Updates first
Keep WordPress core, themes, and plugins updated. Many incidents exploit known vulnerabilities in outdated software.
Test updates on a staging copy when the site is business-critical.
Login and accounts
Use strong, unique passwords and limit login attempts where possible. Consider two-factor authentication for administrator accounts.
Delete unused accounts and avoid shared “admin” usernames.
Permissions and files
Avoid world-writable permissions on production. Follow host documentation for recommended ownership and modes.