Neste artigo, vou mostrar algumas dicas para deixar seu site mais seguro editando o arquivo htaccess.

Encontre seu arquivo htaccess. Ele deve estar dentro da pasta raiz do site, ou public_html ou www.

Após encontrar o arquivo, você vai inserir os códigos abaixo. Vou mostrar código por código e explicar pra que serve cada um. Bora lá:

01) Impedindo a listagem de diretórios:

Options All -Indexes

02)  Protegendo o próprio arquivo htaccess

order allow,deny
deny from all

03) Protegendo o arquivo wp-config.php

<files wp-config.php>
order allow,deny
deny from all
</files>

04) Reescrita da URL

RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]

05) Protegendo qualquer tipo de acesso a pasta wp-includes

RewriteRule ^wp-admin/includes/ - [F,L]
RewriteRule !^wp-includes/ - [S=3]
RewriteRule ^wp-includes/[^/]+\.php$ - [F,L]
RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
RewriteRule ^wp-includes/theme-compat/ - [F,L]

06) Impedir acesso aos arquivos da pasta wp-admin do WordPress
Observe abaixo que você precisa inserir o link do seu site.

RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{HTTP_REFERER} !^https://(.*)?[seusite.com.br]/ [NC]
RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$ [OR]
RewriteCond %{REQUEST_URI} ^(.*)?wp-admin$
RewriteRule ^(.*)$ - [F]

07) Permitindo indexão de imagens somente pelo Google
Observe abaixo que você precisa inserir o link do seu site.

RewriteCond %{HTTP_REFERER} !^https://(.*)?[seusite.com.br]/ [NC]
RewriteCond %{HTTP_REFERER} !^http(s)?://(.*\.)?google\..* [NC]
RewriteRule \.(jpg|jpeg|png|gif)$ - [NC,F,L]

08) Bloqueando execução de arquivos .php dentro da pasta Plugins

RewriteRule wp-content/plugins/(.*\.php)$ - [R=404,L]

09) WordPress protegido de ataques Script Injection

Options +FollowSymLinks
RewriteEngine On
RewriteCond %{QUERY_STRING} (<|%3C).*script.*(>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} GLOBALS(=|[|%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} _REQUEST(=|[|%[0-9A-Z]{0,2})
RewriteRule ^(.*)$ index.php [F,L]

10) Forçar uso de cache do browserExpiresActive On

ExpiresByType image/jpg "access 1 year"
ExpiresByType image/jpeg "access 1 year"
ExpiresByType image/gif "access 1 year"
ExpiresByType image/png "access 1 year"
ExpiresByType text/css "access 1 month"
ExpiresByType application/pdf "access 1 month"
ExpiresByType text/x-javascript "access 1 month"
ExpiresByType application/x-shockwave-flash "access 1 month"
ExpiresByType image/x-icon "access 1 year"
ExpiresDefault "access 2 days"

11) Forçar compressão com gzip

AddOutputFilterByType DEFLATE text/html text/plain text/xml application/xml application/xhtml+xml text/javascript text/css application/x-javascript
BrowserMatch ^Mozilla/4 gzip-only-text/html
BrowserMatch ^Mozilla/4.0[678] no-gzip
BrowserMatch bMSIE !no-gzip !gzip-only-text/html

12) Instale o plugin Really Simple SSL
Este plugin vai redirecionar seu site de http para https. Deixando o site com a marca de seguro.

13) Dentro do arquivo wp-config.php inclua as seguintes linhas:

/** desabilitando o editor de arquivos do wordpress. */
define( 'DISALLOW_FILE_EDIT', true );

/** Para desativar as instalações de temas e modelos */
define ('DISALLOW_FILE_MODS', true);

14) Crie um arquivo .htaccess dentro da pasta uploads() e insira o seguinte código:

<Files ~ ".*\..*">
Order Allow,Deny
Deny from all
</Files>

<FilesMatch "\.(jpg|jpeg|jpe|gif|png|bmp|tif|tiff|css)$">
Order Deny,Allow
Allow from all
</FilesMatch>

<FilesMatch "\.(php|php\.)(.+)(\w|\d)$">
Order Allow,Deny
Deny from all
</FilesMatch>

15) Corrija as permissões de pastas e arquivos

.htaccess 444
wp-config.php 440
index.php 644
/themes 711
/wp-admin 755
/wp-includes 755
/wp-content 755

15) Use um bom plugin de segurança para seu site. 
Tente o All In One WP Security.

Conclusão

Com essas dicas, você estará dificultando o acesso indevido ao seu site.
No final, seu arquivo htaccess ficará assim:

Options All -Indexes
<files ~ "^.*\.([Hh][Tt][Aa])">
order allow,deny
deny from all
satisfy all
</files>
<files wp-config.php> 
order allow,deny 
deny from all 
</files>
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
RewriteRule ^wp-admin/includes/ - [F,L]
RewriteRule !^wp-includes/ - [S=3]
RewriteRule ^wp-includes/[^/]+\.php$ - [F,L]
RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
RewriteRule ^wp-includes/theme-compat/ - [F,L]
RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{HTTP_REFERER} !^https://(.*)?seusite.com.br/ [NC]
RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$ [OR]
RewriteCond %{REQUEST_URI} ^(.*)?wp-admin$
RewriteRule ^(.*)$ - [F]
RewriteCond %{HTTP_REFERER} !^https://(.*)?seusite.com.br/ [NC]
RewriteCond %{HTTP_REFERER} !^http(s)?://(.*\.)?google\..* [NC]
RewriteRule \.(jpg|jpeg|png|gif)$ - [NC,F,L]
RewriteRule wp-content/plugins/(.*\.php)$ - [R=404,L]
Options +FollowSymLinks
RewriteEngine On
RewriteCond %{QUERY_STRING} (<|%3C).*script.*(>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} GLOBALS(=|[|%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} _REQUEST(=|[|%[0-9A-Z]{0,2})
RewriteRule ^(.*)$ index.php [F,L]
</IfModule>
<IfModule mod_expires.c>
ExpiresActive On
ExpiresByType image/jpg "access 1 year"
ExpiresByType image/jpeg "access 1 year"
ExpiresByType image/gif "access 1 year"
ExpiresByType image/png "access 1 year"
ExpiresByType text/css "access 1 month"
ExpiresByType application/pdf "access 1 month"
ExpiresByType text/x-javascript "access 1 month"
ExpiresByType application/x-shockwave-flash "access 1 month"
ExpiresByType image/x-icon "access 1 year"
ExpiresDefault "access 2 days"
</IfModule>
AddOutputFilterByType DEFLATE text/html text/plain text/xml application/xml application/xhtml+xml text/javascript text/css application/x-javascript
BrowserMatch ^Mozilla/4 gzip-only-text/html
BrowserMatch ^Mozilla/4.0[678] no-gzip
BrowserMatch bMSIE !no-gzip !gzip-only-text/html