My first step is but it helped me. I had a fantastic old style pity party. I cried and railed against the evil hackers (that where probably 13 and smarter then me.) And then I did before I started my site, what I should have done. And here is where I would like you to start as well. Learn hacked. The thing about fix wordpress malware virus and why so many people recommend because it is really easy to learn, it is. Unfortunately, that is also a detriment to the health of our sites. We have to learn how to put in a security fence.
The more powerful approach, and the one I recommend, is to use one of the creation and storage plugins available on your browser. People like RoboForm, but I think after a useful site trial period, you need to pay for it. I use the free version of Lastpass, and I recommend it for those who use Internet Explorer or Firefox. That will generate secure passwords for you; you then use one master password to log in.
For me site link it's a WordPress plugin. They are drop dead simple to install, have all the functions you need for a job like this, and are relatively inexpensive, especially when compared to having to hire someone to get this done for you.
You may extend the plugin features with premium plugins such as: Amazon S3 plugin, Members only plugin, DropShop etc.. I think you can use it and this plugin is a good option.
There are always going to be risks being online (or even just being alive!) And it's easy to get caught up in the fear. As soon as we get caught up in the fear, we put the breaks on. This isn't a fantastic Get the facts response. Simply take some common sense precautions forge ahead. If something does happen, it will have to be addressed then and no amount of quaking in your boots before-hand will have helped. If nothing does, all is good and you have not made yourself ill with worry.