Cloning your website is just another degree in fix wordpress malware fix which may be very useful. Cloning simply means that you've backed up your website to a completely different location, (offline, as in a folder, so as to not have SEO issues ) where you can get it in a moment's notice if necessary.
No software system is resistant to bugs and vulnerabilities. Security holes will be discovered and bad guys will do their best to exploit them. Keeping your software up-to-date is a fantastic way once security holes are found because their products will be click here for more fixed by software sellers that are reliable.
Yes, you need to do regular backups of your website. I recommend at least a weekly database backup and a monthly "full" backup. More. If you make changes and additions to your site, definitely. If you make changes multiple times a day, or have a community of people that are in there all the time, a daily backup should be a minimum.
What if you go to WP-Content/plugins, can you view that folder? If so, upload that blank Index.html file inside that folder as well so people can not see what plugins you have. Someone can use that to get access because if your version of WordPress is current, if you are using a plugin or an old plugin with a security hole.
Change your password, often, or at least admin username and your WordPress password and collect and use good WordPress security tips to keep hackers out!