how to protect from hackers

Remain calm and carefully follow this guide. When you’re done, you may want to implement some (if not all) of the recommended security measures.

I’m pretty sure he’s not being hacked but just want the security measures.

Good thing that James posted both resources then!

There are a lot of solid posts about WordPress security that you can find online.

Server side security is better, but having a security plugin active on the site, changing the login URL from wp-login.php and having site backup running would be a good start.

Additionally you might look at the plugin, WordFence.

As mentioned server-side security is the best, but Wordfence is one of the better Free plugins that will help prevent, and in the rare case it happens, recover from a hack.