WordPress Security Guide:
- Themes and plugins from authentic source/website (Theme-forest/theme shop)
- Excellent coded plugins
- remove the unused plugins
- always keep updated all the plugins and themes
- always find alternative to an outdated plugin
- Do never use username admin for administrative role
- Hide default login URL (http://yourdomainname/wp-admin) (WPS hide login for that)