My first step is but it helped me. I had a fantastic old style pity party. I cried and railed against the evil hackers (that where probably 13 and smarter then me) And then I did before I started my website, what I should have done. And here is where I would like you to start. Learn hacked. The thing about secure your wordpress website and why so many of us recommend because it is easy to learn, it is. That is also a detriment to the health of our websites. We have to learn how to put in a safety fence around our site.
There are many ways to pull off this, and many of them involve copying and FTPing files, exporting and re-establishing much more and databases. Some of these are very complex, so it is important that you select the one that is right. Then you may want to look into using a plugin for WordPress backups if you're not of the persuasion.
Exclude pages - This plugin adds a checkbox,"include this page in menus", which can be checked by default. If you uncheck it, the page won't appear in any listings of pages (which includes, and is ordinarily restricted to, your page navigation menus).
You Continued can extend the plugin features with premium plugins such as: Amazon S3 plugin, Members only plugin, DropShop etc.. So I think this plugin is a fantastic option and you can use it for free.
There is another problem you have with WordPress. People always know where they can login and additionally they could just visit with your login form and try a different combination of passwords and user accounts out. In order to prevent this from happening you need to set up Login Lockdown. It's a plugin that lets users attempt and login with a wrong password three times. After that the IP address will be banned from the server for a certain timeframe.