Hi.
On this site, going to install the new version of X-cart and change the salt code once installed, as you say, trying to change it when live would be a pain. I have the products backed up so not a problem.
Too many files were changed, mainly te skin folder, so easier to start from scratch.
Another site I operate is quite safe as I have already done most of the things you have suggested, was in the process of doing it with this one, but it would appear I was a little late.
Here is a online tool to create .htaccess files if none users cpanel
http://www.htaccesstools.com/
We don't store credit card info on the server, orders are deleted once processed.
Tanks for the tips