When you're dealing with WordPress, the most important thing is to do their updates very often. WordPress brings out security patches every few days-weeks and you should think about the workflow of doing updates on a regular basis.
The most common vulnerabilities when dealing with web development, are things like
Cross Site Scripting (XSS), wrongly implementing authentication and session management,
Cross-Site Request Forgery (CSRF) and things like this.
You can find more about these topics on the internet, I would suggest you take a look at the top 10 OWASP vulnerabities. OWASP (Open web application security project) has lots of resources available for you to learn about vulnerabilities and how you go over fixing them. This blog articles explains the current top 10.
If you want to learn more about
security by design, which is the topic you should really explore more, you can take a look at the OWASP Security Knowledge Framework. This framework gives you a lot of information and examples about secure programming in several languages.
You should indeed use a SSL certificate, not just because it gives proper information to your users, but because it makes the connection between your website and your users secure. You can read more about SSL and why you need a certificate on this website.
With the server, should I get support and security or some kind of similar service?
Most services that let you rent servers, have a managed solution. They are more expensive but if you are new to security and securing servers, this is your best option when you are in production. Obviously I would recommend you setup your own server and learn about security along the way, but not in production.
To add on to the subject of server security, this answer does a great job at explaining the difference between you as a web developer and system administrators:
But it's a different thing when you rent a virtual server which
provides you with a naked operating system (or not even that) and
expects you to set up everything on your own. In that case you are
responsible for updating everything. When you require this for your
project, you should consider hiring someone who knows how to harden a
server properly, who knows which components need to be updated and how
this is done. But the person you are looking for is not a software
developer. It's a system administrator.