Practical WordPress Security Checklist

Force Two-Factor Authentication on your WordPress login screen Force Two Factor Authentication and know user’s password strengths along unlock many other powerful security enhancements with iThemes Security Pro
Enable Two-Factor Authentication on your web hosting account
Google the following to see how to enable it if your host offers it:
For example if your host is SiteGround you would Google the following:
Enable Two-Factor Authentication on your domain registrar account
Google the following to see how to enable it if your registrar offers it:
For example if your registrar is GoDaddy you should switch to Namecheap, but you would Google the following for now:
Install SSL Certificate and redirect all HTTP traffic to HTTPS
You can redirect HTTP to HTTPS with iThemes Security
Use a secure managed WordPress host
You need to make sure everything is up-to-date, especially plugins or themes with security exploits identified. Managed hosts will help automate updates and patch security holes. They also achieve better performance as they’re optimized specifically for WordPress hosting.
Install and use established security plugin(s)
Use a trusted password manager and make unique passwords
Source: https://managewp.org/articles/17431/practical-wordpress-security-checklist

source https://williechiu40.wordpress.com/2018/05/16/practical-wordpress-security-checklist/