Cloning your website is another degree in fix wordpress malware removal that may be useful. Cloning simply means that you've backed up your website to a totally different place, (offline, as in a folder, in order to not have SEO problems) where you can access it in a moment's notice if necessary.
Protect your login credentials - Do not keep your login credentials where a hacker might locate them. Store them offsite, as well as offline. Roboform is for protecting them very good . Food for thought!
Luckily, keeping your WordPress site up-to-date is one of the most easy things you can do. For the last few versions, the ability to install automatic updates has been included by WordPress. Not only that, but sites are notified basics whenever a new upgrade becomes available.
Now we're getting into matters specific to WordPress. Whenever you install WordPress, you have to edit the file config-sample.php and rename it to config.php. You need to install the database details there.
Do your homework and some searching, but if you're pressed for time and need to get this done once and for all, try the WordPress safety plugin that I use. It is a relief to know that my site (and business!) are secure.