I am not using shared hosting. It was hosted on a Digital Ocean box using the recommended security updates, settings, file permissions etc and with as few plugins as I could get away with. I also had the "pro" version of Wordfence installed with active monitoring. Yet it was hacked.. multiple times.