By default, the latest version of WordPress is pretty darn secure. The development team of WordPress has considered anything which may have been added to any fix wordpress malware protection plugins. Before, WordPress did have holes but most of them are filled up.
Strong passwords - Do what you can to use a strong password, alpha-numeric. Easy to remember passwords are easy to guess!
Maintain control of your assets that are online - Nothing is worse than getting your livelihood in someone else's hands. Why take chances with something as important as your site?
BACK UP your website regularly and keep a copy on your computer and storage. For those who have a site that is very active, back. You spend a lot of money and time on your website, do not skip this! The one complete solution that does it all is BackupBuddy, no back up your files, widgets, plugins and database. Need to move your website this my sources will do it in less than a couple of minutes!
Just ensure which you can schedule, and you choose a plugin that's current with release and the current version of WordPress, restore and replicate.