How do I keep my wordpress site secure?

I currently have
- Domain privacy protection (I got lured in by the bluehost affiliates and bought a subscription till 2022 , I plan on transferring them to a better more expensive, non shared hosting) then
- Wordfence premium

Q: Do I need a plugin to hide the login screen?
Q: I currently use festinger's service for themes and plugins, sometimes a plugin can't be updated for some time, is it true that my site is then more vulnerable to hackers? Is it possible that I will face problems down the road?

- Regularly checking exploit sites. Google: "wordpress vulnerability database". Keep eye on whether someone post exploit of wp version, themes and plugins you are using.

- You can update your theme or plugin directly to wp repo (wordpress.org) from your wp admin page. So need for other services.

- I suggest you to read and learn about some stuff because security is a technical stuff which can affect your convinient and the performance of your server. In many cases, some server configuration can avoid the need of plugins.

Thank you for your response, I often get e-mails from wordfence about what plugins caused vulnerabilities to WordPress sites, but I will definitely check exploit sites regularly

@kindablack has a sales thread in which he offers wordpress security

Most probably wordfence will secure your wp site
but it will use your resources.

On the other hand make sure that on server side you have secured directory + FTP + SSH + Database access

1. Move dns to cloudflare
2. Change wp login url
3. Don't use 'admin' login as user name
4. Install wordfence plugin + limit logins attempts
5. Change DB password + wp login password to 30+ random characters
6. Don't use nulled themes or plugins

Hide login plugin plus wordfence premium

Well, I use a combination of on-site and off-site tools:

On site:
- Wordfence
- WP Cerber
- Ninja Firewall
- All In One WP Security & Firewall

Off-Site:
- Cloudflare (with special added rules)

Like others suggested
Move your dns to cloudflare and set up a rule to js challenge EVERYEONE who is not using ssl (assuming your website does have ssl,will filter a TON of bad bots)
Another rule you could use on cloudflare is to jschallenge everyone whos thread score is greater than or equel to 9, this will prevent access with proxies and vpn`s (if someone is trying to access your website with proxy or vpn chances are they are with bad intensions)
For wordpress im not using anything else other than:
"WPS Hide Login" (to change login page from wp-admin to one of your choosing),
"Limit login attempts reloaded" (so that if by any chance someone does find your login page this will prevent brute force).
Mind you i run my wps on vps so i have fail2ban plugin installed to filter all bad request and ban them on my website, since you are using cPanel (i guess) you MIGHT (but not necessary) use some sort of firewall on your wp website

i use wordfence premium.

Let me answer your questions here:

Q: Do I need a plugin to hide the login screen? If you want to hide the login screen don't put the login link on the website: However, people familiar with WordPress would know that the login link is yoursite+wp-admin.
There are couple of plugins that would hide your default login links so that hackers and bruteforce links can be hidden or changed to what you like. So please go-ahead and check these options. adding plugins like wordfence is good. Check that once as well.
Q: I currently use festinger's service for themes and plugins, sometimes a plugin can't be updated for some time, is it true that my site is then more vulnerable to hackers? Is it possible that I will face problems down the road?
festinger is a service providing themes and plugins as GPL complaint. I have not heard about it other than in BHW. There are more good ones out there. not sure if I can put the names here.

Coming to your initial point of domain privacy is good to hide your contact details when someone search whois of a domain and nothing more.