All that you've been told is true.  It's also true that you can get very pure water from core drilling the Antarctic ice and melting it in a lab.  Personally, I'm not paying for Antarctic core ice water when I can get very good bottled water at the corner grocery.

Nobody bothers to sniff passwords for your site in a coffeeshop.  Besides, you are changing your admin passwords regularly, correct?  As for SSL, it's not worth it except to secure financial data, which is what someone will be sniffing for.  As for the best way to prevent hacking, you're already vulnerable with that insecure password you never change, the fact that your password is the same as you use for other accounts and the fact that the guy at the next table can watch you type it.  Along with your weak FTP password, your unpatched server and the fact you don't use a VPN to access the server, your security is far easier to breech than sniffing your packets.

Jeff