Are security plugins affects website performance?

It depends on what you think is more important – a few miliseconds or processing time, or a site that has more chances of being hacked.

There is a caveat to that though. If you are good (and I mean very good) at server set up, optimisation and security, then there’s little chance that you’ll need any sort of security plugin for WordPress as you’ll most likely mitegate most of the possibilities through the server set up before they even get to your WordPress installation. However, most people that use WordPress are not that knowledgeable on the matter, so it’s a much better idea fo them to use *something*.

I had put some security codes into my htaccess already. Can I still use some security plugins?

Yes you can. Any security plugin will act after those .htaccess rules will, and if the rules are set up correctly they won’t be over-written by any changes that the security plugin or WordPress makes to your .htaccess file.