WordPress is pretty secure by default, but it never hurts to add another layer of protection. But first of all, you want to be certain that your hosting service is secure enough! If it's not, switch over to a different one. Hostgator is a really great webhoster with powerful security. Now for WordPress security plug-ins, I use Better WP Security. It gives you a list of possible security breaches and will fix them for you upon your command. There's a built-in blacklisting system and firewall for spammers or possible hackers.