Secure
Core, themes, plugins, and dependencies kept current, because most compromises exploit known vulnerabilities in outdated versions rather than anything novel. Backups run on a schedule and get restored periodically — an untested backup is a belief, not a safeguard.