install security audit log, updates notifier; disable html in comments
add wordfence security