In reply to djsteveb.

my 2 cents about "security" plugins and plugin security.

Security plugins usually do not worth the electricity they use. They are more likely to harm your server than a security breach (maybe I am exaggerating a little....). Login limiter is an easy show case as it is very obvious the harm it does - for every failed login attempt it has to do a write to the DB which is the most expensive operation you can do. And then some of them go on and keep wasting resources by sending e-mals to you as if there is much you can do (you obviously can, but most admins can't)

If you have your own server you can try to integrate wordpress with fail2ban. There is a plugin for that but it still requires some server configuration, but it is always true that if you can block access in the web server config it is the better options, as all brute force protection can not protect you against a lucky first guess.

As for securing plugins - just disable "direct" access to any php file under the wp-content directory. Plugins and themes that fail in that enviroment should not be used, as simple as that.

Object caching can indirectly help as well by reducing the number of reads from the DB when you are being hammered on specific set of login names.

Last thing to do is prevent any script execution on the uploads directory.
This way even if you are hacked, which usually results in files added to the uploads directory, the server will not waste CPU on running malicious scripts.and be used as a spam getway (this of course assumes that all the other directories are RO)

So why isn't this all in core? I think that the default .htaccess can be made more secure but most of the items here are either specific to apache or require a control over the server resources, something that you don't have at a shared hosting.