The basics:
- Make sure the computers you use are free of spyware, malware, and virus infections.
- Always keep your operating system and the software on it, especially your web browser, up to date to protect you from security vulnerabilities.
- Use long passwords for your WordPress login. Preferably hard to guess, with numbers.
- Keep your WordPress and plugins up-to-date.
- If you have an SSL certificate, connect to your WordPress admin login using HTTPS.
- When connecting to your server you should use SFTP encryption.
Restrict access to your WordPress admin area. Add this to your .htaccess file.
Replace the x's with your own IP. If you've changed the admin area, also reflect those changes.
# BEGIN RESTRICTION
RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$ [OR]
RewriteCond %{REQUEST_URI} ^(.*)?wp-admin$
RewriteCond %{REMOTE_ADDR} !^xx.xxx.xxx.xxx$
RewriteRule ^(.*)$ - [R=403,L]
# END RESTRICTION
Consider two-factor authentication.
Security through obscurity:
Don't use the "admin" username.
Don't use the default database prefix.
Backups are important, too. If in the event your Wordpress is hacked - restoring from a backup so you don't lose all your data.
Then there's a plethora of security plugins. Such as iThemes Security and Wordfence just to name two.
I know iThemes has an option to autoban anyone attempting to login using the "admin" username. It also has 2FA built-in. Has a known blacklist of IP's. Has website malware scanning functionality. Lots of things, really.
The server on which Wordpress is installed also plays a large role. Obviously if the server Wordpress is on is outdated, or has known vulnerabilities it definitely wont help your installation of Wordpress.
From what I've seen, it's usually outdated Wordpress installations with very old plugins that get hacked.
