Wherever possible, outsource. wordpress.com if you can deal with their limited selection of themes and plugins, any number of third-party outsourcers whose brea

Wherever possible, outsource. wordpress.com if you can deal with their limited selection of themes and plugins, any number of third-party outsourcers whose bread and butter is WordPress if you need your own theming. (I maintain three WP myself by hand, but that's me being a control addict.) WP's core security is vastly better these days. So instead you'll fall prey to a cruddy plugin or theme ... especially the latter, being PHP written by designers. (Nothing against good designers, but design thinking is not security thinking.) A really useful shortcut: put /wp-admin/ behind Apache basic auth. This stops most doorknob-rattling automated 'sploits in their tracks. (Main barrier to doing this in practice is that nontechnical editorial people tend to get confused by two layers of password.)