Part of the problem is that a lot of security advisories basically say "run the latest version".<p>Restricting access with .htaccess is a good idea;
<a href="http://www.themepremium.com/wordpress-security-restrict-wp-content-and-wp-includes-on-wordpress-using-htaccess/" rel="nofollow">http://www.themepremium.com/wordpress-security-restrict-wp-c...</a>
i got hacked by something almost exactly like this like 3 months ago. They uploaded a folder called .files with about 2K html files there to each of my folders.<p>Probably a few million crap files all together. Was a huge pain in the ass to clear all that crap out. After that point I killed all wordpress installs, since it has such a huge target on it's back.