FIRST: Make sure you have the most updated version of WordPress, its entire suite of plugins and ditto for CiviCRM. Second, and perhaps before you execute the aforementioned, make sure you have a backup or your host does daily as it sounds like you are not running bare blades.
If you have cPanel, simply set the cron up as follows:
wget -O - -q -t 1 'https://www.NAME OF WEBSITE/wp-content/plugins/civicrm/civicrm/bin/cron.php?name=USERNAME&pass=PASSWORD&key=SITEKEY''
I want to belabor a couple of things, my site is set up WITHOUT a WP directory, so thus, direct. Second, at the end there are TWO ' meaning '' not ". I have mine run every 15 minutes, but you can set the time to whatever I suppose. Next, set up a user in the User section of WordPress as SUBSCRIBER. That way if it gets hijacked --- the UN/PW --- it is only a subscriber. Spin up the user in CiviCRM and voila! Remember, the username may be an email or a user name depending upon how you create it in WORDPRESS. Cook up a HUGE password. Usually, WordPress will recommend and if you run Chrome it will as well. I generally make a note of it and save it accordingly. Finally, if you are using MFA --- sends you a text or code or whatever --- a few other steps.
Finally, protect everything with WordFence. It is free (do not pay for the paid version) and the best darn (would use a different word but don't want to get banned) security plugin I have found based on almost two decades. Clear cache if running a CDN, etc.
I'm not in here a lot, but if you are within the US (because calls are free on Google Voice) I'll walk you through it. Took me 4 years to figure it out and is one of the BIGGEST DRAWBACKS OF CIVICRM I have found as the novice is left without clear and concise spelling out. I'll probably write an article about it next week on my site because it was literally like the Red Sea parting for me!
Edit - you can add dev/null if you don't want the emails sent to you. If you want help let me know. And to check to make sure you have the path correct copy the https through the last character of the site key and simply toss it up in your browser and hit enter. If it only returns white, confirm that your Scheduled Jobs ticked off and grab a beer - or coffee depending upon persuasion!