Originally Posted by anexsia

An up-to-date Wordpress install shouldn't be getting hacked at all.

Block wp-login.php (only allow access via your IP, stops bruteforce attacks) and block xmlrpc.

Do not use shitty plugins or themes (stick with well reviewed and popular plugins and themes on the main Wordpress theme/plugin database).

Folder permissions should be 755, files should be 644.