Also what are the best security plugins you recommend for wordpress?
I'm just using the cache plugin. htaccess is the first way of security.
First of all, you shouldn't let them solve what the system is. Set up individual directory-specific htaccess configuration. For example, some wp files are open to the outside. Deny access to some php files. (Check one by one) But do it one by one. Monitor the operation of the system continuously.
Sample:
<Files *.txt>
deny from all
</Files>
<Files *.license>
deny from all
</Files>
<Files *.html>
deny from all
</Files>
<Files *LICENSE>
deny from all
</Files>
<Files *.xml>
deny from all
</Files>
<Files *.ser>
deny from all
</Files>
<Files *.md>
deny from all
</Files>
<Files *.sql>
deny from all
</Files>
<Files *.ini>
deny from all
</Files>
If you are using a plugin, do it for its files as well. But some php files must read the browser. (Check in Live)
Turn off server ports. (You can do this with Cloudflare)
There are companies that offer sql injection scanning. You can get this service for a fee.
Note: Hide server ip addresses. (Cloudflare dns routing.)
Note: 2: Use SSL. Because you should use DNSSEC. (Protects your domain and DNS addresses from poisons.) In particular, DNSSEC is required. This prevents dns poisoning.
And if you know how to use Acunetix, it's good.
Never forget! Security matters. If you succeed, there will be people who want to poison you.