The key to running Wordpress securely is usually to set the file permissions correctly and protect all admin routes. Basically, don’t expose any write endpoints to the internet.

And the easiest way is to use as few third party plugins/themes as possible.

Base Wordpress is pretty secure if you put the admin panel behind a VPN and don’t install any plugins.