Keep your passwords long like 25 characters combination of upper and lowercase along with symbols.
Never use same password twice.
Use some kind of 2FA.
Password advice above for login username, mysql database, hosting account and domain registrar account if at different company than hosting account.
Keep up to date theme/core/plugins, don’t do the whole wait a bit.
Make sure your theme and plugins are no older than 6 months since the last update. I used to say 12 months. Maybe 3?

If your hosting/domains company/-ies have 2FA, use it.
If you use a third-party company/website, like managewp or jetpack, etc…same applies, specially 2FA.

Go through the settings for your security plugin.

So many people think that all you have to do is install a plugin, activate it and that is it.

Do weekly backups, daily if you are extremely popular.

You do not need a million dollars security budget. Get off your rear end, and do something. There is more security either than install+activate.

Hacked sites, 99% is because of a lazy human.