I always give the webserver read only access to the file system, except the uploads directory, and then prevent the webserver from being able to execute php inside the uploads directory.

You can't update plugins via the admin with this setup, that is instead done with a deployment script.

I've deployed many WP sites with this setup and have never been hacked.

Oh fail2ban monitoring wp-login is also essential.