Attackers scan for known plugin versions, weak passwords and forgotten admin users. None of that requires skill, which is why the defence does not either. Run this routine once a month and you will be ahead of most sites on the web.
The checklist
- Updates: core, theme and plugins. Read the changelog for anything marked security.
- Users: delete anyone who has left, demote anyone who does not need admin, and make sure no account is literally named admin.
- Backups: confirm the last backup exists off-server and open one file from it. A backup you have never restored is a hope, not a plan.
- Logins: two-factor on every admin account, and a login limiter or firewall rule in front of wp-login.
- Plugins: deactivate and delete anything unused. Inactive plugins still get exploited.
When something fails
If an update breaks the site, restore the backup and test the update on a staging copy. If you find an unknown admin user, assume compromise: rotate every password, check for unknown files in uploads, and get a scan done before you do anything else.