Keep headers/logos under 125 pixels high. It takes up valuable viewing space, especially for laptop users, that is best left for the good stuff to appear"above the fold" Take a cue from the big companies, simple logos done well say it all. This is our #1 pet peeve - screaming logos and headers!
My first step is but I was helped by it. I had a good old fashion pity party. I cried and railed against the evil hackers (that where probably 13 and smarter then me) And I did before I started my website, what I should have done. And here is where I want you to start as well. Learn hacked. The beautiful thing about how to fix hacked wordpress and why so many people recommend because it is so easy to learn, it is. Unfortunately, that can also be a detriment to the health of our sites. We need to learn how to add a security fence around our site.
The stronger approach, and the one I recommend, is to use one of the creation and storage plugins available on your browser. I believe after a free trial period, you have to pay for it, although people like have a peek at this website RoboForm. I use the free version of Lastpass, and I recommend it for those who use Firefox or Internet Explorer. That will generate passwords for you; then you use one master password to log in.
There is a section of config-sample.php that's headed"Authentication Unique Keys." There are four definitions that appear within the block. A hyperlink is inside that section of code. You need to enter that link in your browser, copy the contents which you get back, and replace the keys you have with the unique, pseudo-random keys provided by the site. This makes it harder for attackers to automatically create a"logged-in" cookie for your site.
Make a note of your password! I suggest the version of the software that is secure *Roboform* to remember your passwords.
These are three simple things you can do to keep WordPress secure without plugins. Put a blank Index.html file in your folders, run your web host security scan and backup your entire account.