WordPress Version Must Be Up-to-date
This one is pretty self explanitory
Use A Valid SSL Certificate To Secure Traffic
Again this one is pretty basic, now that Let’s Encypt exists, every site you set up should have an SSL. Any hosting company that we reccomend will have Let’s Encrypt integrated.
WordPress Address Should Normally Equal Site Address
WP_HOME and WP_SITEURL values should be left alone and should be the same value.
Whats the difference between them?
WP_SITEURL – The “Site Address (URL)” setting is the address you want people to type in their browser to reach your WordPress blog.
WP_HOME – The “WordPress Address (URL)” setting is the address where your WordPress core files reside.
Password Protect WP-Admin
This is also pretty understandable, what do you think the best way / plugin to password protect it.
Disable XML-RPC In WordPress
What is the best way to do this? update .htaccess file? use a plugin?
other posts about this topic:
How to Disable XML-RPC in WordPress at WPBeginner