1) Dowload wp-security-scan wordpress plugin -> http://wordpress.org/extend/plugins/wp-security-scan/

Create backup.
Upload the zip file to the /wp-content/plugins/ directory
Unzip.
Activate the plugin through the ‘Plugins’ menu in WordPress

- Hide wordpress version in meta tag
- Remove admin login id and change it other name
- Change database table name
- Check file permissions
- Select strong password for admin login

2) If you are don’t use  wordpress membership, you can close it.

3) If you don’t use wordpress comments, you can close it.

4) You always update your wordpress plugins.

5) Put a blank index.php or index.html in  /wp-content/plugins/ directory.

6) Hide your wp-admin folder from search engines crawling and add Disallow: /wp-admin/ in robots.txt file.

7) Add yours wordpress secret-key in wp-config.php

go to url : http://api.wordpress.org/secret-key/1.0/

select and get secret-key for your wordpress and put it in wp-config.php

8) You have to be careful about wordpress theme and plugin hackers. Because They are add harmful code in wordpress themes or plugins sometimes.

9) Hide wp-admin and wp-includes folder with .htaccess

Document by Osman Atabey & www.TcpSecurity.com