Hardening is not about chasing a perfect, unbreakable site — that does not exist, and anyone promising it is selling something. It is about closing the common doors so that the easy, automated attacks that make up most compromises simply do not work on you.
Keep everything updated
The single highest-value habit. Most successful attacks use a known vulnerability in an out-of-date plugin, theme, or WordPress core. Keeping them current — and removing anything you no longer use — closes most of those routes for free.
Lock down logins
Use strong, unique passwords for every admin account, add two-factor authentication, and limit repeated failed login attempts so automated guessing gets nowhere. The login page is the most-attacked part of most WordPress sites.
Reduce who can do damage
Give people the lowest role that lets them do their job, remove accounts that are no longer needed, and keep the number of administrators small. Fewer keys means fewer ways in.
Set sensible configuration
Disable the built-in theme and plugin file editor, keep file permissions tight, use HTTPS everywhere, and avoid exposing information that helps an attacker. None of these are dramatic; together they remove a lot of low-hanging fruit.
Back up, off-site and often
Assume that one day something will get through, and make sure that day is recoverable. Automated, off-site backups that you have actually tested restoring are what turn a compromise into an inconvenience.
The honest version
Hardening lowers your risk; it does not remove it. The goal is to be a harder target than the site next door, to notice quickly if something does get through, and to be able to recover cleanly when it does.