I also run multiple WP sites. There are many steps you can take to limit but not eliminate the risk of hacking. Here are a couple:
-keep all WP core and plugin code up to date
-use a theme from WP.org: These are somewhat tested. Third party themes may or may not be well tested
-limit/reduce plugins: Plugins are where most hacks occur in WP, not core code. Reduce these to a bare minimum and ensure they are all updated. If you can do something with a plugin or without, do not use a plugin.
-remove all unused themes and plugins from your install. They can be an entryway for a hack
-ensure passwords are non-trivial: simple passwords are easily guessed with hacking software and a vocabulary file. IDs are easily found with a simple scan of documents
-2FA: Do two factor authentication. This is a server-based ID and password before the WP password challenge, and is common for all WP IDs. This makes it extremely difficult for bots to hack your IDs, though it makes it more difficult for your users.
If you only do this step you will markedly increase your WP security. [
codex.wordpress.org...]
Optional but very useful:
-monitor your raw access log and ban malicious bot behaviour
-download WP hacking software and try to break into your own sites. Scan your sites for vulnerabilities and easily broken passwords
There are no guarantees, so do regular backups. WP is not software you can leave alone for years. It will eventually get hacked. WP sites need regular maintenance and protection Server hacks can occur but are much more difficult.
