My WordPress business site needs a proper security hardening pass and a reliable backup setup. It's currently live with no off-site backups and I want peace of mind.

What's involved:

• Harden wp-config, file permissions, logins and disable XML-RPC where safe
• Install and configure a reputable security/firewall plugin
• Set up automated daily off-site backups with a tested restore
• Scan for and clean any existing malware, remove unused plugins/themes

Please share which tools you'd use and a short summary of what you changed at the end.