Help! How should I protect WordPress?

It's important to keep all parts of your website up-to-date.

This includes the core (WordPress core), themes, and plugins.

WordPress will normally tell you if there is an update for the core when you login.

It will also tell you about updates for themes and plugins that are in the WordPress Repository or if they are setup to check their repository.

If you purchase a theme or plugin from an outside site, check in with them every so often to see if there are updates for your theme.

And of course, before performing any updates, make sure you take a backup of your site files and databases!

Typically, not all your users need to have administrator access to your site.

Its best to restrict users to have only the access they require.  This limits the damage a compromised WordPress account can do to a site.

There are several plugins available to enable 2 Factor Authentication, which can help take the possibility of a compromised account out of the equation.

Clef is an easy and free one to install, but if you are already using Duo or Google 2 Factor, they are available as well.

EDIT: Clef has been discontinued, but Automattic has built 2 Factor into their Jetpack Plugin.

There are several Free and Paid plugins for WordPress that provide "Hardening", "Auditing", and "Monitoring".

Sucuri offers both a free basic plugin and paid upgrade option to help protect your site.

WPMU Dev offers Plugins for an annual subscription or one off purchase.  One of the Plugin's they offer is called Defender and provides security.  If you find a few of the plugins that you like, it might be worth the annual cost.

WordFence is 100% opensource, and offers a premium key to unlock the additional features like "Premium Support, Country Blocking, Scheduled Scans, Password Auditing and we even check if your website IP address is being used to Spamvertize".

Plugins are a great way to expand the capability of your site, but they have a downside.

1. Too many plugins can slow down the performance of your site.
2. Plugins also can also cause high resource usage.
3. Plugins can also be a point of entry for a malicious user if they are not updated or are coded poorly.

You should use plugins that have a good update history, and disable plugins that have exploits reported until they are patched.

It's important to keep backups of your site.  Even with all the preventive measures listed here, it is possible that your site could get compromised, or an update could break your site.

Store the backups off your hosting account for maximum safety.

If you want to test your backups, tools like DesktopServer allow you to run a WordPress site locally.  This is also great if you want to do development locally before pushing it live to your hosting account.

Don't use weak passwords. If you have password authentication enabled make sure your password is not weak.  If you must use passwords, use a password manager.

If you do get compromised, make sure you update all your passwords, and have your computer and site scanned for possibly infected files.