kool_duck Wrote: I don't think that you need a security plugin. In fact, the plugin can increase the attack surface itself.
Nothing is wrong with using a well known plugin for security tweaks ect. iTheme Security is one of those plugins that are worth it. We also offer this plugin free of charge with anyone who hosts a WordPress site with us. Along with activly patching WordPress vulnerabilities on the backed without any user input.