User Login
The biggest risk to your website security will be your logins. Do not use “Admin” as the user name for any account.
Plugins and Themes
Anything being out of date, from your plugins to your themes, and even the version of WordPress that you’re using can pose a security risk.
Can You Trust That Plugin/Theme?
Don’t add any plugins or themes you haven’t vetted yet. For themes, you can use W3C’s Validator to see if the theme meets WordPress requirements for security.
Take Regular Backups
Taking regular backups from a site is a big step towards security.