Walk through a complete worked example: every command, in order, to bring a new router named R1 to a secure baseline.

Question

Accepted Answer

From a fresh router: enable → configure terminal, then hostname, enable secret, secure the console and VTY lines, service password-encryption, a banner motd, and finally copy run start to persist it.
This is the concrete transcript for the conceptual steps — note the mode changes in the prompt ((config) → (config-line) → back), which trip people up. You enter line-configuration mode for console and VTY, then exit back to global config for the remaining commands. The example assumes a brand-new R1 you have just connected to via the console.
Router> enable
Router# configure terminal
Router(config)# hostname R1
R1(config)# enable secret class
R1(config)# line console 0
R1(config-line)# password cisco
R1(config-line)# login
R1(config-line)# line vty 0 4
R1(config-line)# password cisco
R1(config-line)# login
R1(config-line)# transport input ssh telnet
R1(config-line)# exit
R1(config)# service password-encryption
R1(config)# banner motd #
*******************************************
WARNING: Unauthorized access is prohibited!
*******************************************
#
R1(config)# exit
R1# copy running-config startup-config

Gotcha: The banner delimiter (# here) must be a character that does not appear in the message text, and it must bracket the message on both ends. Forgetting the closing delimiter leaves you stuck typing into the banner. Also remember the order is not arbitrary for security: enable secret before you risk leaving privileged mode unprotected, and copy run start (or wr) last so everything you just did survives a power cycle.
Go deeper:

Jeremy's IT Lab — SSH (CCNA Day 42) — types the secure-baseline transcript live, including the mode changes that trip people up.
 Cisco IOS — command modes (Wikipedia) — the (config) → (config-line) → back transitions shown in the transcript.