@the_Effekt @atomicpoet @kraft
I admin a few WWW hosting servers.
Many of my customers decided at some stage to use WP (self hosted, wp dot org) as a publishing platform, because of the brand recognition.

The amount of little steps required to get each new WP site up to a basic level of security is almost scary.
Luckily, most of them can be automated.
With cron jobs and .htaccess stanzas, not more plugins!