Lets stop this fantasy that Wordpress is secure. Even the updates need updates. Recently we were denied the knowledge of a flaw until weeks after it was patched. Try putting a new Wordpress install into the wild, without any third party prophylactics, and see how venerable it really is. It's not a case of when you are going to get hacked ,it how many times. What a about a quality tested mark for plugins or info on what security tests are done on the plugins in the directory. Relying on last update date isn't enough. This and the Google HTTPS tax have made us abandon Wordpress and go back to html. What about a slimmed down core secure version of the install. #wpbloat