Exactly this. My website was hacked a while back, when I was installing random disreputable plugins.

Remade it but thought before I installed and suddenly the site is performant and secure.