Risk Assessment is described as
Risk assessment determines the value of the information assets, identifies the applicable threats and vulnerabilities that exist (or could exist), identifies the existing controls and their effect on the risk identified, determines the potential consequences and finally prioritizes the derived risks and ranks them against the risk evaluation criteria set in the context establishment.
in the ISO/IEC 27005:2011.
A Threat Risk Assessment does exactly that, but with focus on threats towards an organization/system/software (whatever you set as your scope).
To give an example, if you would perform a TRA for your blog an outcome might be:
Asset: webserver
Threat: abuse of rights
Vulnerability: All admins have access to the admin control panel (or whatever this is called in wordpress)
Control: Gee, I don't know?!?
Effect on Risk: lowers likelihood by X%
Now you are done with the risk assessment (in a nutshell). After you have completed this for all your assets within the chosen scope, you model your threats. This means, that you try to 'think' like an attacker who wants to harm you/your system. How would he/she try to accomplish his/her goal? If you can't do that yourself, you hire a consultant, an IT-security expert or you visit Sec.SE and ask a question:
You: "Heyyy guyzz, how would an admin abuse his rights, if he was,
like, an admin on my blog?" (not you obviously)
You get a sophisticated answer that describes how this admin would do that.
Sec.SE: "Oftentimes administrators have more rights, than they need. Imagine a team of - let's say - 5 admins. Each admin has a specific role. Admin A is responsible for uploading new content, Admin B is responsible for moderating comments, Admin C is responsible for maintaining the database and so on. This obviously means, that each admin should only have the rights, that he/she definitely needs to have. You should definitely restrict the rights for admins in a way, that they are only allowed to do things, that they have to, according to their roles.
Now you have modelled(!) a threat and also established a control. Congratulations!