Hardening, malware, brute-force protection and backups for people who run WordPress without a sysadmin.