Finally, repair hacked wordpress site will tell you that there's not any htaccess in the directory. You may put a.htaccess file into this directory if you wish, and you can use it to control access from IP address to the wp-admin directory or address range. Details of how to do that are available on the net.
Don't make the mistake of thinking that your hosting company will have your back so far as WordPress backups go. Not always. While they their explanation say they do, it's been my experience that the company may or may not be doing proper backups. Why take that kind of chance?
For me it's a WordPress plugin. They're drop dead easy to install, have all the features you need for a task such as this, and are relatively inexpensive, especially when compared to having to hire someone to read get this done for you.
You click here for more info may extend the plugin features with premium plugins like: Amazon S3 plugin, Members only plugin, DropShop etc.. I think you can use it at no cost and this plugin is a good choice.
Of course it's possible to set up plugins to make your store more user-friendly like share buttons or automated backup plugin. That's all. Your shop is up and running!