Installing the fix wordpress malware cleanup Scan plugin will check most of this for you, and alert you that you may have missed. It will also inform you that a user named"admin" exists. Needless to say, that is the user name. If you desire, you can follow a link and find instructions for changing that name. I personally believe that a strong password is security that is good, and there have been no attacks on the blogs that I run, since I followed those steps.
The one I recommend, and the approach, is to use one of the password creation and storage plugins available on your browser. RoboForm is liked by people, but I click here for more think after a free trial period, you need to pay for it. I use the free version of Lastpass, and I recommend it for those who use Firefox or Internet Explorer. That will generate secure passwords for you; you then use one master password to log in.
Maintain control of your assets - Nothing is worse than getting your livelihood in someone else's hands. Why take chances with something as important as your website?
You could also get an SSL Encyption Security for your WordPress blogs. The SSL Security makes secure and encrypted communications with your blog. You may keep history of communication and the all the cookies so that all transactions are recorded. Be certain all your blogs get SSL security for utmost protection from hackers.
Of course it's possible to install more plugins to make your shop like backup plugin or share buttons. That's all. Your shop is up and running!