When setting up the WordPress installation please:
- Do not use ‘admin’ as the username, use something unique like ‘sitename-admin’ etc
- Install https://en-gb.wordpress.org/plugins/wps-hide-login/ to change the default login page from /wp-admin/ to something unique i.e. /sitename-login/
- Install WordFence but do not activate, this is activated when going live