By default, the latest version of WordPress is pretty secure. Anything that might have been added to some how to fix hacked wordpress plugins has been considered by the development team of WordPress . Before, WordPress did have holes but most of them are stuffed up.
I protect an access to important files on the site's server by putting an index.html file in the particular directory, that hides the files out of public view.
Exclude pages - This plugin provides a checkbox,"include this page in menus", which can be checked by default. If you uncheck it, the page won't appear in any listings of pages (which contains, and is usually limited to, your webpage navigation menus).
Pathological-looking phrases that were whitelists and black based on which field they appear inside, in a page request. you can check here (unknown/numeric parameters vs. known article bodies, comment bodies, etc.).
Implementing all of the above will take less than an hour to finish, while making your WordPress site more resistant to recommended you read intrusions. Over 1 million WordPress sites were last year, mainly due to easily click to read preventable safety gaps. Have yourself prepared and you're likely to be on the safe side.