To harden a WordPress site, you work in layers: lock down how people log in, keep everything patched, reduce what is reachable from outside, put a filtering layer in front of the server, and make sure you would notice a compromise quickly. No single plugin does this....
A working WordPress backup strategy has four parts: back up both files and database, run it on a frequency matched to how often your site changes, store copies off-site in a location separate from your hosting account, and test a restore on a schedule. Miss the last...
Here is why WordPress sites slow down: nothing breaks all at once. Plugins pile up, the database fills with records nobody deletes, images get uploaded at full camera resolution, the PHP version falls behind, and the caching that was set up at launch quietly stops...