Serious attackers are rare; automated scanning for known weaknesses is constant. Most compromised sites were running outdated software or had weak access.
The checklist
- Update the platform, libraries and plugins promptly, and remove ones you do not use.
- Strong, unique passwords in a password manager, and two-factor authentication on hosting, domain, email and admin accounts.
- HTTPS everywhere, with the certificate renewal monitored.
- Least privilege. Each person and system has only the access it needs; remove accounts of people who have left.
- Backups stored elsewhere and tested.
- Protect forms against abuse and validate everything users send.
- Limit exposure. Keep admin areas non-obvious and rate-limited, and do not expose files and folders that do not need to be public.
- Security headers appropriate for your site.
- Logs and alerts so you notice unusual behaviour.
- A plan for what you will do if something is compromised, including whom to notify.
Personal data
If you hold personal data, a breach may carry legal duties to notify. Know your obligations and keep only what you need.
Be realistic
No checklist makes a site impregnable, but this one removes the common easy routes in. Applications with accounts and payments need a deeper review, discussed in the web application security question.