Security is mostly about reducing avoidable risk and keeping systems maintained.
Keep WordPress and plugins updated
Use reputable plugins and remove tools that are no longer needed.
Use strong administrator accounts
Use unique passwords and avoid sharing administrator credentials between people.
Keep backups
A backup is only useful if it can actually be restored. Test restoration periodically.
Monitor the site
Watch for unexpected administrator accounts, unfamiliar plugins and sudden changes to important pages.
Prepared for Furynight by Md Millad Hossan.