Keep everything updated
Update WordPress core, themes and plugins promptly. Remove themes and plugins you do not use.
Protect logins
Use unique passwords and enable two-factor authentication for administrators.
Back up regularly
Keep automatic off-site backups and test that you can restore them.
Least privilege
Give each person the lowest role that lets them do their job.