I operate a semi-well-known website that has been running Wordpress for over 11 years, and it's been hacked and attacked relentlessly since the early days. On m

I operate a semi-well-known website that has been running Wordpress for over 11 years, and it's been hacked and attacked relentlessly since the early days. On multiple occasions the attackers have managed to get their "dashboards" onto the server to insert spam links and use my server in a botnet. I keep my Wordpress and plugins up-to-date, but they still kept finding ways in. What finally worked for me was to write a simple front-loader to replace the Wordpress front-loader. It has a whitelist of allowed $_POST fields, a blacklist for $_POST content, and it deletes anything in $_FILES unless the user is on a whitelisted IP. This has kept the site safe for several years now so far. Mine is an extreme case, but maybe this approach will be helpful to other extreme cases.