Five lessons to lock down WordPress
Each lesson is something you can finish in one sitting. None of them require a plugin to be safe, and none of them replace a cleanup if the site is already infected.
1. Updates
Update core, then plugins, then themes. Delete anything you do not recognize. A nulled “pro” theme is a common way spam gets in. Buy it, or remove it.
2. Users
Open the user list. Remove admins you did not create. Editors do not need the administrator role.
3. Passwords and salts
Replace reused passwords. If the site was hacked, generate new salts in wp-config.php so old cookies die. Change the hosting password too.
4. Themes and plugins
Prefer fewer plugins. Read the changelog before you update a plugin that handles payments. Keep a backup from the same day.
5. Backups and file changes
Store backups off the web server. After a cleanup, compare file dates. PHP files in wp-content/uploads are a reason to stop and look, not a reason to ignore the folder.