Setting up WordPress

I have used WordPress for personal use. but this time i am looking to host a kinda big website. now the problem is i do not know how to design it. i have confusions regarding cache, HTTPs, Ddos and other security threats.
the site that i am looking to host is 3K Pages and full of images with Expected daily hit of 4K users or above.

here are my confusions.

– First think how should i know which hardware requirement is suitable of this size of website. i would be using digital-ocean. i know the answer is stress test but atleast for stress test i still need a machine.

– what is the best practice to mitigate DDOS.

– now cache thing, should i need varnish or W3 caching addon which one will suite more to this type of website.

– what is the best practice to overcome other general attacks like SQL injection, and protect my site from spam, ETC.

– there are many firewall plugins which one should i choose.

your experience advice is highly appreciated.

Thanks,
Yousuf