Plugin versions visible
Effort to fix: Quick win (under an hour)
Why it matters
Version numbers in asset URLs let attackers find vulnerable plugins instantly. Outdated plugins are the most common way WordPress sites get compromised.
How to fix it
Update every plugin, remove ones you don't use, and strip version query strings from asset URLs.
On WordPress
Enable automatic updates for plugins you trust, delete inactive plugins, and use an optimisation plugin's 'remove query strings' option.