A – WP- Admin

Your can restrict access to wp-admin by IP:

1.order deny,allow
2.allow from a.b.c.d # This is your static IP
3.deny from all

Source - BlogSecurity.net

B – Blacklist

One of the most important things you can do with .htaccess is blacklist IP addresses. You can do so with the following code:

1.<Limit GET POST PUT>
2. order allow,deny
3. allow from all
4. deny from 123.456.789
5.</LIMIT>

Source – Perishable Press

C – WP-Config Protection

Your wp-config file contains your database name, your database username and your database password. In other words, you’ll want to keep it secure.