Your best bet is one of the big ones like wordfence or sucuri etc. I've also heard shield security mentioned every time this question is asked so that is definitely worth a try. Less popular than wordfence etc but way more cheaper
Hide my WP Ghost is a great security plugin as nobody know site uses WordPress as CMS and it works together with another security plugin such as Wordfence, Sucuri, Shield Security, etc and it has both free and paid version. Don't forgot install HTTP Headers plugin gives you control over the HTTP headers returned by wordpress site.
I recommend Astra Security if your client have ecommerce site.