My first step isn't one you must take but I was helped by it. I had a fantastic old fashion pity party. I cried and railed against the evil hackers (that where probably 13 and smarter then me.) And I did before I started my site, what I should have done. And here is where I would like you to start also. Learn hacked. The beautiful thing about fix wordpress malware attack and why so many people recommend it is because it is so easy to learn. That is also a detriment to the health of our sites. We have to learn how to additional reading add a safety fence around our website.
Don't make the mistake of believing that your web host will have your back so far as WordPress backups go. Not always. It has been my experience that the company may or may not be doing backups while they say they do. Why take that kind of chance?
Should you ever want to migrate your website elsewhere, like a new hosting company, you'd have the ability to pull this off without a hitch, and also without needing to disturb your old site until the new one was in place and ready to roll.
As I (our untrue Joe the Hacker) understand, people have way too many usernames and passwords to remember. You have got Twitter, Facebook, your online banking, LinkedIn, two site logins, FTP, web hosting, etc. accounts which all come with logins and passwords you will need to remember.
There is. People always know they could just drop by your login form and where they can login and try a different combination of passwords and user accounts out. In order to prevent this from happening you need to install Login Lockdown. It is a plugin that allows users to attempt to login with a password three times. After that the IP address will be banned from the server for a certain timeframe.