No security checklist makes a website invulnerable. It can, however, remove common weak points and make a problem easier to contain. The basics are mostly about access, updates, backups, and visibility.
Protect access
Use unique passwords, multi-factor authentication where available, named administrator accounts, and the fewest privileges each person needs. Remove old users and review connected services periodically.
Keep recovery possible
Maintain tested, off-site backups and know how to restore them. Keep WordPress, themes, and plugins supported. Monitor for unexpected redirects, new accounts, unfamiliar files, or sudden search pages. If you suspect compromise, avoid quietly deleting symptoms before preserving evidence.
WordPress rescue can help when the issue is already affecting visitors; maintenance helps reduce the chance of repeating it.