For your firewall, though, I’m from the school of thought that believes security plugins are generally not worth installing. They often have a heavy impact on performance, can introduce many security vulnerabilities of their own and don’t always provide more useful defence than you can get through sensible configuration and consistent maintenance of your site. If you’re willing and able to pay for protection, you’re probably better off with a WAF like Securi or Cloudflare than relying on a plugin.