Sleep tight, even without a security expert.
WordPress security and maintenance plugins: web application firewall, malware scanning, two-factor authentication, automatic backups, login audit.
We're happy to run a 20-minute scoping call — no pitch, just a look at your stack.