WordPress sites are attacked constantly and automatically. Most compromises come down to a small number of causes, so effort is best spent there rather than on obscure hardening.
The things that genuinely matter
- Keep everything updated. Out-of-date plugins are the most common way in, by a wide margin. A plugin nobody has updated in three years is a liability regardless of how useful it is.
- Delete what you do not use. A deactivated plugin is still code on the server and can still be exploited. Remove it rather than deactivating it.
- Strong, unique passwords, and two-factor on the administrator accounts.
- Do not use "admin" as a username, and do not have more administrators than necessary. Editors do not need administrator rights.
- Protect the login page against repeated guessing, either with a plugin that limits attempts or by restricting access.
Worth doing, less critical
- Disabling file editing from the admin, so a stolen login cannot immediately edit PHP:
define( 'DISALLOW_FILE_EDIT', true ); - Turning off XML-RPC if nothing you use needs it
- Keeping the uploads folder from executing PHP
Largely theatre
Hiding the WordPress version number, renaming the login page, and hiding that WordPress is in use at all achieve very little on their own. Automated attacks simply try the exploit regardless. They are not harmful, but do not mistake them for protection.
And keep a backup you have tested
Every other measure reduces the chance of a problem. A backup is what gets you out of one.
