Cloudflare.
It has a wealth of security and firewall rules and they can be customized. You might need the $20 month plan to unlock some of the better features though.
Two other reason I prefer Cloudflare for.security. One is that brute force attacks are all Wordpress hits. Even with a plugin it’s still a Wordpress hit. Every hit on the server adds to the apache queue. An overloaded queue will result in 50x errors to visitors and admins. By having Cloudflare field the hits Wordpress is protected.
In addition, our host charges by the humber of hits. Too many hits and we jump up a pricing tier. So Cloudflare also saves us hosting fees.