Security basics · Part 1 of 3 · 6 min read
Check account exposure, review eight common gaps, and use two short assessments to choose your next fixes.
There is no hoodie. There is no countdown timer. There is an automated scanner working through a list of every site on the internet, looking for a version number it already knows how to open. Most compromises are not clever: they are patient, and they are cheap.
WordPress runs a very large share of the web, and that very large install base makes vulnerable installations an attractive target for broad automated scanning, not because it is bad software, but because a single working exploit pays off across millions of sites at once. Attackers scan for versions, not for you.
Outdated and abandoned plugins and themes are a recurring compromise route. Someone installed a slider in 2019, the author moved on, and the code is still running with full access to your database. Nobody removed it because nobody remembers it exists.
A site launches, the invoice is paid, and the deployment enters a decade of silence. No patch cadence, no monitoring, no alerting, no backup anyone has ever restored. The first person to notice something is wrong is a customer, or a journalist.
Second factors are one of the highest-value controls against password-based account takeover: someone logging in as you with a password they bought. “Later” has been the answer for three years, and the login page does not care about your roadmap.
Reuse turns any breach anywhere into a breach of yours. A forum you forgot about in 2016 leaks, and that same password walks into your email, your bank, your CMS admin. Attackers do not guess: they replay.
Shared logins in a spreadsheet, a pinned chat message, or a shared drive folder called Accesos. It is convenient, it is searchable, and it is one compromised laptop away from being the attacker’s index of your entire organization.
The device holding your email, your authenticator, and your session cookies has no biometrics, no passkeys, and a four-digit code shoulder-surfed at a café. Mobile is where your identity lives now. It deserves the same locks as the front door.
Ex-employees, ex-vendors, ex-interns: still holding admin accounts, still on the shared inbox, still in the deploy pipeline. Offboarding is a security control, and in most organizations it is a Slack message that nobody actioned.
None of this is exotic. Many of these gaps are routine and inexpensive to start fixing, which is exactly why they keep working as an entry point. Others, like replacing a legacy platform or migrating a vendor, are planned work rather than an afternoon. What they have in common is that they are known, and that being busy is how they stay open. Several of them (numbers three, four, five and eight above) are not code at all: they are settings in a Microsoft 365 or Google Workspace admin console that nobody has opened since setup. The ten that matter, with the exact paths, are here →
Many addresses appear in known breaches, usually because a service was compromised rather than the account holder: their address, password hash and whatever else went into a file that has been circulating ever since.
Put an email address into the panel. We check it against Have I Been Pwned, the public breach index maintained by security researcher Troy Hunt, and show you exactly what turned up.
honestly: the point of this tool is not the result. It is the moment right after, when you realize a password you still use was in one of these.
Yours, or your organization’s shared inbox. Both are worth knowing.
Privacy: the address is checked against Have I Been Pwned through our own server. We do not save it in application storage or analytics, and we do not add it to any list. Being straight with you about the limit: it does travel through our server to HIBP, and transient operational logs may exist somewhere in that delivery chain, which is not something we can promise away.
Breach data powered by Have I Been Pwned.
Use these assessments to identify questions and next steps, not to certify security. Answers stay in your browser. Analytics receives derived results such as score, tier, percentage, and weakest category; it does not receive the individual answers. Any optional email report is a separate, explicit choice.
Answer as your honest self, not your aspirational self. The score is worthless if you grade on intentions.
Written for decision-makers, not engineers. “Not sure” is a legitimate and extremely informative answer: in most organizations, uncertainty is the actual finding.
Fourteen printable pages you can put on a table with your team and fill in with a pen. No login, no download form, no follow-up sequence: it is yours to copy, adapt, and hand to whoever runs operations. If your ops manager works through it end to end, you will know more about your own organization than most assessments would tell you.
Edited September 29, 2026. Research and source dates are retained; this edit is not a fresh review of every statistic or legal development.