thanks for the reply
I haven't done anything to the apache config, I'm using nginx + apache setup
What would I need to change in apache to ensure it doesn't keep happening?
yes, I'm logging in through SSH/WinSCP using the user/pass for the user the website is added to