Itheme Security and which firewall? (After Hack)

Dear Support Team, I have installed your plugin on some websites and appreciate your work very much.

Unfortunately you do not offer a firewall directly. Do you have any experience with which free firewall you can support your plugin and which settings are optimal?

Recently, an attacker was unfortunately able to log in as a user and then promote himself as an administrator. We keep our systems like WordPress, Plesk with Web Application Firewall (ModSecurity), etc. up to date with the latest updates.

Hope that some professionals can give me some tips here!

Thanks for your support