I have talk about WordPress security before month ago in WordPress Bulgaria 2015.
So very short - if you have update to latest versions of core, plugins and themes and they're stable you don't have anything to worry about.
The problem is when some of them comes with non well checked code - most plugins or themes. This mean that if there is some vulnerability you can be infected over and over. Same can happen if you download from illegal sites plugin/theme with some added code as vulnerability. Don't think that "this won't happen on me" because this is one of most frequently way to distribute malware to users.
All that security layers add extra PHP code that need to be executed and slow down site. They also bring issues to some users. I never forget when few months ago ping in Twitter some site that i can reach their site from Bulgaria. Yes - due settings in their "security" plugin.
That's why you need few ways:
- you need to use only plugins/themes from original author. If they're on WordPress.org then this is preferred. This doesn't mean that they can't have some vulnerability, but you just minimize chance
- you need to update them regular
- you need to use only proven plugins/themes in your practice. I believe that plugins with 100k installs is tested than plugin with 10 installs
- you always should keep backup of site and it's database local on your computer. In hacked site case - you just need to restore from backup for 5-10 mins
- keep backups on regular basis - can be plugin or manually. There you can diff backups for changes very quick
- you need some skills to investigate web attacks using checking web server log files. I do this on daily basis for mine most important sites. If some IPs or user agents doesn't follow rules - deny their access
- in case of hack - keep archive of hacked site and then recover. One of huge mistake more novices make is to trying to clean site. Most of malwares keep somewhere in WP "dead hand" and they're back later. Experts (like me) need lot of time to find and disabled them. With backups - this is piece of cake
- If you follow this but keep hacked... then think out of box - maybe plugin have unknown vulnerability or theme. Sometime other sites/scripts working on same hosting account can infect you. I have even seen infected whole hosting company on server level. Then you need expert assistance. You can find this in WP forum and/or in your hosting provider.
- Some hosting providers provide extra service as - WordPress hosting. This is often high-speed solution with added extra level of security on server level. I can recommend SiteGround, WPEngine or nestify.io
List is really long and boring. But if you follow all these rules - you don't need "security" plugin. It's critical for you to know what's happen in WP and when this is happening. I often can see people that doesn't know that they're infected but they doesn't have backups or archives. This make mine job longer and expensive.
PS: I know that checking site on daily basis sound little bit scary. But take me maximum 5 minutes per site for day.