I had a website got hacked when the FTP server running on the shared host got exploited. They added some malware injection code to the index.html file.

After that I added a cron job that compared the hash of the index.html with a precomputed value. Didn't change often enough to be a hassle.