Hello,
changing page extension from php to html should only be done befor the first page is created. If you do this after pages are created you have to change manually all files in the pages dir.
Also this function is buggy in all 2.6.x versions of WB. This is fixed in the upcoming WB 2.7.
And last but not least you need to configure your server to parse html files as php. This can be done in the server settings or if your hoster allows .htaccess with a .htacces file.
Any ideas on how to prevent Hackers getting into my site
All known hacks was caused from bad server configurations and not from the WB files itself. If you use WB in normal configuration, WB itself could not be hacked. It only could be hacked if you allow this by setting the permissions wrong. So i would ask the hoster for the server protokolls to find out when and how your site was hacked.
Matthias