Preventing reinfection after WordPress hack (AMP spam injection)

Hi Wordfence team,

I’m considering upgrading to Wordfence Premium for my website that was recently hacked.

The site had spam/AMP URLs injected, and we’ve already removed the malicious files and submitted the cleanup to Google Search Console. It’s currently in the recovery stage.

Before upgrading, I just want to confirm a few things:

• Can Wordfence detect and clean any hidden backdoors or reinfection scripts that might still exist?
• Will the firewall help prevent similar attacks (like file injection or spam URLs) from happening again?
• Are there any recommended steps after installing Wordfence to fully secure the site?

My main concern is making sure the issue won’t happen again after cleanup.

Thanks in advance for your advice!