BlueHost issues

Found out our homepage had been hacked
highroadtour.com had a bad index.html file that put up a jpeg and played an mp3 - need to initiate a lot of security for php
Removed a number of files that looked like wysiwyg ....php files that I thought looked suspicious, then removed the index.html file
ToDo
Found that renaming index.html wouldn't stop it - if the file is opened by a browser, you still
get the pirate stuff - and just going to the url provided a list of files with no index.html, so subdirectories could be examined -
helpdesk.bluehost.com find security, find php security fixes
Also, additional security for Joomla sites - see help at
http://www.siteground.com/tutorials/joomla/joomla_administration.htm