I've installed Wordfence on several sites to "test drive" it and compare to better-WP-security and login-limits. Interesting that within an hour or so, I received an email telling me that the php file associated with the Hello Dolly plugin (that was inactivated but still present) had reported as a "critical" attack possibility. This raises the question about "false positives" - or are core inclusions a bigger issue than we've always thought they were?