There is only one way to make WordPress safe, but it's never going to happen,because of marketing, and because the core developers are not serious about security (let the attacks and the propaganda begin).

Let's not consider server security for now, and just concentrate on WordPress. There are 3 areas of concern - the core, the plugins, and the themes. Even if the core is secure (which it never is, since the core gets constantly being patched, but let's assume it is), NOTHING is being done about plugins and themes. I'm not necessarily mean those from the repository, which btw, in this case it came and caused a huge situation, but I'm specifically referring to third party sources. Even if those sources are trusted (is there such a thing?), those "secure & trusted" sources can be compromised as well, look what happened to Linux Mint 2 weeks ago.

I said it a thousand times before, and I'll say it again, since the core does not check for themes and plugins that are insecure to get activated, WordPRess is never going to be secure. So, if you try to activate a plugin or a theme, the core should check for security holes, and if it finds them, should refuse to activate the said plugin or the theme. At the repository, a big percentage of the plugins have security issues, which I can't understand how they got approved to begin with. If you don't believe me, download and run plugin tests with the "Plugin Inspector", found at wordpress.org, and see it for yourself.

As I said before, this is never going to happen, since WordPress is run like a big government. Quality takes the backseat to activity. They rather have activity (43,000+ plugins for example), as oppose to 10,000 quality plugins, that will not put your website in danger.

There is no other way to maximize WordPress security, the core has to take action, and refuse any unsafe code to get activated. Until then, just like politicians and governments, everything else is just white noise, propaganda, and false sense of security.

I have nothing against the core developers, the plugin and theme teams who approve them, they have tremendously huge and important jobs and I do admire and respect them, but at least admit the shortcomings, and finally do something meaningful about the security issues. After more than a decade of developing WordPress, this is almost embarrassing. Security issues like this, should have been a huge priority over things like distraction free writing and other meaningless things, as an example the new shortcuts proposals, and among countless other things... All the people who are really in charge, are 100 times more intelligent than me, so I'm sure this has crossed their minds, but chose to do nothing, while keep telling us WordPress is safe. The reality is that unless you code your own themes and plugins, your WordPress websites will never be safe, as it stands today.