Why “updated WordPress” is not the same as “secure WordPress”

Clicking “update” on the WordPress dashboard covers about 40% of your real attack surface. Here’s the other 60%.