Supported versions
WordPress 6.x and PHP 8.1+ receive security updates. Anything older has public vulnerabilities with ready-made exploits. Update with a backup first, then check the theme and plugins afterwards.
The admin user should not be public
On most installations, the /wp-json/wp/v2/users address lists users with their login names. Once the name is known, an attacker only has to guess the password. Restrict the endpoint for visitors and rename the “admin” user.
Default files
readme.html tells anyone who asks which WordPress version you run. license.txt and wp-config-sample.php have no place on a live site. Delete them after every major update, or block them in .htaccess.
Limiting login attempts
Without a limit, a script can try thousands of passwords on wp-login.php. A limiting plugin (or a rule in the hosting firewall) blocks the IP after a few attempts. Two-factor authentication for administrator accounts almost entirely removes the problem.
HSTS and secure cookies
The Strict-Transport-Security header tells the browser never to try http again for your domain. It is enabled with one line in .htaccess, once you are sure the whole site works over https.
A backup you can use
When a site is compromised, the fastest remedy is restoring a clean backup. If the backup is on the same server, it is compromised too. Daily, external, tested: those are the three words that matter.