While there is no way to guarantee that your website will never be attacked, there are steps that you can take to reduce the risk to your business, and limit the impact of an attack should one occur. These steps include
Keep your plugins up to date
Limit access to only those who need it
Remove inactive plugins and users
Enable multi-factor authentication wherever possible
Put a disaster recovery plan in place