I have my wordpress installed in my purchased hosting company.
I see from my security plugin that the attacker changes IP and installs malware such as WP-vcd, and changing the themes such as wordpress original themes and thus gain access.
Now I want to re-install the wordpress again but this time I built it through localhost, is there anyway to achieve the installation without the attacker targeting the site? I will be adding more prevention work through .htaccess locking the IP and only allowing my IP to do the work.

But I wouldn't be able to prevent the attacker if during installation they still have their program up. I don't know what program they are using, but they have been targeting my domain, and keeps finding all the folders. 

I hope this makes sense. I appreciate all the feedbacks and help.