Last time I got a website defaced, it was the web hosting company's fault (server not properly hardened, thus exploited). Lots of websites on that server got defaced. Since it was some el cheapo web hosting account (IP diversity for seo purposes, usual stuff), I just figured out the hacker was somehow overwriting the default index pages (index.html, index.php) so I used htaccess to set another non-standard default page name (main.php was my choice), and modified the CMS to use default.php instead of index.php where needed. Ta-dah, problem solved. I still had my decoy index.php changed to the flavor of the week script kiddie's h4x0r handle, but nobody saw that anyways.
