Based on the passion engendered with the responses to this question. It appears that the answer is a resounding "Nothing!" or "leave it to plugin developers to handle, WP is already secure enough"...
So I guess I'm way off base with the question? It appears to have stirred a hornet's nest and that was not the intent. Never the less, here's the real world outcome...
I just got an email from one of my customers who had 12 of his sites hacked because an attacker cracked his password. His comments opened my eyes a bit to the possibilities for some very easy options that could be added to the WordPress core in order to help make WP sites less prone to these kinds of attacks.
The simplest thing a user can do is to change the default username. I would guess that over 90% of live WP sites have an "admin" user profile that may or may not be used, but that obviously has full rights and permissions. An attacker's job is already half done!
But WP core could be enhanced with some very simple security options too. How hard would it be to add...
- Failed login attempts lockout (user defined setting)
- Regulate the time between failed login attempts (user defined setting in seconds)
- IP range restriction (set a list of IPs from which logins are accepted)
These are just a few things off the top of my head. I'm sure you guys have some better options too.
And the point of my question is not what "users" should do to enhance security, that's a whole other question. I'm asking what steps WP could take to provide some OPTIONS, nothing mandatory, but things that plugin developers are currently having to fill gaps where stuff should be part of every default WP installation (IMHO).
Are any of these kinds of enhancements planned for near term WP releases?