fix hacked wordpress will tell you that there is no htaccess in the wp-admin/ directory. You may put a.htaccess file if you desire, and you can use it to control access by IP address to the directory or address range. Details of how to do that are easily available on the internet.
Protect your login credentials - Don't keep your login credentials where they might be found by a hacker. Store them offsite, and even offline. Roboform is very good for protecting them. Food for thought!
Luckily, keeping your WordPress site up-to-date is one of the simplest things you can do. For the last few versions, WordPress has included the ability to set up automatic updates. Not only that, but websites are notified whenever a new update becomes available.
Upgrade, if you're not running the latest version of WordPress. Like maintaining your door this page unlocked when you leave for vacation leaving your website is.
I prefer to use a WordPress plugin to get the work done. Make sure that the plugin you select is able to do copies, has restore and can clone. Be sure it is often updated to keep pace with all versions of WordPress. There's absolutely not any use in backing your data up to a plugin that is out of date, and not functioning.