Cloning your website is just another degree in fix wordpress malware plugin that can be very useful. Cloning simply means that you have backed up your site to a completely different location, (offline, as in a folder, in order to not have SEO issues ) where you can get it in a moment's notice if necessary.
Also, don't make the mistake of thinking that your web host will have your back as far as WordPress backups go. Not always. It's been informative post my experience that the hosting company may or might not be doing proper backups, while they say they do. Why take that kind of chance?
Should you ever wish to migrate your site go to my blog elsewhere, such as a new hosting company, you'd be able to pull this off without a hitch, and also without needing to disturb your old site until the new one was set up and ready to roll.
It is really sexy to fan the flames of fear. That is what bloggers and journalists and politicians and public figures do. It's great for readership and it brings money. Balderdash.
However, I recommend that you install the Login LockDown plugin rather than any.htaccess controls. That will stops login requests from being allowed from a certain IP-ADDRESS for an hour or so after three unsuccessful login attempts. If you accomplish that, it is still possible to access your mobile while from your workplace, and yet you still have good protection against hackers.