30,000 Sites Are Hacked Every Day

And... most are WordPress

And... most are easily preventable

Use Strong Passwords

Seriously, do it.

Dashlane
LastPass
1Password

Delete the "admin" user

Use 2-factor Authentication

Google Authenticator
Duo Security
Two Factor Auth

Change Your Login URL

Keep Your CPU Clean

Webroot
Avast
AVG

Update Everything All the Time

Add to wp-config.php

define( 'WP_AUTO_UPDATE_CORE', true );

Delete Unneeded Plugins

Take Backups & Store Offsite

Vaultpress
BackupBuddy
BackWPUp
BackUpWordPress

Use a Secure Theme

Install an Auditing/Logging Plugin

Stream
WP Security Audit Log
Audit Trail

Install a Security Plugin

iThemes Security
WordFence*
Bulletproof

*I include this with hesitation. It's one of the most compromised plugins in the entire repo

Use SSL for login & admin / whole site

Easy Way
Force SSL

Hard Way

define ( 'FORCE_SSL_ADMIN', true );

.htaccess

RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://example.com/$1 [R=301,L]

Server-side Compromise scanning

Sucuri

WAF - Web Application Firewall

Sucuri
Ninja Firewall
Cloudflare

Disable File Editors

Add to wp-config.php

define( 'DISALLOW_FILE_EDIT', true );

Disallow unfiltered HTML

Add to wp-config.php

define( 'DISALLOW_UNFILTERED_HTML', true );

Block access to XMLRPC

Add to functions.php (or similar)

add_filter( 'xmlrpc_enabled', '__return_false' );

Add to .htaccess

# START XML RPC BLOCKING

Order Deny,Allow
Deny from all

# FINISH XML RPC BLOCKING

Disable Error Reporting

Add to wp-config.php

ini_set('display_errors',0);
error_reporting(E_ALL|E_STRICT);

Move wp-config.php

Check Your File Permissions

Mass Overwrite

chown www-data:www-data -R *
find . -type d -exec chmod 755 {} \;
find . -type f -exec chmod 644 {} \;

chwon -R www-data:ftp-user wp-content (where ftp-user is what user you are using to upload the files)
chmod -R 775 wp-content

Change DB Table Prefix

Starts as wp_
Change to xx_

Resalt/Salt WordPress

Use an Excellent Host

WP Engine
Pagely
Flywheel

Use a Blacklist/IP blocker

Disable
pingbacks

SQL Query

update wp_posts set ping_status='closed' where ping_status='open'