Security is layered. Sites I manage run on hardened hosting (Pressable or Kinsta), receive plugin and core updates within days of release, and have firewall and malware scanning enabled. I monitor known vulnerabilities and apply mitigations even when no official patch exists yet. Daily off-site backups mean we can roll back quickly if something does go wrong.