My site was hacked, how can I use chmod permissions to avoid this? To be honest, only the home page was switched (even the text that was modified bragged about this, grrrr!), but still... not pleasant at all.

So the important question, and something that was on my mind for a long time but never got around to ask:

which files MUST be read-only or what kind of permissions should I had to enforce in which files to make this at least a bit more difficult?

Thanks in advance.
See: Securing file permissions and ownership

You also might want to try adding the Security Review module to help make sure your site is following the correct file permission settings.