Few steps to make your wordpress site more secure

1. Username

NEVER use "admin" as your administator user name. Choose something different!

2. Database prefix. 

Dont use wp_! Choose something different

3. Salt

In your wp-config.php don't forget about Salt
Follow the link https://api.wordpress.org/secret-key/1.1/salt/ and generate auth key and other parameters you can see somewhere around line 45. Copy and paste what you've got from generator.

4. Hide wordpress in subdirectory (doesn't work for multisite installations)
1. Put wordpress instalation files into new subdirectory - choose any name for it.
2. during installation use the pass yourdomain.com/yourfolder
3. after site is installed go to dashboard->settings
4. In site adress line leave only your site address: yourdomain.com
5. Download through ftp manager (ex. Filezilla) 2 files: .htaccess and index.php
6. In index.php change the last line: require( dirname( __FILE__ ) . '/wp-blog-header.php' ); add your folder name in the beginning so it will ook like this require require( dirname( __FILE__ ) . '/yourfolder/wp-blog-header.php' )
7. put new index.php and .htaccess files into root directory.
That's it!