Plugin safety

Hi All!

I am new to WordPress. I have a webmaster that developed it but she is not technical so I have been tasked to get the site ready for launch.

Security is a significant concern for me. I have been working on hardening the site. I did some research and tried two plugins for security: Wordfence and iTheme Security. Wordfence broke the site (I tested it locally, of course) whereas Itheme seems to work fine.

My boss asked me how I came by iTheme and I said I did some research and it has over 800,000 installs. He expressed a concern that there are plugins that send information back channel to who-knows-where and that got me concerned.

So, here’s my question. How do I know if a particular plugin from ww.wp.xz.cn is safe? To me, it’s a black box.

As an additional question: Does anyone have experience with iThemes? What do you think? How long have you used it? Is there something better?

Thanks