How to avoid malware and increase security

Hey WordPressers.

There are currently some issues regarding web-safety that I would like to discuss with you. When I started out as a WordPress freelancer, I would have never thought of this topic. The first websites I made (2012) were never attacked. When I started to develop my skills, I always offered my client some web security by making use of iThemes Security (free version). Everything went pretty fine and I never had major issues. However, these days, two of my websites are sending spam emails to the contacts bound to the email account, and one of them is non-stop under attack. Concerning this last point, I installed WordFence (free) and deleted iThemes Security, and at least all traffic is being kept outside the door. However, these email scripts cannot be found by all the major plugins (e.g. Exploit Scanner, WordFence, iThemes Security etc.). Other security scans such as Sucuri or the scan from ManageWP do not find anything at all. After reading loads of articles about hacked websites and malware, I am still not confident about solving these problems. I personally feel that this topic goes beyond my knowledge. What I usually do as being a freelancer, with things that go beyond my knowledge, is outsourcing. I don’t create my own Themes, I purchase them. Which goes hand in hand with plugins. However, one question that remains is the following.

How can I convince myself and my clients, that I can make their website secure to average hackers and other inappropriate traffic, by making use of proper plugins or other software.

To give a direction what I considered so far. The premium services by WordFence do not seem to solve these problems. Sucuri premium is awesome, but way to expensive for my clients. ManageWP (through which I manage all my sites) creates backups but is also not able to detect these malicious files.

Any suggestions about fully securing WordPress websites, for a reasonable price, taking private clients into consideration, are highly appreciated. Even full WordPress management systems are fine. As long as I keep the undesired traffic out of the door, and can promise my clients (to some extend) that they are considerably safe.

Thank you for helping out!