Most WordPress security incidents are not solved by one plugin. A strong baseline includes prompt core and plugin updates, unique administrator credentials, multi-factor authentication where available and removing software that is no longer used.
What to consider
Backups should be stored separately from the live site and retained long enough to recover from issues discovered later. Security scanning and file-change monitoring can provide early warning when something unusual happens.
Choose plugins and themes carefully, restrict administrator access and protect the hosting account itself. Website security depends on the entire chain from DNS and server configuration to application users.