Security is crucial and all risk elements are mitigated or deactivated; XML-RPC, Heartbeat and the REST API etc! I implement web security on several levels: Brute Force Login: Attacks are defended against by using Loginizer or Wordfence Web Application Firewall: Other hacking attacks are fended off using Block Bad Queries or Wordfence Bad Bots: These are blocked to reduce their impact on server resources and to prevent content scraping etc. The old adage that "An ounce of prevention is better than a pound of cure" still holds true today!