To protect your site from being hacked, below are steps you should take...
1. Use Complex and Unique Passwords.. Since hackers use brute force to discover websites credentials, you should be security cautious not to use an easy to guess passwords. Your passwords should be complex. As for uniqueness, never use one password for multiple services and applications.
2. Keep Plugins updated. Don't download Themes and plugins from questionable sources.
3. Use WordPress Hardening Methods. Very important! This method allows you to add or deny rules in .htaccess, protect your wp configure file, etc.
4. Keep Server Clean. Delete unused Wordpress files, plugins, themes, etc EVEN THOUGH THEY ARE INACTIVE. This is because inactive files can be exploited.
5. Don't Use Much Plugins. Since plugins are easily manipulated, try as much as you can to do away with too many of them. The less, the better.
6. Install a Wordpress Security Plugin. WordPress Simple Firewall Plugin is a pretty powerful one that you should have.
7. Don't Log in on Public Wifi. Quite clear.
8. Install an SSL Certificate on your Site. This encrypts information among users on your site. Never share any important details on sites without SSL. You'll notice a green padlock completely visibly on sites with genuine and uncompressed SSL certificate installed.
9. Use Better Hosting Services like Namecheap, Godaddy..
10. Use 2FA (Two-Factor Authentication) to enhance your site security.
11. Update your Wordpress version.
12. Manually approve comments or strongly moderate comments to avoid spams, activate akismet and use Captcha on your contact forms.
13. Always backup your website. Even though this doesn't directly fit into our security measures, you'll agree with me that backups help to bring your site back to its previously good state after it might have suffered from a hack, assuming the site was hacked.
OTHERS MAY ADD THEIRS BELOW.
