Use individual accounts, strong unique passwords and two-factor authentication where supported. Give people only the access they need. Keep WordPress, themes and plugins updated and remove software you no longer use.
Maintain regular backups away from the website and test a restore. A backup is useful for recovery, but it does not prevent a compromise or remove the cause of one.
Investigate unfamiliar administrators, redirects, spam pages and host warnings. Preserve useful evidence and get help if you are unsure what has changed. A security plugin can support the work, but it is not a guarantee.
