My first step isn't one you must take but it helped me. I had a fantastic old style pity party. I cried and railed against the evil hackers (that where probably 13 and smarter then me.) And then I did before I even started my site, what I should have done. And here is where I want you to start. Learn hacked. The thing about secure your wordpress site and why so many people recommend because it is so easy to learn it is. Unfortunately, that can be a detriment to the health of our sites. We have to learn how to put in a security fence around our website.
This is great news as it means that there's a community of users and developers who More Bonuses can further enhance the platform. However, whenever there's a group of people trying to achieve something, there will always be people who will try to take them down.
Move your wp-config.php file one directory up from the WordPress root. WordPress will search for it if it cannot be found in the root directory. Additionally, nobody else will have the ability to read the document unless they've FTP or SSH access to your server.
Security plug-ins can be thought of as a security checker that was full. They give you information concerning the weaknesses of the site and check and scan the entire site.
However, I advise that you install the Login LockDown plugin instead of any.htaccess controls. Login requests will stop from being permitted from a certain IP address for one hour after three unsuccessful login attempts. If you do that, you may access your panel whilst away from your office, and yet you still have protection against hackers.