1. Install wordpress not with the default username.
2. Install protection to your wordpress site like Wordfence.
3. Install a proper brute force protection as additional service we recommend bruteprotect (currently the only really working system).
4. Change the salt in wp-config.php and make sure its unique ; use the following website for a new combination (also recommended AFTER a hack) https://api.wordpress.org/secret-key/1.1/salt/
5. Remove any unused templates and plugins (not configured or enabled plugins or templates are still on the system and can become a security issue).
6. Make sure your DB password is strong ; once hacked make sure you change it.
7. Make backups ! always make sure you have a local backup of your site. (go to cpanel and run the full backup, and download it locally).
Other Tips ? let us know and we are glad to add your tips as well.
