove any rootkits. Inspect all sites, scripts, services running to ensure it isn't a possible entry point. You could track through log files if you have root access to the server, patience, and experience to know what to look for. This would help you find exactly how they got in so you know where your hole is. Only experienced users with this kind of stuff and server security will be able to do this.
If you aren't on a dedicated server (your on a shared hosting), then contact them and tell them what is going on, and ask them to scan the server for rootkits. There isn't much you can do (aside from finding the vulnerable script, or finding the actual shell/rootkit laying on your server.. if it even is there)
If you know the exact time the attack happened (look at .htaccess modified time), then look at the server access log file to at that exact time frame to find what urls were accessed on your server, you may be able to find the cause. If the issue is the access through public FTP and your on a shared server, then the webhost will have to fix that as root access is required to change this setting.
If it is due to a RAT/keylogger on your computer.. then honestly, format the computer. Yeah, you can use a good antivirus, even 5 different ones. Kill all startup apps, clean it the best you can. But you never are 100% sure it is gone. People can have apps bind to known processes (explorer.exe which is required) so it will never show in the startup list, and you will never find it in taskmanager process list... Just backup, and format. You can never be too safe.
Get on a friends computer, or computer you know can't possibly be infected. Go and change all your passwords ect. (it is dumb to do this on your PC if they are keylogging you, lmao they will see your new passwords). Might as well change bank passwords, paypal passwords, and anything else you don't want someone getting into. You don't know how much they have seen.
Some may say this is overkill... Ok, if you know 100% it is on your server and not a virus on your computer, fine.. But if your not positive, then just do it. You haven't seen half the shit I have, its pretty fucked up what people can do. Just some advice..
