1. restrict access to wp-admin to only your IP address. Not so easy if you have multiple users and dynamic IPs, but if you are running the blog yourself and your ISP gives you an IP it means nobody else can log in, even if they have your password.

2. WordPress Firewall – there are a couple, both work. Both block suspect URL queries which are often related to MySQL injection attempts, and they also help protect when a plugin goes bad.

3. Back up on 3 levels:
3.1 Full server backup, and download.
3.2 Backup your wp-content files and database
3.3 Create a WordPress export file.

4. Never keep FTP logins and passwords saved on your PC. Many programs save them, such as FTP clients, html editors etc. Just remember them, or even keep them written down in a book. Some trojans / virus are designed to sniff out FTP details.

Plugins to be careful with are any image upload (or any file upload) plugins. These are notorious. Although most are secure, some themes use them built in and they are not updated. So final tip:

5. Make sure you use secure themes!

Thanks for reminding