For shared servers, I like to ask the host if they use “suPHP”.
This is a version of PHP that makes scripts run in the context of their owner, so that somebody hacking a website doesn’t get the permissions of the “apache” user (which generally can access all websites on the server), but only gets the permissions of the website they hacked instead (which generally can only access that users website). This strikes me as a more secure solution for shared systems, and hosts who use it tend to be more on the ball.
Other hosts don’t do shared systems at all in that way, and use virtualization instead. This is way more secure, but also more expensive.
Best way is to simply ask them what their security measures are. If they won’t give details on how their servers are secured, then I’d look elsewhere. Many hosts will just blow you off and say “we’re secure” but some will give details if pressed for it.
