Configuration and security measurements on live server

1- Is basic hosting plan from “BlueHost” enough for my website?

I have several small sites there in one account and the servers seem quite sufficient.

What are the steps that I should take…to insure security…

BulletProof Security (plugin) to “harden WordPress”, then also follow its additional permissions suggestions.

I would like to do the security measures that is done manually not using a plugin. Isn’t that possible?

Not to the extent BPS does that unless you are as expert as its authors. And for perspective here: I spent my first two or three months sorting through all kinds of articles, tutorials and snippets before discovering BPS had *all* of those covered along with much, much more and now I never look back after nearly three years of never since having any intrusion or hack. Also, BPS is not ever going to cause you any trouble.

I heard that in the .htaccess and php.ini files there are changes that should be done once the website is live. is that right?

Yes, and with the things in php.ini being more optional. But there in php.ini is where you could just do your own work at whatever pace without risking the kind of exposure you would have while spending many hours trying to get even close to what BPS does with htaccess.

BPS secures the gate and all service doors, and then, if you wish, WordFence Security does a fine job of throttling traffic and several additional things on the inside. And then to optionally stop certain malicious traffic altogether before it can ever even reach WordPress, NinjaFirewall can run its own stuff out in front of it all.