Wordpress Security

One of my wordpress blogs was hacked last week - some swine had stuffed some iffy links into the theme’s header.php file.So it’s got me thinking what sensible precautions should be taken to protect a wordpress installation. Here are some things to consider/action:

1. Keep on an up-to-date release of wordpress and make yourself aware of patches by subscribing to the wordpress development blog.
2. Keep your plugins up-to-date too. Wordpress 2.5 offer automatic plugin upgrades.
3. Ensure you backup your wordpress data. I mentioned a backup plugin a while back.
4. Get your themes from trusted sources.
5. Matt Cutts offers 3 security tips here. Additionally, I think it’s okay to create a empty index.html in your /themes folder to stop snoopers seeing what’s in your theme folder.
6. Use strong passwords and change regularly.

Additionally you can modify your .htaccess file to restrict various actions, though some people may not have the confidence to change that file.

What other precautions do you take to secure your wordpress installation?