Since scare tactics seem to be what compels some people to take secure your wordpress website a little more seriously, or at the very least start considering the problem, allow me to shoot a couple of scare tactics your way.
Use strong passwords - Do what you can to use a strong password, alpha-numeric, with upper and lower case and special characters. Easy to remember passwords are also easy to guess!
Yes, you want to do regular backups of your website. I recommend at least a weekly database backup and a monthly "full" backup. More. If you make changes and additions to your website, definitely. If you make changes multiple times every day, find this or have a community of people which are in there all the time, a backup should be a minimum.
BACK UP your site frequently and keep a copy on your computer and off-site storage. Back For those who have a very active site. You spend a whole lot of time and money on your website, do not skip this! The one solution that does it all is BackupBuddy, no back up your files, widgets, plugins and database. Need to move your site this will do it in under a couple of check this minutes!
Do your homework and some searching, but if you're pressed for time and want to get this try the WordPress security plugin that I use. It is a relief to know that my site (and company!) are secure.