Any website can be hacked. Yours too.

It doesn’t have to be important, well-known, or especially vulnerable. It’s enough that it’s online and has a “door that isn’t properly closed”. Most attacks aren’t personal: they’re automated, massive, launched against thousands of sites at the same time. If something looks like “you can get in here”, they’ll try.

Not long ago, someone called me about a website that kept going down. It was a tense situation: a three-way call, the systems team explaining they were seeing huge traffic spikes and the server couldn’t handle it. I joined with the DevOps team and quickly saw that the xmlrpc.php file was exposed. I asked whether they were actually using it for anything, and since they weren’t, I closed it.

The “visits” didn’t stop, but the server overload did. What was happening was pretty clear: bots running brute-force attacks against that entry point. In other words, automated requests trying username/password combinations via xmlrpc.php, which allows multiple calls in a batch (multicall). Even though every attempt was failing, the sheer volume of requests was enough to bring the server to its knees, creating a denial-of-service effect (DDoS).

Once we blocked access, the bots kept trying for a while, but when they didn’t get a response, they moved on. It wasn’t a targeted attack. It was a mass attack that had detected a common weakness and was simply exploiting it as one more item on a huge list.

Of course, there are other ways to protect yourself. If we had needed to keep that access, a properly configured firewall would have been the right approach. But that wasn’t the case.

These situations happen every day. And they’re not catastrophic mistakes, but they’re not “small things” either. They’re the kind of little details that, if you don’t watch them, end up causing serious problems.

In the end, security isn’t about paranoia or building a bunker. It’s about knowing what you have exposed and checking whether it still makes sense for it to be there.

And now that many attacks aren’t even launched by people anymore, but by systems that learn, scan, and evolve on their own, it makes even more sense not to leave “doors open” by neglect. AI has reached this too. And it’s not always on our side – even though it’s also used to strengthen our defenses.

It’s not about making things impenetrable. It’s about staying vigilant.

If you work with WordPress and you’re not sure which doors you have open, we can look at it together. Sometimes it’s simpler than it looks.

#WORDPRESS #WORDFENCE #XMLRCP #WEBSECURITY #CYBERSECURITY