I've finished building my wordpress website and now, I'm concerned about the security of the website.

To improve security, I'm using Google two factor authentication plugin while also password-protecting the wp-admin folder besides the default username-password login of wordpress.

My question is, does it make sense to apply all these layers of security? Am I being silly about this? I mean, if either two of these protection methods are used, instead of three, and it is enough, then using all three will be too much of a hassle without bringing significant improvement in security. What do you think?