Good Questions, security is your main issue and is the same for everyone who undertakes looking managing their own websites. WordPress isn't the most secure content management system on the planet however it can be made secure with good hosting and good knowledge of what to secure and ensure is set.
Hosting
The safest way of hosting your site is in a VPS or dedicated assuming that you have good security on the OS. The problem with shared hosting is that malware can spread from one account to another, even though they are in jails these hackers find their way around and infect multiple sites. GoDaddy for example was hacked last month and left 100,000's of websites hacked with greyhat backlink inserts.
From what I've read you want to go with a VPS but important you want something to manage your backups, what you need is a VPS with CentOS6 with Cpanel. You will need to pay additional for the Cpanel but this will make setting up websites and backing up the database, and file system automated as well as sending you emails daily when the backup has completed or failed for one reason or another.
Now I don't know how strong skills you have within linux itself but VPS can often bring other security problems if your not strong in this department. Lucky enough these days we have things like Google and you can pretty much learn how to secure your VPS with ease. The basic thing about your VPS box is to ensure that your using a SSL Key that you have on your computer meaning that even if they know the password they can't access your system without that certification. Furthermore to stop people guessing the password you could always change the ssh port.
There are many things you can do to prevent access to your Box and Google serves this best, theres just far to many to list.
WordPress
Securing Wordpress is pretty straight forward, My strongest advice is to secure the template files within the /wp-content/themes directory
. Since your wife will not be editing the template files you want to chmod these so they can't be written to from WordPress directly. There is a setting within the configuration.php
you can set but seriously just CHMOD them using FTP or if you do go and use a VPS change the ownership of these files from www-data
to root
. This way they can't be changed from WordPress or any other software running on the server. Most injections, scripts based will attack the index.php
files of the templates and add the malware. Furthermore there is a few .htaccess
redirect attacks, so again chmod the .htaccess
file to unwritable once you have the desired settings, or again change from www-data to root. Also the configuration.php
you should set to root, or chmod so it can't be read by guests and outsiders.
Don't under estimate the power of the CHMOD, the more files you can make unwritable the better. Try to avoid unnecessary WordPress plugins. While some are great, ask yourself do you need. The more you have installed the more your hackers have to play with, so avoid plugins as much as you can and don't bloat the site with them.
WordPress updates weekly to monthly, update as soon as possible - There's a reason why they have so many updates and one of them is security issues and loopholes they have found.
Furthermore, by default you will have a "admin" "password" account, make another administrator such as yourwifenames along with a good password. Then delete that admin account.
Test Plan
You can always mimic your site, i.e. have a clone. Using cpanel you could setup a sub domain test.subdomain.com and have that running the same WordPress along with a clone of the database.
Personally if your not using major extensions for WordPress then you could just take the site offline i.e. Maintenance in progress. and then update the system, if anything goes wrong then you have the automated backup or a backup you did while it was in maintenance. that way your safe either way.
Always best to update in maintenance mode, while some updates don't ask, some do. Best to take it offline so you have a GOOD snap shop.
Versioning
With each daily backup you do it'll have a date, inside the GZ/Zip your be able to read the config file with version numbers of WordPress.
Uptime
Good Vps systems will monitor it for you and reboot if required, since you operate the server you can always install a cron job that will send you a email if the server goes down, but again. A good server never goes down really, pick a good VPS company which operates on a cloud with redundant power supplies and hardware, Rackspace for example, or amazon work on a cloud.
Test Version
Again just clone the site onto a sub domain that is uses a .htaccess password.
Hope this helps, and if you have any additional questions please ask.