There's a few things you can do immediately.
- Read the WordPress codex for steps in Hardening Wordpress
- IP protect your Wordpress Login files so that ONLY the IP's you use can access the files.
- Have your host install fail2ban
- Use common sense. The weakest part of Wordpress is the lack of keeping it updated and a tendency to rely on 3rd party plugins and themes. Not only does an abundance of plugins slow your site down, they contribute to sites breaking on update. If you have to use plugins, make sure to keep them updated and use ones from quality sources.
There's other things you can do. But the above is fairly straightforward and won't clutter up your database with the security plugins out there.
Even cloudflare is an option as they have web application firewall (WAF) rules already in place for Wordpress specific targets.