https://www.mekinpesen.com/application-security/hardening-and-securing-wordpress-without-plugins/
Hardening and Securing WordPress Without Plugins