Fantastic stats, Cathal (I neglected to stress that initially). Well done.

I’ve updated the stats. The first chart of each pair is the Short-Listed blogs, the second chart is the winners (only). I’ve also included the overall winner in the stats. Workings/raw data now linked above.

You’re right about the version number of course. Hackers send out thousands of requests to sites hoping to get lucky. I routinely get requests targeting Win32 security holes on my servers.
Hiding the version number does have a tiny benefit. Some people use Google to target out of date blogs but really, the only sure fire way of avoiding trouble is by updating as soon as a new version is released.

We don’t have a version number on WordPress.com because the code running there is constantly being worked on and it rarely matches the code running on standalone blogs. Most of the users there won’t care if it’s 2.7 or 2.7.1 anyway, which is how it should be when someone else takes care of things.

Many template designers remove it, so when you use a given template, one isn’t even aware of the verson thing.

Searching does make it easier alright, but to counter that, it does make users, maintainers, and hosts encourage, or even force, upgrading. That’s even easier with 2.7.x as well. That, and script kiddies just fire off thousands of attempts anyway (they don’t particularly care if 950 of them fail).

The ideal solution would be a phone home scenario, where the WordPress installation phones home once a week or month. That way WordPress get their stats, and the version tag can be done away with.

On hiding the WordPress version, I wasn’t aware WordPress ask that it be left in, but I’m sure you’re right. They don’t display it themselves on wordpress.com funnily.

Searching for installations of older versions with known security flaws is one of the ways hackers seek out targets. Displaying it in the meta data makes it far too easy from them.