clean hacked wordpress site will tell you that there's no htaccess in the directory. You can put a.htaccess file if you desire, and you can use it to control access by IP address to the wp-admin directory or address range. Details of how to do this are easily available on the internet.
The one I recommend, and the approach, is to use one of the generation and storage plugins available on your browser. I think after a free trial period, you need to pay for it, although RoboForm is liked by people. I use the free version of Lastpass, and I recommend it for those of you who use Firefox or Internet Explorer. That will generate secure passwords for you.
While it's an odd term, Extra resources it represents a task that is essential : creating a WordPress copy of your website to work on offline, or in case something should go amiss. We're not only being obsessive-compulsive here: servers go down every day, despite their promises of 99.9% uptime, and if you've had this happen to you, you know the panic is it can cause.
You can create a firewall that blocks hackers. The firewall prevents the hacker. You must also have version of Apache. Upgrade your PHP also. It's important that your system is always filled with upgrades.
The plugin should be updated have WordPress, play nice with of your other plugins and to remain try this site current with the latest WordPress release and restore capabilities. The ability to clone your website (in addition to linked here regular copies ) can be useful if you ever want to do an offline website redesign, among other things.