I understood you fixed it, I saw it is working.
You can check the date of modification of the files in FTP - that will give you more file specific date of modification.
FTP is probably not required in your case if you have a GUI installed for the server OS.
It is not a good sign if a file is modified 'automatically' or public pages suddenly started throwing 500 error. I want to point you - for your setup, make the security from networking level very strong.
You need to make sure that no one can do unauthorized SSH tunneling. ISP is always a vulnerable point.