Passwords Are Not Your Biggest Security Risk

Password strength gets most of the attention in security advice because it is easy to explain and easy to act on. In practice, most of the incidents we see start somewhere less dramatic: an outdated plugin with a known vulnerability, an old admin account nobody remembered to remove, a backup that was never actually tested.

The unglamorous basics do most of the work

Keeping the platform, plugins and dependencies patched on a set schedule closes the majority of the common entry points automatically, because most exploited vulnerabilities are ones that were already fixed in a later release the site never installed. This is maintenance, not a project — it needs a recurring slot on somebody's calendar, not a one-time audit.

Access control matters more than password complexity

A handful of named admin accounts, each behind a second factor, and removed the day someone leaves the team, does more than requiring sixteen-character passwords on every account. Fewer people with access, and clear accountability for who has it, closes off more realistic risk than password rules alone.

A backup is not a safeguard until it has been restored

Backups fail quietly — a broken export, a storage quota reached months ago, a database dump nobody has actually opened. Test the restore process on a schedule, not just the backup itself. Finding out a backup does not work during an actual incident is the worst possible time to learn that.