I back up my blogs regularly using a free plugin WP DB Backup. I will restore my blog to the 13, if anything happens. I use WP Security Scan plugin that is free to scan my site regularly and WordPress Firewall to block suspicious-looking requests to fix wordpress malware virus.
Don't make the mistake of thinking that your web host will have your back so far as WordPress backups go. Not always. While they say that they do, it's check herecheck my blog been my experience that the hosting company may or may not be doing backups. Take that kind of chance?
Exclude pages - This plugin adds a checkbox,"include this page in menus", which can be checked by default. If you uncheck it, the page will not appear in any listings of webpages (which contains, and is ordinarily you can check here restricted to, your webpage navigation menus).
Another step to take to make WordPress secure is to upgrade WordPress. The main reason for this is that with every upgrade there also come fixes for security holes which makes it essential to upgrade.
These are three simple things you can do to keep WordPress safe without plugins. Set a blank Index.html file in your folders, run your web host security scan and backup your whole account.