Exchanges and online sites are risky because you don't own your private keys for your Bitcoins. They may be hacked or just shut off - with your money. Best way is keeping them in a wallet where you control your private keys - and for extra security a hardware wallet.