The WordPress Security Checklist

Ordered by return on effort. If you only do the first five, you have removed most of the realistic risk to a small WordPress site.

Do these first

1. Update WordPress core, plugins and themes — and confirm the versions afterwards rather than trusting the notification.
2. Delete every plugin and theme you do not use. Deactivated is not removed.
3. Remove administrator accounts that do not need to be administrators. Editors can edit.
4. Enable two-factor authentication on every administrator account.
5. Run a vulnerability scan so you know what is actually installed.

Then these

1. Set DISALLOW_FILE_EDIT to disable the built-in theme and plugin editor.
2. Move wp-config.php permissions to 400 or 440 and check the rest of your permissions.
3. Regenerate the salts in wp-config.php — this logs everyone out, including anyone with a stolen cookie.
4. Take backups that leave the server, and restore one to prove it works.
5. Use a password manager. Reused administrator passwords defeat everything above.

Then these, if it applies to you

1. Turn off WP_DEBUG in production.
2. Disable XML-RPC unless something you use needs it.
3. Restrict access to wp-login.php by IP if your team is small and static.
4. Set security headers at the server or CDN level.

Hardening reduces the damage. Patching removes the hole. Scan your site free to see what still needs patching.