I agree with what's written here - you could get a G4 upgrade and install Leopard, which is a pain but doable, then you could compile Apache, PHP and friends from scratch so they don't have ridiculous numbers of insecurities (I'm looking at you, PHP), but all that work is most likely not worth the effort.
OpenBSD and NetBSD aren't very different, but the fact that OpenBSD only supports New World machines is a problem.
NetBSD newer than NetBSD 5 (which is still patched and updated, to be clear) has issues on large cache G4s. I wish I had more time and a local machine to work on this, but I don't at the moment. But NetBSD 7 will be out shortly, and a G3 wouldn't have any problems with it.
PHP is slow as all heck. Wordpress is the Java and Flash of the blog world. It's a mess. I HIGHLY recommend keeping a staging site and public site both up and running at all times so you can update Wordpress in your staging site whenever there's an update, and so long as it doesn't break anything, update on your live site immediately thereafter. I've known way too many people who just leave their sites running insecure Wordpress because they're afraid an update will break something. But people don't understand computer security - a non-working site is MUCH more desirable than a site controlled by a malicious party.
I also recommend following these simple rules that Wordpress people would never want you to follow:
Never allow uploads to directories which are executable.
Never allow execution in directories to which files can be uploaded.
If you do this, you'll be much more secure than a default Wordpress installation. However, installation and Wordpress-based upgrades won't work. What I do for my clients is I give them two shell scripts to run - one makes the site insecure so they can install a plugin, then the other restores the more secure state.
Also, I don't bother with Wordpress-based upgrades - I do all that from the command line because it's really easy to make a backup of all the files, install the new Wordpress files, the copy the site-specific files in place with a script.
Furthermore, the FTP method of local filesystem access is one of the most asinine, bullshit insecurities EVER. It's so incredibly stupid that one might think that people who make money from phishing are the ones who suggested it. Yes, let's use the database, which is accessible whenever there's a vulnerability, to store the username and password of the owner of the site! Yes, let's leave insecure, plaintext FTP open for regular users (it doesn't matter that access is over localhost - FTP should never be on for regular users).
I should really write up a how-to because Wordpress insecurity really bugs me, in case you can't tell