Sites hacked across login pages
I had this problem before with some friend about files folder 

The solution to this problem is:

1.- in your apache conf or nginx conf or .htaccess disable all formats php in the path /files/*

2.- if you have the opportunity change the permissions to the folder but the first point works, they will upload files php but, they will not run it.

3.- remove estrange files php and search for every file that contains text like base64, search something about this in google or other searcher.

They enter by a port using exploits and add a file like image.php.jpg, and after the file is uploaded, they change the name to image.php (it is not the real name but you get the idea).

That file is an php form, they upload files php through it, like a command line and do a lot of things...

I hope this help you.