In reply to mark k..

@Mark K

Also regarding your reply to Tim.

It's not an either or.

So what if most of the hacks are due to them running insecure or outdated plugins.

That doesn't invalidate the insecurity from using old unpatched PHP versions. PHP versions that don't include modern password hashing for example.

Security is always in-depth.

Run the latest secure stable supported stack, secure and harden at a server level, security at an application level, security at a behavioural level.

Do you really want to be working with clients that don't understand that? If things go wrong, who is the sh@+ gonna blow back on?