Well a good step is to never give your clients full admin permissions in WP so that they can install plugins or mess with theme files.