• Update WordPress core, themes and plugins promptly.
• Remove unused themes/plugins.
• Use strong unique admin passwords and 2FA plugins where possible.
• Limit login attempts.
• Do not install nulled / pirated plugins.

Most WordPress compromises we see start with outdated plugins or reused passwords.