How do you protect your WordPress without any security plugin?

Why would you NOT use one of the better security plugins?

Anyhow, you may want to implement some (if not all) of the recommended security measures.

Because over my experience, they are usually slow down the website and conflict with others.
Do you have good htaccess codes which is also complied with cloudflare?

I don’t use Cloudflare — you’d need to ask them.

I do use WordFence on over 70 sites and, unless it’s actively scanning, does not affect site speed in any noticeable way.

From personal experience, the best way to learn how to protect your website is to suck a whole lot at security, get pwnt a whole lot over the years, painfully learn from your mistakes, until eventually you’re confident you don’t suck anymore. Try it, it works ??

Joking aside: pretentious talk and attempts to make it work without using the available help isnt’ going to do the job. If you intend to protect yourself all alone without relying on security plugins and solutions, you WILL learn it the sucky, painful and long way.