Plugin installation after a hacked blog?

Hi,

My site’s blog has been hacked, new categories and articles, from the default category and the new categories, are repeatedly created.
So far I have taken the following measures:

• deleted all new categories and articles
• changed the passwords
• updated wordpress, plugins and the active theme to the latest versions
• the next step is to install Wordfence
  Do you recommend installing this plugin on a site after it has been hacked or are other previous measures necessary?
  If you’ve been through this before, can you help me? Thank you.