How to Prevent Potential Hacks from Occurring on Client Site

Hello all!

I am newer to using WordPress and I have created a few sites for someone I am doing work for. This client has started to get spam emails to an email that I so far don’t see linked to the website. (As in administrator email).

They suspect the potential hacking situation is what happened to their sites from before. Some hacker trying to use the site to get Bitcoin money, and I want to make sure I do what I can to keep their sites protected. I’ve done what I know to the best of my current knowledge:

Wordfence (free), reCaptchv3, and SSL.

They are using Cpanel for hosting, which I know nothing about at the moment but in some research I did I understand there is a way that Cpanel can be further secured?

I’m a bit nervous that hacking could take place at a server level such as phishing files, but I do not know how to protect from something like that.

Are there any recommended articles or courses or any advice or tips on how to prevent hacking at a server level from happening? And how could I look into stopping the emails?

Thanks!