Do you security scan your website before going live on PH? You should!
I recently came across two cases. Case 1. Insecure WordPress website, I was able to add myself as an admin. I immediately reported to the website owner; Case 2. I was able to download the whole source code (except backend) of a ReactJS based website. Test your security setups before you go live. It takes no time to destroy whole your business.