Keep WordPress updated. This is the single most important thing you can do to ensure your website’s security. While it can’t stop zero-day vulnerability hacks, it’ll ensure you’re safe from ones discovered in the past.

Keep plugins updated. The is the second most important thing you can do. It’s very common for vulnerabilities to be discovered in WordPress plugins and used to breach sites running them.

Prevent brute-force login attacks. This is when someone uses an automated program or script to try and guess a password. Unchecked, someone can just pound away at your WordPress installation. Consider plugins that protect against these attacks. Usually they limit how many failed logins are allowed in a specific period and, if triggered, will block access to the Internet Protocol and the account they attempted to access.

Require question/answer verification. This is similar to, if not exactly like, CAPTCHA. Someone logging into an account for your WordPress instance must answer a question. It could be “type in these letters and numbers” or a math problem. This helps further prevent automated attacks to the login apparatus.

Password-protect the admin and login page. This is where you use your Web server to password-protect the /wp-admin directory and wp-login.php file. Before you can even access these things, you’ll need a username and password. Generally, this is done in the .htaccess file for Apache Web server. This is a great way to fend off attacks that are directly at the core files of WordPress.

Change the default “admin” username. Every fresh installation of WordPress creates a user called “admin” that has full access to everything. Ensure you change this username to something obscure and random, such as usr10937.

Change the “display name” for users. When you create a new WordPress user, it’s important to ensure the “display name” is changed to something besides the username. Hackers can identify usernames this way via posts and use them to execute a brute-force attack.

Change the default “wp_” database prefix. When you install WordPress, it asks you to create a database prefix; the default is _wp. Instead, make this something obscure and random, like zX312_. This will make it harder for hackers to do structured query language injections and other attacks that involve the WordPress database.

Disable XML-RPC. This feature has been enabled by default since WordPress 3.5. It can be used to brute-force attack the platform and bypass any methods you’ve set up to prevent this on the login page. A hacker can literally try thousands of passwords in as little as 10 to 40 requests vs. doing 1,000 individual requests on your login page.

Disable PHP file execution. There are some directories in your WordPress instance that shouldn’t be allowed to execute a PHP file, such as /uploads/. Attackers can find ways to force an upload and execute malicious code. Ensure you leverage your .htaccess file to block PHP file execution in the directories that don’t need it.

Disable file editing. By default, you can edit the code of your theme files inside of the WordPress backend. If someone does compromise an account, this can make it easy for them to deploy malicious code. I always recommend people turn file editing off and require updates to be deployed server-side.

Use strong passwords. If your passwords aren’t a minimum of 12 characters with letters, numbers and special characters, they can easily be guessed. Enforce strong password requirements to keep your accounts as secure as possible.

Have a back-up solution. Let’s face it … Stuff happens. If your site is hacked, you’ll need to redeploy it as quickly as possible. I highly recommend you don’t try to fix it and instead do a fresh install. However, you need back-ups to do this! Ensure you deploy a proper back-up solution and retain copies going back at least 90 days, because some hacks are discovered months later.