Heads Up :
The post you are writing will appear in a public forum. Please ensure all content is appropriate for public consumption. Review the employee guidelines for the community here.
For a small WordPress service site, I’d aim for a layered baseline rather than trying to build an enterprise security stack. HTTPS, MFA for administrator accounts, minimal admin privileges, timely WordPress/plugin/theme updates, login protection, a r...