Up-to-date updates
Most hacks come in through outdated plugins. Update core, theme and plugins, first in a staging environment if the store bills daily. Thirty pending updates, as we see in many audits, is an open door.
Access: 2FA and anti-brute-force
Enable two-step verification at least for admins and limit login attempts (5 attempts = temporary lockout). Delete the generic "admin" user and accounts no longer used.
Headers and firewall
A free security plugin adds headers (X-Frame-Options, HSTS with HTTPS) and a basic firewall that slows bots and scans. Cloudflare on its free plan adds another layer in front of the server.
Backups you can restore
A backup you never tested is not a backup. Schedule daily backups of files + database with 30-day retention and restore once in staging to confirm it works.
FAQ
Does 2FA annoy employees? It only asks for the code from time to time or from new devices.
Is free Cloudflare enough? For small and medium sites, combined with 2FA and updates, yes.