How to secure WordPress site without plugin