If all of your forum and WP (non xenforo) sites have been hacked, you likely need to invest time keep it all updated. I check all of my forums and sites EVERY morning at 6am, and follow their support forums, to make sure no add-ons or base code need to be updated with patches since the previous day. Make sure that permissions are correctly set for folders, too.
I have been doing this since the early 1980s in the dialup days, and have never had a system hacked. Maintenance and proper backups are a good investment of your time, IMO.