I appreciate the security tips, and have implemented four of them (working on the fifth).

The htaccess advice is incomplete, and causes the admin to be locked out (when stored in /wp-admin/ of course). Here is what my ISP says:

"AuthUserFile /dev/null
AuthGroupFile /dev/null
AuthName "Access Control"
AuthType Basic

are only needed if you restrict access to the particular subdirectory by password protection. Since there is no user, group or path to a .htpasswd file the whole .htacess file fails. As soon as you allow 'allow from all' it no longer attempts to authenticate the access to the directory thus allowing the directory to show correctly. "

So all that is needed is:

order deny,allow
deny from all
allow from XXX.XXX.XXX.XXX