Thanks. I ended up using wordfence (http://wordpress.org/plugins/wordfence/) and found something on one of the sites. doh
Just sorted out the firewall so the only things externally available are http, dns, mail and ssh. I’ll look at the http headers now. Can’t change the cookies though, as they are used to store cart information used by jscript - at least that is my understanding.