your file permissions should be 644 and directories should be 755. The only user which have permission should be www-data. Other users only have read only permissions. In your case that looks fine.
Put a daily scan of clam-av and LMD on your web root directory. If you are using any built-in frameworks verify the security with there site and always have the latest versions of the applications.
To montior the web root directory you should put inotify on /var/www so you should know which files edited, created and deleted on the filesystem. The first step of the hacker is put some files on the web root and then navigate into the filesystem so you should monitor that via inotify.
Always have the daily backup of the old files so you can compare the files if any edited newly on the web for malicious code.
All the files created in the images folder should not have execute permission also put a check that the uploaded file is image only, also check the extensions of the file.
Hope that helps.