WordPress security checklist: 29 steps to harden your site
This WordPress security checklist has 29 steps in five groups. If you only do three, turn on two-factor authentication for every administrator, keep plugins updated while watching for known vulnerabilities in the versions you run, and get an alert when a new administrator account appears. Those three stop or expose most real-world compromises.