timmmmyboy

I'd go further and say there needs to be an option for automatic updates. Some hosting provider's installers have it built in, but making WP default to automatically updating core to minor security releases and all plugin updates would be a great start to securing it as a platform.

Any chance of a comment-spam filter being built into core? Akismet is great but has a lot of hurdles for a new user (Activation of the plugin, Registration on Wordpress.com, Registration for API key) and most just don't do it, contributing to the problem.

Cookies for Comments seems to do a really decent job at catching a sizeable portion by dropping a small image cookie to check whether a commenter is an automated bot or not. It's approaches like that I'm interested in. It's not going to catch everything of course, but something is better than complete exposure on a clean install.