WordPress runs a large share of the web, which makes it the most rewarding target there is, and as an ethical hacker I meet it in every possible state of neglect. The ten practical measures I recommend are mostly unglamorous: keep core and plugins updated, remove what you do not use, control who can log in and from where, and make sure a compromise cannot reach the rest of the server.