Both of them are not by something like malware but by my fault. orz
The previous cause was the mojibake of this file which is corrected now. When I made the file, I edited it by a text editor. I replaced " " with " ", and I inadvertently did the " "s that are included in HTML tags. Then, that brought the mojibake. He-he-he. I tweeted about them like the below at the time. If you click the link, you can read other replies.
This time, the cause was an empty directory named “.well-known”.
The previous renew of the Let’s Encrypt certs did not work well, because the WordPress plugin “BPS” has more strict rules for Site Security.
At the test, I made two or three “.well-known” directories here and there. After complete the renewal, I forget to delete one of them. And this brought me “Security issues”.
But recently, I have more mistakes like this, which gets me into trouble. Hmm.