I see you have a few mods installed. Not saying all mods are bad but some can punch holes in your security. Need to check on those.
Check server logs to see how they are getting in and where they go once they do get in.
Check your htaccess file to make sure the back end of the software is protected.
Check to be sure you have html posting turned off for all usergroups.
Even if on a dedicated server or vpn, you have to have the same security set in place as if you were on the wildest shared hosting you could imagine.
|