If your site is hosted on WP Engine, they will monitor and prevent malicious attacks from the outside with a firewall and malware scanning.
If you own a high traffic website or are having issues with spam and malicious attacks then we recommend you add extra security and monitoring to your website with Sucuri. Sucuri monitors your website for spam, hackers and malicious attacks. If you purchase an account (or if you receive an email warning from your existing account) then visit https://sucuri.net/ and login to remove the threat or talk to their support.
Users on your wordpress website are a huge security risk. It is important that every user has a complex password with a mix of upper/lower case letters and symbols. It is also a good habit to reset all user passwords each year.