Backup before you backup, and then backup some more.
I use CodeGuard for money sites, which is seamlessly integrated into Wordpress sites now via plugin. It's a premium service, but for the peace of mind it offers, it may as well be free. It's ~$50 per website per year, so like ~$4/mo for a daily backup, and single click restores.
Any other sites I usually just get them where they need to be, then dl a full copy backup via cPanel and store off-server.
Several more-premium hosting companies offer this type of service. WPEngine, for example, has a 10-day trailing backup system that allows for single click restores. That type of hosting is $29/1 site, $99 for 10. They used to be amazing, and now are still pretty good.
Now, if you are comfortable scripting or scheduling server-side automated jobs, you can always schedule backups and have them upload to off-server locations such as Dropbox via FTP. However, if you aren't fluent enough in some a programming language that can accomplish this for you; just get the CodeGuard. Assuming you make $20/hr, in the time it would take you to figure out how to schedule those tasks yourself, you could probably back up 5 sites for 5 years.
I'm not a CodeGuard affiliate or anything, and would just suggest you Google them. I used their FTP service with a Magento site for a couple of years with little issue, and now use their wordpress plugin for several sites. You can literally set it up in 5 minutes.
As far as monitoring security in the future; WP Fence gets a lot of popular press, and has a free version, as does "Hide my WP" which is sold on CodeCanyon. Also, keep your plugins and core up-to-date.
You can assume that any security update that gets released for Wordpress has probably been getting exploited for some time before it got caught.
