The site has been live for a few weeks, it gets a handful of visitors a day, and yet failed-login notifications pile up overnight. Most owners seeing this for the first time think “what could anyone possibly want from us”. The instinct is understandable, but it does not match how these attempts actually work.
Nobody is choosing you
Attacks where a person sits down and decides to go after a particular company are a story about banks and large enterprises. Attempts arriving at a small site are almost entirely produced by automated programs. A program walks a list of addresses and repeats the same checks mechanically; there is no step in it where anyone looks up your revenue or your traffic.
Because sweeping costs almost nothing, there is no reason to narrow the list either. If checking ten thousand addresses costs roughly what checking ten does, the rational choice for the program is to check all of them. Being small is a condition of your defence, not an exemption from it.
Often it is not your data they want
Here is the second reason the instinct misleads. A compromised small site is usually valuable not for the information it holds but for the resources it has.
The quietness of it is the awkward part. The site loads normally, the admin screens look the same, and then one day search results contain pages you never wrote, or all your outgoing mail starts being filed as spam. The later you notice, the more expensive the unwinding.
This is not a weakness in WordPress
The question that always follows is whether WordPress is simply risky. It is not. Core WordPress is among the most heavily reviewed web software in the world, and confirmed security issues get a release quickly. Automated attempts aim at WordPress because it is everywhere, not because it is fragile — one set of checks covers an enormous number of addresses.
So the cause of real incidents is almost never the tool; it is neglect. Core left un-updated after a fix shipped, a plugin whose development stopped, an administrator account created long ago and forgotten. This series works through that neglect one layer at a time.
Three things you can check today
This is the first part, so here are only checks that need no tooling. First, open your list of users and look for accounts you do not recognise or no longer use. Second, count how many pending plugin updates have stacked up. Third, search site:yourdomain.com and confirm there are no indexed pages you never created.
All three clean is a good starting position. Any one of them failing is the first thing this series will help you fix. For the wider subject, see the security archive; if you would rather have the outside view watched continuously, see InfraGuard monitoring.
Next part
The first door to close is the login. The next part covers what a single properly made administrator account prevents — username, password and two-factor, in that order.