Harden WordPress Security Firewall Setup

My WordPress site has suffered a few suspicious incidents and I’m ready to lock it down properly. The first task is a solid, fully-configured firewall that works at both the application level (plugin or WAF) and the server level if possible.

You’ll need to:

• Recommend the most effective firewall solution for my current hosting stack (Cloudflare, Sucuri, Wordfence, or similar) and explain why it fits.
• Install and configure the firewall so it blocks common attack vectors, rate-limits brute-force attempts, and logs events clearly.
• Tweak .htaccess or server rules as needed to harden admin and login areas.
• Verify that the site’s performance and existing plugins remain unaffected after the changes.
• Provide a brief hand-off report summarising settings, any IPs or rules added, and simple steps I can follow for future checks.

If everything runs smoothly, I’m open to extending the engagement for SSL optimisation and regular security scans, but the firewall setup is the immediate priority.