What goes wrong.
NOT UPDATING
The largest cause of compromise.
REUSED PASSWORDS
A breach elsewhere becomes a breach here.
NO TWO-FACTOR AUTHENTICATION
A stolen password is enough.
NULLED PLUGINS AND THEMES
Injected code, deliberately.
BACKUPS ON THE SAME ACCOUNT
Lost with everything else.
ABANDONED INSTALLATIONS
Old applications nobody remembers, never updated.
DEACTIVATED RATHER THAN DELETED PLUGINS
Files remain and can be exploited.
SHARED ADMIN ACCOUNTS
No attribution, no way to revoke.
ACCESS NOT REMOVED WHEN PEOPLE LEAVE
The most commonly neglected action.
BACKUPS LEFT IN PUBLIC_HTML
Downloadable by anyone.
ASSUMING NOBODY WOULD ATTACK YOU
Attacks are automated and indiscriminate.
