Correct server setup for Wordpress

Hello folks,

I need your experience to setup the best environment for my Wordpress installation in regard to reliability and security. Recently we get 502 errors so that we need to reset the droplets to get back the website.

Situation:

• Currently, we have only 4 admins without real visitors working on Wordpress to prepare the website
• After checking the traffic, I realized different IPs requesting non existing URLs which leads them to 404

Current Setup:

• 1GB Memory, 1vCPU, 25GB SDD (5 Dollar package)
• No additional services activated such as Volumes, Backups etc.
• Firewall deactivated
• Ubuntu 18.04
• php 7.2.10, MySQL 5.7.24
• /etc/php/7.2/apache2/php.ini I set the memory limit to 512M
• In Wordpress config I set memory limit to 512M
• php Post max size 16MP
• php time limit 60sec
• Heavy plugins installed: Woocommerce, Dokan, Yoast, WP Rocket, KingComposer and Redux
• Free version of Malcare Wordpress plugin to make use of their firewall (don’t know if it really works)

Can you help me out to have a proper setup, please? Based on the statistic graph the memory is often at 90% (apache2 up to 90%, mysqld up to 20/30%) although we don’t have high traffic and visitors. I’m also not sure what memory limit to set within the php.ini file (1Gb because I have 1GB memory server?). I hope you realize that I am a beginner, so every suggestion and tutorial is appreciated.

Thank you.