By default, the latest version of WordPress is pretty secure. The development team of WordPress has considered anything that might have been added to any fix wordpress malware virus plugins. In the past , WordPress did have holes but most of them are stuffed up.
The approach, and the one I personally recommend, is to use one of the password creation and storage plugins available for your browser. I believe after a trial period, you need to pay for it, although RoboForm is liked by people. I use the free version of Lastpass, and I recommend it for those who use Internet Explorer or Firefox. That will generate content secure passwords for you.
Exclude pages - This plugin provides a checkbox,"include this page in menus", which can be checked by default. If you uncheck it, the page won't appear in any listings of pages (which includes, and is usually restricted to, your page navigation menus).
So what's the best way? Out of all the possible choices that are available right now, which one is right for you and which route should you choose?
Do your homework and some searching, but if you are pressed for time and need to get this done once and for all, try out the WordPress security plugin that I use. It's a relief to know that my site (and business!) are secure.