Site hacked, is backup enough?

Two weeks ago my site got hacked, fortunately I have a backup plugin. I have read some threads and I have also installed an ip login plugin and a limit login one. Is it enough to do a backup? I don't have nulled plugins/themes.

Change the passwords, db prefix and update the salt keys. Recheck to be sure that you don't have any nulled plugin there.

Keep your passwords strong enough, limit brute forcing and limit access to sensitive info and files.

Thanks for the informations. Fortunately, the hacker only created random 404 pages and redirected some of my pages to some spammy Chinese website, however it didn't redirect the most important pages on my website, so it didn't impact the revenue a lot and strangely my website didn't experience a severe drop