How to protect wordpress from hacking user accounts?

Question

CMS

Created a service based on wordpress. Periodically, users of the service complain that their accounts are hacked. How can users be protected from such hacks?

Answer 1

https://wordpress.org/plugins/wordfence/ block after 3 attempts of incorrect input for 20 minutes, the second time for a day and immediately for a day if the username is not correct (this is optional)
captcha be sure
to enter the login panel transfer
the password strength check when registering and when changing the
alert, set up when you try to enter the password 3 times for soap
from the more radical ones, you can send the token via SMS to the entrance or set up the entrance via the social network (they are more difficult to hack at times)

Answer 2

Take away their computers. Well, or make authorization by SMS.

Answer 3

Issue an authorization token for specific server or client parameters (subnet, browser, domain, url, etc.).
Initiating token - send via e-mail.