WordPress is a very popular content management system for community news/info sites. But since it's free and open source, it's also a popular target for hackers. Here are some common WordPress security myths, and a checklist for securing your WordPress installation.

WordPress security expert Anders Vinther published a list of 10 common myths about WordPress security, with links to more details:

1. WordPress is not secure.
2. Nobody wants to hack my blog.
3. My WordPress site is 100% secure.
4. I only use themes and plugins from wordpress.org so they are secure.
5. Updating WordPress whenever I log in is cool.
6. Once my WordPress site is setup my job is finished.
7. I'll just install xyz plugin and that'll take care of security for me.
8. If I disable a plugin or theme, there is no risk.
9. If my site is compromised I will quickly find out.
10. My password is good enough.

Have you caught yourself saying or believing any of these things about your community site? If so (or even if not), you might want to download Vinther's free WordPress security checklist.

Working through the steps in this checklist takes about five hours total -- but that time is well worth the effort if you want to protect your site and make sure it stays protected. The tasks don't all have to be completed in one sitting; you can do them over a few days if you like.