Most WordPress security advice focuses on the wrong things. This covers the real attack vectors we see most often when cleaning up compromised sites and the specific changes that actually reduce risk.