Guides from the NOC

Set up WordPress two-factor authentication, enforce it for every admin account, and recover fast if you ever get locked out of wp-admin.