First, be cautious of any plugin that has this showing at its page here at www.ads-software.com:
“This plugin hasn’t been updated in over 2 years. It may no longer be maintained or supported and may have compatibility issues when used with more recent versions of WordPress.”
Such is the case with WP Firewall 2.
WordPress security has many approaches, but anything reliable begins with these basics:
https://codex.www.ads-software.com/Hardening_WordPress
BulletProof Security is a plugin that takes care of all of that and more as well as the things covered by 5G. In over two years now, I have *never* had any invasion attempts get past BPS. Its initial setup does not require anything more than making less than a dozen clicks, it has a “Custom Code” editor for adding extras later (and it even suggests what to add), and it will never break your site.
That takes care of guarding the door at your site, but then also using the NinjaFirewall plugin to work out ahead of your site can turn malicious traffic away at the gate.
For the desired traffic that next actually reaches your site, WordFence Security can throttle the aggressive ones while occasionally scanning all files for unwanted changes. I find the throttling helpful, but I am thinking about turning off the scanning since the only reports I ever get come from plugin authors making changes without actually sending out an update.
There are other plugins that do the above, so have a look for yourself!