I have basic auth protecting login and no plugins installed because I know they are usually the source of vulnerabilities.