how to stop hacker uploading malicious spts in public_html

m using wordpress..and recently found malicious script attack on my server..hacker had uploaded 1 script in public_html,wp-content,wp-admin and modified theme,changed password of admin etc..etc…i have reset these directory/index permissions to 705/444 now..i think that was the issue..but how to stop incase of ROOT[pub_html)?
if i change permission to 705 i get “500”ERROR…