I don't know about you, but when I secured my WordPress blog, and I researched to see what others do to maintain their blog safe, I found information I was completely confused. And some of the information was actually over the top or superstitious. People told me to rename this file, rename this folder and install these ten plugins. It seemed to be quite a lot of energy and work.
Backing up your site also helps in procuring from fix hacked wordpress hackers. You must keep a copy of your documents hide away in backup system so that you can be confident of your database. This makes you a protected backup files that serves you in times of down that is unexpected is the system. Hackers are less likely to steal from a secured back up system.
Use strong passwords - Do your best to use a password, alpha-numeric, with upper and lower case and special characters. Easy to remember passwords are easy to guess!
Yes, you want to do regular backups of your site. I recommend go to this website at least a weekly database backup and a monthly "full" backup. More, if possible. If you make frequent additions and changes definitely. If you make changes multiple times a day, or have a community of people that are in there all the time, a daily backup should be a minimum.
You can extend the plugin features with premium plugins like: Amazon S3 plugin, Members only plugin, DropShop etc.. I think this plugin is a good choice and you can use it at no cost.
There is another problem you have with WordPress. People know where they can login and they also could drop by with your login form and try a different combination of passwords and user accounts out. In order to prevent this from happening you want to set up Login Lockdown. It is a plugin that allows users to try and login with a wrong password three times. Following that the IP address will be banned from the server for a specific amount of time.