Most of the wordpress templates achieve this by just adding a few lines of base64 encoded script in one of the template files, decoded and eval()'ed on run, though this won't stop everyone from removing it.
You can make it a bit more secure by adding checker scripts like that to multiple files and making them cross-dependent.