In my opinion, the best way to ensure your that is clean hacked wordpress site is via using a WordPress backup plugin. This is a fairly inexpensive, easy and elegant to use way to make certain that your site is available to you in case of a disaster.
Backup plug-ins is also important. You need to backup all the files and database so in case of a sudden attack, you can easily bring back your site like nothing happened.
You also need to place the"Anyone Can Register" in Settings/General to off, and you ought to have some sort of spam plugin. Akismet is the one I use, the old standby, but like it there are many of them nowadays.
Note that this step for new installations should try. If you would like to do it for existing installations, you'll also need to change all the table names within the database.
Software: If you have installed scripts that are free such as Wordpress, search Google for'wordpress security'. You'll get tips.