WordPress version exposed
Effort to fix: Quick win (under an hour)
Why it matters
Advertising the exact core version tells attackers which known vulnerabilities to try.
How to fix it
Keep WordPress core updated, then hide the version: remove the generator meta tag and version query strings from core assets.
On WordPress
Add remove_action('wp_head', 'wp_generator'); to a small must-use plugin (or use a security plugin option), and delete readme.html.