The fix hacked wordpress site Codex has an outline of what permissions are okay. Directory and file permissions can be changed either through an FTP client or within the administrative page from the web host.
Hackers do not have the capability when you got all these lined up for your security to come to your WordPress blog. You definitely can have a safe WordPress account especially that one that provides big bucks from affiliate marketing to you.
Yes, you need to do regular backups of your site. I recommend at least a weekly database backup and a monthly "full" backup. More. If you make frequent additions and changes definitely. If you make changes multiple times a day, or have a community of people which are in there all the time, a daily backup should be a minimum.
Now we are getting into matters specific to WordPress. Whenever you install WordPress, you have to edit the document config-sample.php and rename it to config.php. You want to click this site install the database details there.
I prefer using a WordPress plugin to get the job done. Just make sure is in a position to do backups that are select, has restore functionality, and can clone. Be sure it is frequently updated to keep pace. There is no use in not functioning, and backing up your data to a plugin that's out of date.