Hide my WP Ghost is a great security plugin as nobody know site uses WordPress as CMS and it works together with another security plugin such as Wordfence, Sucuri, Shield Security, etc and it has both free and paid version. Don't forgot install HTTP Headers plugin gives you control over the HTTP headers returned by wordpress site.
I recommend Astra Security if your client have ecommerce site.