I back up my blogs using a free plugin WP DB Backup. I will always restore my blog to the last 13, if anything happens. I use WP Security Scan plugin to scan my blog and WordPress Firewall to block requests to fix malware problems free.
The more powerful approach, and the one I recommend, is to use one of the password creation and storage plugins available on your browser. Many people like RoboForm, but I think after a free trial period, you have to pay for it. I use the free version of Lastpass, and I recommend it for those of you who use Firefox or Internet Explorer. That will generate passwords for you; you then use one master password to log in.
Exclude pages - This plugin adds a checkbox,"include this page in menus", find more info which can be checked by default. If you uncheck it, the page will not appear in any listings of webpages (which includes, and is click ordinarily restricted to, your page navigation menus).
Another step to you could check here take to make WordPress more secure is to upgrade WordPress. The main reason behind this is that with each new update there also come fixes for security holes that are older which makes it essential to update.
Those are three things you can do to maintain WordPress safe without plugins. Set a blank Index.html file in your folders, run your web host security scan and backup your whole account.