Disable the Theme and Plugin File Editors
Turns off the built-in Theme File Editor and Plugin File Editor screens, so a hijacked admin account cannot inject code through them.
WPIDE Team 6 installs
Snippet Library
Security snippets for WordPress
Snippets that harden WordPress: turn off XML-RPC, hide the version number, stop user enumeration, add security headers and block risky uploads. Small, reviewable changes for site owners who want fewer attack points without a heavy security plugin.
Restrict Unfiltered HTML to Administrators
Only administrators may save raw HTML such as scripts and iframes in posts. Editors get the same safe HTML filtering as authors.
WPIDE Team 6 installsRequire Strong Passwords for Editors and Administrators
Requires at least 12 characters with letters, numbers and a symbol or mixed case for users who can edit other people's content.