I have a web server and installed wordpress on it. I would like to know about the files permissions which are required to secure my site. (last time XSS happed on my site, they wrote inside my all index.php files and some other files. I don't know how they did this.)

What are the best file permissions?