How to secure a WordPress site with zero technical knowledge

1. 1
   relying on hosting company automatic backups and staging areas

   Did this help you?
2. 2
   installing security plugins for malware protection

   Did this help you?
3. 3
   contacting hosting support to roll back backups or clean malware

   Did this help you?
4. 4
   switching to fully managed platforms like wordpress.com, Ghost, or Medium

   Did this help you?
5. 5
   Force SSL across the site.

   Did this help you?
6. 6
   Keep core, themes, and plugins updated.

   Did this help you?
7. 7
   Use strong, unique passwords for all accounts.

   Did this help you?
8. 8
   Disable XML-RPC if not needed.

   Did this help you?
9. 9
   Set up brute force protection at the server level or with a lightweight plugin.

   Did this help you?
10. 10
    Enable two-factor authentication (2FA) for the admin portal.

    Did this help you?
11. 11
    Keeping themes and plugins up to date

    Did this help you?
12. 12
    Keeping the number of plugins as low as possible

    Did this help you?
13. 13
    Avoiding abandoned plugins with a low number of installs

    Did this help you?
14. 14
    Keeping regular backups

    Did this help you?

In their words

Unedited, grouped by where they were said, most upvoted first within each place, each linked to the thread it came from.