Finally, fix wordpress malware protection will even tell you that there is no htaccess in the wp-admin/ directory. You may put a.htaccess file if you desire, and you can use it to control access by IP address to the wp-admin directory or address range. Details of how to do this are easily available on the internet.
You can search. If hackers abruptly hack your site, you can restore your site with the use of your files and change everything that must be changed.
For me it's a WordPress plugin. They're drop my response dead easy to set up, have all the features you need for a job such as this, and are relatively cheap, especially when compared to having to hire someone to have this done for you.
Upgrade, if you aren't running the latest version of WordPress. Leaving your site is similar to maintaining your door unlocked when you leave for vacation.
The plugin should be regularly updated have WordPress cloning, play news nice with of your other plugins and to stay current with the latest WordPress release and restore capabilities. The ability to clone your website (along with regular backups) can be helpful if you ever want to do an offline site redesign, among other things.