My first step is not one you must take but I was helped by it. I had a good old fashion pity party. I cried and railed against the evil hackers (that where probably 13 and smarter then me) And I did before I started my website, what I should have done. And here is where I would like you to start as well. Learn how to protect yourself before you get hacked. The thing about fix wordpress malware and why so many of us recommend because it is easy to learn, it is. That can also be a detriment to the health of our websites. We have to learn how to add a safety fence around our site.
Do not depend on your Web host - Many men and women rely on their web host to"do all that technical stuff for me", not realizing that sometimes, they don't! Far better to have the responsibility lie rather than out of your control.
Yes, you want to do regular backups of your site. I recommend at least a weekly database backup and a monthly "full" backup. More. Definitely more if you make changes and additions to your website. If you have a community of people that are in there all the time, or make changes multiple times every day, a daily backup Read Full Report should be a minimum.
You can also get an SSL Encyption Security to your WordPress blogs. The SSL Security makes encrypted and secure communications with your site. You can also keep the all the cookies and history of communication so that all transactions are recorded. Make sure that all your blogs get SSL security for protection from hackers.
Software: If you have installed scripts that are free search Google for'wordpress security'. You'll get tips on the best way to make your WP blog protected.