Google just gives me a bunch of content spam, but I know that there's gotta be some best practices I can employ.
2. Don't disable autoupdates.
3. Avoid plugins and external themes. If you can stick to Wordpress Core. If you use plugins use as few as possible and only ones that are maintained regularly. Keep plugins and themes updated.
4. Don't disable autoupdates.
Also, have I mentioned you shouldn't disable autoupdates?
You could decide to not upgrade when a new major version comes out, like 4.8.0, but wait till there is a 4.8.1. Often there is a rush to pack new features in a new release, and the first update often has quite a few security fixes.
Also, be picky about which plugins and themes you use. And if you notice that one becomes unmaintained (no updates anymore), make a plan to switch to something else. /edit: Commercial themes are often overloaded with lots of functionality that you don't need. If you care about security, avoid them.
There are also plugins like WordFence, which might be a good idea (I don't really know). Most things that are in there should really be handled serverside, like mod_security rules and firewall rules. This topic is about WAF rules, which are serverside done afaik.
If you just use shared hosting and have no control over the server, using WordFence might be a good idea.
(I maintain three WP myself by hand, but that's me being a control addict.)
WP's core security is vastly better these days. So instead you'll fall prey to a cruddy plugin or theme ... especially the latter, being PHP written by designers. (Nothing against good designers, but design thinking is not security thinking.)
A really useful shortcut: put /wp-admin/ behind Apache basic auth. This stops most doorknob-rattling automated 'sploits in their tracks. (Main barrier to doing this in practice is that nontechnical editorial people tend to get confused by two layers of password.)
I keep my Wordpress and plugins up-to-date, but they still kept finding ways in. What finally worked for me was to write a simple front-loader to replace the Wordpress front-loader. It has a whitelist of allowed $_POST fields, a blacklist for $_POST content, and it deletes anything in $_FILES unless the user is on a whitelisted IP. This has kept the site safe for several years now so far.
Mine is an extreme case, but maybe this approach will be helpful to other extreme cases.