Most WordPress sites that get compromised or become slow do so through a plugin. Choosing them well is therefore worth more than any security plugin you could install afterwards.
The good news is that the signals are visible before you install anything, and checking takes about two minutes.
The four checks worth doing
Last updated. The most informative single figure. A plugin updated within the last few months is maintained; one untouched for two years is not, whatever its rating says.
Tested up to. If it has not been tested with a recent WordPress version, the author has stopped paying attention.
Active installations. Not a quality measure, but a plugin with a large user base has more people finding problems and more pressure to fix them.
Recent support threads. The most useful and least read part of a plugin's page. Unanswered threads from months ago tell you what support will be like when you need it.
Any one of those failing is a reason to look for an alternative. All four are visible without installing anything.
Read the one-star reviews
Not to count them: to see what they say.
A plugin with a handful of one-star reviews all describing the same fault has a real problem. A plugin whose bad reviews are people who did not read the description has a documentation problem, which is different and less serious.
Look at whether the author replied. An author who engages with a bad review is one who will engage with your problem.
What "abandoned" costs you
An unmaintained plugin is not merely stale. When a vulnerability is found in it, nobody publishes a fix.
Vulnerabilities in popular plugins are catalogued publicly, and automated attacks begin scanning for them within days of disclosure. Running an abandoned plugin means being on that list indefinitely.
WordPress marks plugins closed in the directory when they are removed for security reasons, and an installed plugin does not tell you that happened. Checking occasionally is worth it. There is more on the wider picture in securing WordPress.
Nulled plugins are not free
A paid plugin offered free on some other site has been modified. The modification is the business model.
What is added is typically a backdoor, a spam-link injector, or a route for someone else to run code on your server. It is not an occasional risk in this category; it is the usual case.
You also get no updates, which means no security fixes even setting the backdoor aside. If a plugin is worth using, it is worth paying for, and if it is not affordable there is nearly always a free alternative that is maintained.
Prefer fewer plugins
The count matters less than what they do, and it still matters.
Every plugin is code running on every request, another update to apply, and another author whose security practices you are trusting. Thirty plugins means thirty of each.
Before installing, ask whether the theme already does it, whether WordPress does it natively, or whether ten lines in a child theme would do it. Creating a child theme goes into where those lines belong.
Weight is not about the count
One plugin running a database query on every page load costs more than thirty that do nothing on the front end.
The ones to watch are those that add scripts to every page, query the database on load, or run scheduled tasks frequently. Sliders, page builders and "all-in-one" suites are the usual offenders.
Install one at a time and check the site's speed after each. A plugin that doubled your page generation time is obvious immediately and invisible a month later. Optimizing WordPress performance walks through measuring it.
Test somewhere that is not live
Install on a staging copy first, particularly for anything touching the database, checkout, or the theme.
A plugin that conflicts with another produces a white screen, and finding that out on a live shop during business hours is entirely avoidable. There is more on making one in setting up a staging site.
Deactivating is not removing
A deactivated plugin's files remain on disk and remain reachable. Several known compromises have gone through plugins that were installed and switched off.
Delete what you are not using. If you might need it again, it can be reinstalled in thirty seconds.
Note that deleting usually leaves the plugin's database tables and options behind, which accumulate over the years. Cleaning up the WordPress database walks through finding them.
Keep a record of why
Write down what each plugin is for, particularly on a site you maintain for someone else.
A year later, nobody remembers whether a plugin with an obscure name is load-bearing or a leftover experiment, and the safe assumption becomes leaving it installed forever.
A short note in a text file is enough, and it is what makes a periodic clear-out possible rather than theoretical.
A two-minute routine
Check the last update date. Check tested-up-to. Skim the recent support threads. Read two one-star reviews. Install on staging. Measure the page speed before and after.
That is the whole process, and it removes most of the ways a plugin ruins a site, which is more than any tool you could add afterwards would do.
Once you have chosen one, How to Install and Manage Plugins goes into installing, updating and removing it properly.
A plugin that defines no hooks of its own cannot be extended without modifying it, which is worth knowing before you depend on it. Understanding WordPress Hooks: Actions and Filters deals with what to look for.