Cloning your site is just another degree in fix wordpress malware that may be useful. Cloning simply means that you have backed up your site to a completely different location, (offline, as in a folder, in order to not have SEO issues ) where you can get it at a moment's notice if necessary.
No software system is immune to bugs and vulnerabilities. Security holes will be discovered and bad guys will do their best to exploit them. Keeping your software up-to-date is a fantastic way to stave off attacks, once security holes are found because their products will be fixed by software vendors that are reliable.
Is to delete the default administrator account. This is critical because if you don't do it, malicious user know a user name that they could try to crack.
Note that you should only try this step for setups. If you would like to do it you'll also need to change go to my site the table names inside the database.
However, I advise that you install the Login LockDown plugin in place of any.htaccess controls. From being permitted after three unsuccessful login attempts from a specific IP address for an hour login requests will stop. You may still get into your panel while and yet you still have good protection against hackers, if you do so.