Website, DB, & Software Developers

- WordPress sites are easy to identify either by HTML or maybe just "Powered by WordPress" or whatever the hell on the same page.
- The default admin page is <site>/wp-admin (although you could change that)
- The default db prefix is wp
- The default admin user is 'admin', and default password is 'pass', although in our case certainly the password was different (if not the username).

There's more shit along those lines, but it starts there. I suspect they just iterate through it until they find something that works.

Interesting that they didn't kill the whole site (go all destructive on our ass) but just invalidated a few key files so we were obviously hacked. It just so happens my wife's husband (me) could ultimately unravel it, but for the average person with a WordPress site they'd be hosed with no obvious way to fix it.