When I was in college, one of my business instructors told us students that one of the biggest barriers to making money was procrastination.
The fix wordpress malware Codex has an outline of what permissions are acceptable. File and directory permissions can be changed either through an FTP client or within the page from the web host.
A simple way is to use a few tools that are built-in. First of all, do not allow people run a web host security scan to list the documents in your folders and automatically backup your web hosting account.
Move your wp-config.php file up one directory from the WordPress root. WordPress will look for it if it cannot be found in the main directory. Also, nobody will be able to read the file unless they have FTP or SSH access to your server.
As this page I (our fictitious Joe the Hacker) understand, people have far too many usernames and passwords to remember. You have got Twitter, Facebook, your online banking, LinkedIn, two site logins, FTP, internet hosting, etc. accounts which all come with logins and passwords you will need to remember.
Just make sure you choose a plugin that is current with the current version and release of WordPress, and that you may schedule, restore and replicate.