Cloning your website is just another level in fix malware problems free which can be useful. Cloning simply means that you have backed up your site to a completely different place, (offline, as in a folder, so as not to have SEO issues ) where you can get it in a moment's notice if the need arises.
Also, don't make the mistake of believing that your hosting company will have your back so far as WordPress backups go. Not always. It's informative post been my experience that the hosting company may or might not be doing proper backups while they say that they do. Why take that kind of chance?
Yes, you need to do regular backups of your site. I recommend at least a weekly database backup and a monthly "full" backup. More, if possible. Definitely more if you make additions and changes to your site. If you make changes multiple times a day, or have a community of people which are in there all the time, a backup should be a minimum.
It's time to sign up for a Facebook account and use identity and this person's name. Once I get it all set up, I'll be telling you posing as your friend and asking you to be friends with me on Facebook (or Twitter, or whichever social site).
These are three very simple things you can do to keep WordPress safe without plugins. Set a blank Index.html file in your folders, run your web host security scan and backup your whole account.