The fix wordpress malware removal Codex has an outline of what permissions are okay. File and directory permissions can be changed through an FTP client or within the page from the hosting company.
An easy way to maintain WordPress safe is to use a few tools. First of all, do not allow people run a web host security scan to list the documents in your folders and automatically backup your web hosting account.
Yes, you want to do regular backups of Website your site. I recommend at least a weekly database backup and a monthly "full" backup. More. Definitely more if you make changes and frequent additions to your site. If you have a community of people which are in there all the time, or make changes multiple times every day, a daily backup should be a minimum.
You may extend the plugin features with premium plugins like: Amazon S3 plugin, Members only plugin, DropShop etc.. I think this plugin is a good choice and you can use it at no cost.
These are only a few of the things I do to protect my Your Domain Name blogs. Great thing is they don't need much time to do. These are also solutions, which can be carried out.