Log of failed access, pingbacks, user enumeration, disable xmlrpc authenticated methods, kill xmlrpc request on authentication error.

Don't let anyone know that which WordPress version are you using.

Remove overhead from the HTML, speed up your website and disable widgets you don't use