How can we save our WordPress+PHP website from unauthorized access? How will website+code+data be safe from hackers or thieves?

many ways ...depends on the website type....and depends on the interaction way between users and website

There are a number of things to do to lower the chances of WordPress being hacked. You can find them listed in this link:

https://www.entrepreneur.com/article/241620

1. Hide your WordPress CP.
2. Enable WordPress Auto Update.
3. DO NOT install plugins that are not up to date or from unknown source.
4. Use strong password.
5. change Config file path. 

From server side also you need a lot like setting a firewall rule, disabling some PHP functions and close some ports.