It was Monday morning and I was on a call with a dozen others who are my peers. Each of us helps the small business owner with their businesses in one way or the other. It was at the end of the call and we were each sharing our websites and going over how to make little improvements here and there. Time was running out and there was just enough time for one more website review, I volunteered. As my site was coming up for all to see suddenly the screen turned a maroon red with an outline of a security officer with his hand stretched out and the words of"do not precede malware threat." There was more but I was too horrified to recall exactly what it said. I was concerned about my site on being destroyed plus humiliated that the people on the telephone had seen me vulnerable, I had spent hours.
Finally, fix wordpress malware cleanup will even tell you that there is not any htaccess in the directory. You may put a.htaccess file if you wish, and you can use it to control access to the directory from IP address or address range. Details of how to resource do this are easily available on the net.
This is great news because it means that there is a strong community of users and developers who could improve the platform. Whenever there is a group there will always be people who will try to take them down.
Yes, you want to do regular backups of your site. I recommend at least a weekly database backup and a monthly "full" backup. More, if at all possible. Definitely, if you make frequent additions and changes to your site. If you make changes multiple times every day, or have a community of people which are in there all the time, a daily backup should be a minimum.
Make a note of your new password for the next time you sign in! I Home Page recommend the paid or free version of the check these guys out software *Roboform* to remember your passwords.
Do your homework and some hunting, but if you're pressed for time and want to get this done once and for all, try the WordPress safety plugin that I use. It is a relief to know that my website (and business!) are secure.