Are you sure the hack is happening by your login being intercepted?
If so, SSL would help, but you do not need to purchase an SSL certificate for your website. The SSL that covers cPanel is separate from the one for your website - the SSL for cPanel will usually be a self-signed certificate generated by the server, that you access by logging into cPanel on port 2083 instead of port 2082.
That said, unless someone has access to your home internet connection, the likelihood that the hack is coming from someone intercepting your login is pretty low.
If you have confirmation that the attacker is logging into your cPanel, then they may be brute-forcing your password, or you may be re-using a password from some other service that has had their login/password database compromised. (See haveibeenpwned.com to see if your email address is in any known data breaches from major companies.) So your best bet here would be to use a STRONG password, that you do not use anywhere else.
There are also other ways an attacker can get in without ever logging into your cPanel. If your website has been defaced or had malicious content uploaded, it is fairly likely that you fell victim to this type of attack. If you use a content management system like Wordpress or Joomla, older versions of these (and sometimes their plugins) can have known vulnerabilities that attackers can exploit to upload malicious files without ever having to figure out your password. So keeping your website software up-to-date is important. If you have been hacked, it is also important to change the password for the MySQL user that your software package uses, since this is often stored in plain text (eg in wp-config.php) so if they have access to your files, that password should be considered compromised.
Last, look under "FTP accounts" in cPanel, and delete any old FTP accounts that you're not using, this is another easy way for attackers to get in and upload bad things.