Notes from the work — hosting, security, and the things clients keep running into.
It is almost never a clever attack. It is an abandoned plugin, a reused password, and a backup nobody tested.
