WordPress hardening without touching your theme: XML-RPC, user enumeration, login limiter, security headers, strong passwords, event log.