> Turn on auto-update

Having been paid quite well to migrate to and from WordPress, and to help maintain the WP sites of major publishers, I have to say that this is questionable advice. In most cases in my experience, the publisher has employed third-party providers (at huge cost) to develop frameworks and custom plugins that can easily be broken by automatic updates.

Updates need evaluation and testing in staging sites before they can be rolled out. For publishers, the first install of WP is free - everything after that costs plenty.