For wordpress we use a few security/firewall plugins and backup regularly. For other sites we use unique passwords and we back up everything.

You never think you need it, until you need it. :/