I work with Wordpress since years and I use to protect my client websites with iTheme Security + Wordfence keeping core