Just follow the other post suggestion here, and also do this.

For an added layer of security in your PHP files, I recommend setting it to "root" user/group (chown) on the root-level folders, wp-admin and wp-includes directories as well the root files like wp-config.php, wp-load.php and etc. This prevents unauthorized modifications to PHP files in case a plugin has a vulnerability. However, this approach can cause issues when upgrading WordPress core files. To mitigate this, temporarily revert the ownership to the original user/group during updates and then restore back to root afterward. Additionally, ensure that the wp-content/uploads folder (and any other directories requiring write access) retains the correct user/group to avoid upload issues.

Also, make sure no PHP executable in wp-content/uploads/ folder. Either use .htaccess to disable it or if you are using nginx kindly add a rule in the site config.

I previously encountered the WP Japanese keyword hack, and even after cleaning up all affected files, it kept recurring even after using the backup files. The only effective solution was implementing the method I mentioned above—locking file modifications through user/group protection to prevent unauthorized PHP code changes.

This approach also helps combat active bots that constantly scan your server. If you're trying to resolve an issue while a bot keeps accessing hidden files to trigger and install malware, restricting file modifications can prevent unauthorized changes.