It helped me although my first step isn't one you have to take. I had a good old style pity party. I cried and railed against the evil hackers (that where probably 13 and smarter then me) And then I did before I started my website, what I should have done. And here is where I would like you to start as well. Learn hacked. The thing about secure your wordpress website and why so many of us recommend it is because it is easy to learn. Unfortunately, that is also a detriment to the health of our websites. We have to learn how to put in a security fence.
Strong passwords - Do your best to use a strong password, alpha-numeric. Easy to see this here remember passwords are also easy to guess!
There's a section of config-sample.php that is headed"Authentication Unique Keys." There are. There's a hyperlink within that section of code. You want to enter that link into your browser, copy the contents which you get back, and replace the keys you have with the unique, pseudo-random keys provided by the site. This makes it harder for attackers to automatically generate a"logged-in" cookie for your site.
Now we are getting into things. You must rename it to config.php and modify the file config-sample.php, when you install WordPress. You will need to deploy the database facts there.
I prefer to use a WordPress plugin to get the work done. Make sure that the plugin you select is in a position to do select backups, has restore and can clone. Be sure it is often updated to keep pace. There's absolutely no use in not functioning, and backing your data up to a plugin that is out of date.