Install the fix wordpress malware Firewall Plugin. Quit and this plugin investigates net requests to identify most obvious attacks.
Backup plug-ins is also significant. You need to backup database and all the files you can bring your own site back like nothing.
Yes, you need to do regular backups of your website. I recommend at least a weekly database backup and a monthly "full" backup. More, if possible. Definitely if you make frequent additions and changes to your site. If you make changes multiple times a day, or have a community of people that are in there all the time, a daily backup should be a minimum.
Along with adding a secret key to your wp-config.php document, also think about changing view your user password to something that is strong and unique. WordPress will let you know the strength of your password, but a good tip is to avoid phrases, use upper and lowercase letters, and include amounts. It's also a good idea to change your password frequently - say once.
But realize that security is something that you must start thinking about. Don't only be the type that is reactive, consider steps to start today, protecting yourself. Don't let his explanation Joe the Hacker make your life miserable and turn everything that you've worked hard in creating come crashing down in a matter of seconds.