If you use a solid host like WPengine and a security app like wordfence.com it would be a very rare day indeed to get hacked. Source: about 1 year ago

If on wordpress, use the free version of wordfence.com to scan your site and identify possible viruses. Continue to use wordfence to protect the site, and if a successful business blossoms, consider the premium paid version. I'm not affiliated in any way, I've simply used the product with success for a number of years. Source: over 2 years ago

You can also read the documentation to learn about Wordfence's blocking tools, or visit wordfence.com to learn more about Wordfence. Source: over 2 years ago

Depends on the infrastructre setup, but if you're able to specify smtp server the backend will use you can you something like https://github.com/mailhog/MailHog or https://github.com/rnwood/smtp4dev to catch any sent email, regardless of email address and read it via the respective api. Both mailhog and smtp4dev have decent api documentation. Source: over 1 year ago

If so you could check out smtp4dev, it gives you a locally hosted client that you can use to intercept any mail send out by your app and displays them in a nice web based gui interface so can see what they look like. Source: almost 2 years ago