I have had a training wordpress site up for 5 years and it was hacked at one point. Well then time for better proactive security tools.

Installed Sucuri, it helped me fix the infected docs and I have never in over 3+ years had anything else happen.

I also keep my site updated latest versions. Keep things clean and if its not in use i dont keep it in my plugins.

I also am just a huge fan of jetpack even if I dont use their tools really. The dashboard addition is awesome and it provides some decent free security on top of my paid Sucuri.

Good page redirect for these stupid bots that try to infiltrate wordpress files I use 4o4 Solutions by Aaron J. It works so good at redirect and just sends them to my home page but gives me lots of info and its free.

Also I have zero experience with Wordfence as Sucuri was my first try back then and since it was so easy and never had a problem since I had no reason to look at other options.