Are the File Permissions set right?
To secure your Drupal website, the first step you have to take is to set the file permissions right. Make sure that your web server is not given permissions to edit or write the files that it executes. Automated tools to set and verify permissions like File Permissions Module and Security Review Module respectively, can also be used. The PHP Filter Module under /admin/modules needs to be disabled.