In the modern web dev, you don’t want a mutable web root at all - instead, when you run your deploy command, the entire web root is removed and replaced with la

In the modern web dev, you don’t want a mutable web root at all - instead, when you run your deploy command, the entire web root is removed and replaced with latest version from git. So there are few chances to have “web shells” as long as your git repository is intact, and you deploy periodically. That said, if you want extra security, you can add a process monitor which sends an alert any time there is an process running with web server‘s user.