Lately hackers are less interested in being mischievous and more interested in making fast cash by burning your site in the search engines. Hackers are smart and have alot of time to look for exploits. When they find an exploit they can use it to hack wordpress sites and make alot of money in a few days. To avoid being hacked you should reduce that bullseye on your back which hackers are looking for.
Let me be clear - every situation is different. Your situation may not apply here. I am not claiming that every wordpress site is being hacked as I speak. I do think that if you make your living from a wordpress site, it would probably be smart to minimize hacking risks.
Upgrade Wordpress Version
This is a double edged sword. If you don't upgrade you are exposed to known exploits. If you do upgrade you are exposed to unknown exploits. The lesser evil are the unknown exploits since alot fewer people are targeting them. It sucks, the situation is not going to get better anytime soon.
Need to Know Basis
It was nice to have that wordpress link in the footer to let everyone know who powers your blog. Now it is a bullseye for hackers looking for new targets. Your users don't need to know you use wordpress, remove this beacon for hackers. While you are at it remove the wordpress version info from the code. This is even more dangerous since it tells the hackers exactly which exploits will open your site wide open.
Search and Rename
Taking the "need to know" concept even further, you should go search and rename anything (folders, databases, urls, etc) that starts with "wp-". You may not be able to rename everything on existing blogs. Try your best. The more unique and less cookie cutter your blog is, the harder it will be for hackers to find it and exploit it.
Prevent Access to Wordpress Folders
Once hackers find your blog they will try to get into your folders. Stop them! Using htaccess, only allow your ip address access to wp-admin (which is the most critical folder). Matter of fact be proactive and block any wordpress folders that don't need to be accessible. Also try to minimize access whenever possible, only allow access .html, .css, etc. This will help decrease the chance of hackers from abusing your blog.
Danger Plugins Ahead
By blocking those folders you closed the front door but plugins allow for a huge backdoor. Plugins can be comprised and turned into 8 lane highway of attack. Minimize the plugins you use and remove what you do not need.
Admins are Trouble
Many people have created a master user account for their blog with the username "admin". Don't be like everyone. Kill the admin account and rename it something unique. While you are at it make sure your password is not "password".
Go through your template and start making everything unique. Give your site flavor. Instead of saying "blog comments" rename it to "readers thoughts". Instead of "blog archive" rename it "knowledge database". Again this is about avoiding the cookie cutter approach and minimizing the target on your back. ps - your template may include some files that can be exploited.
Avoid Untrusted Internet Connections
We love blogging 24/7. That free open wifi is very tempting. It is also an unnecessary risk. You can be exposing your username and password. Even if you are at a tradeshow, the hardwired internet kiosks are not secure. Only use internet connections that you fully control. Think I'm paranoid? I know someone that tapped an internet kiosk at an internet conference just to win a bet. What better place to get access to a large volume of powerful websites than an internet conference? Your information can be tapped by recording the data sent and also let us not forget through keystroke tracking
In general if you don't need it, get rid of it. If you need it, minimize it. If you can't minimize it, rename it. Most hack attacks are not custom attacks. It is more efficient & profitable for a hacker to automate attacks using common exploit. Raise your site above the cookie cutter level and avoid those automated attacks. Good luck!