@lauramoldham You might also consider migrating to @WPEngine. They take care of all hack/malware prevention as well as core upgrades.