Whenever I get the dreaded message that someone’s site is hacked, I thank my security plugin. 🙂 Most hosts take care of security as well of course, but in the end, it’s our own responsibility to make sure their efforts have effect.
The number of WordPress plugins I use is not big, although I don’t meet the recommended maximum of 5. Most of these plugins are free versions, but the one I am paying for – and with love – is SolidWP (formerly iThemes).