Wordfence is the best security plugin we have tried as it is the most compatible to our needs. The free version offers features that are already enough to security a wordpress website. It has firewall options, rate limiting features, malware scanners and removal and even notifies you of unwanted behaviors and files within your wordpress site. The best thing is its live traffic option, in which it can show you the visitors to your site, especially the one's trying to hack your login page, showing its ip, and whether the one trying to access is a bot or human. Review collected by and hosted on G2.com.
Sometimes, live traffic eats up too much resources. If your site is at its peak of visitors and it is sluggish, disable live traffic. Review collected by and hosted on G2.com.