fix wordpress malware removal will even tell you that there's not any htaccess in the wp-admin/ directory. You can put a.htaccess file if you wish, and you can use it to control access to the wp-admin directory by IP address or address range. Details of how to do this are readily available on the net.
Backup plug-ins is also significant. You need to backup all the files and database you can bring back your site like nothing.
Exclude pages - This plugin provides a checkbox,"include this page in menus", which can be checked by default. If you uncheck it, the page will not appear in any listings of pages (which includes, and is ordinarily restricted to, your page navigation menus).
Note that you should only try this step for setups. If you would like to do it for existing installations, you need to change the table names inside the database.
Using a plugin for WordPress security makes sense. read this WordPress backups need to be performed on a regular basis. Do not from this source become a victim of not being proactive about your 16, because!