Most WordPress security advice is designed to scare you into buying something. Here’s what actually gets sites hacked and the practical security stack that prevents it.