I found this article about WordPress site security. A webhost publicity page but good  reading anyway.

https://thishosting.rocks/wordpress-security-guidelines/

the issues covered are:

• Be Careful with Plugins and Themes
• Follow Reasonable Password Rules
• Use a VPN
• Know Your Team
• Keep Everything Up to Date