Phishing attack

Hi.
Two of my sites were attacked over night.
Files placed on my domain (within WP Content Upload folders) cannot be deleted by me in the normal way (access server via FTP etc).
So the web host is looking into it.
My passwords were strong, so I clearly need to do more to secure the sites.
I see there are pluggins to do this, but to be honest I just do not know what I am doing as they look complex, some requiring settings I have never come across before.
Is there a silver bullet security plugin that can help?
Advice greatly appreciated.
Thanks,