I back up my blogs using a plugin WP DB Backup. If anything happens I can always restore my blog. I use WP Security Scan plugin to scan my blog and WordPress Firewall to block requests that are suspicious-looking to fix wordpress malware scanner.
The one I recommend, and the approach, is to use one of the password generation and storage plugins available on your browser. I believe after a trial period, you have to pay for it, although people like RoboForm. I use the free version of Lastpass, and I recommend it for those of you who use Firefox or Internet Explorer. That will generate secure passwords for you; you then use one master password to log in.
Exclude pages - This plugin provides a checkbox,"include this page in menus", which is checked by default. If you uncheck it, the page will not appear in any listings of pages (which includes, and is ordinarily restricted to, your webpage navigation menus).
What if you visit WP-Content/plugins, can you view that folder? If so, upload this blank Index.html file inside go to this web-site that folder as well so people can't view what plugins you might have. Because even if your current version of WordPress is current, if you're using a plugin or an old plugin with a security hole, someone can use this to get access.
There is another problem you have with WordPress. People always know where they can login and they could visit with your login form and try a different combination of user accounts and passwords out. So as to prevent this from happening you want to set up Login Lockdown. It is a plugin that only lets users attempt and login with a password three times. Following that the IP address will be banned from the server for a certain amount of time.