(While the answers and comments at How do I deal with a compromised server? are useful, my question is more about prevention of hacking when I do not have total (or much) control over the server. I have SSH access but not root privileges. I cannot see or change anything beyond my own user account.)
I volunteer for a non-profit, maintaining their web site for them. We've been on a low-budget shared hosting platform (Bluehost) for several years. The site was built on Wordpress and I did my best to keep core WP and all plugins up to date.
But we got hacked multiple times. Sometimes it was malicious (defacing the home page) while other times it was stealth (I discovered hidden files that seemed to just allow someone to get in and snoop around).
I totally got rid of WP, rebuilding the site on Bootstrap. I removed all files from the server, ran multiple virus scans on the local version of the new site, grep'd for anything that would be suspicious, and then uploaded the files to the server. I was nearly 100% sure this new codebase was "clean".
But within a few days, I discovered (by comparing the server to my local version) a hacked index.php (some 'preg-replace' code was inserted before the first line) and found a "logo-small.png" file in a subdirectory that was not really an image file. It was a big hunk of obfuscated PHP that looked set to to nasty things (I de-obfuscated and viewed the code).
I knew that shared hosts, often with hundreds of sites, could be vulnerable. At this point, I totally distrust the server we're on. But when I asked Bluehost if we'd be safer on a VPS or dedicated server (thinking our "sandbox" would be harder to get into), they said it wouldn't really make a difference.
So I'm in a quandary. The non-profit I help out has limited budget. But I also don't want to continue spending tens to hundreds of hours monitoring and fixing the site. I don't know if hackers are getting in via the file system or an open port that shouldn't be open.
Is there a cost-effective solution that provides much better "hardening"?