To harden a WordPress site, you work in layers: lock down how people log in, keep everything patched, reduce what is reachable from outside, put a filtering layer in front of the server, and make sure you would notice a compromise quickly. No single plugin does this....