Why 'admin' and a weak password cost a reader 3 days

Why 'admin' and a weak password cost a reader 3 days

A reader's site started showing spam ads he never added. Someone had broken into his dashboard (the control panel where you manage your site).

Two mistakes let them in:
— His username was 'admin', which attackers guess first.
— His password was his dog's name plus '123'.

Cleaning the mess took him 3 days and a lot of stress. Afterwards he fixed the root cause:
— Created a new admin account with a unique name and deleted the old 'admin'.
— Set a 16-character random password stored in a password manager.
— Turned on two-step login (a code from your phone on top of the password).

Since then: zero break-ins in over a year.

In plain words: a unique username and a long random password block almost every automatic attack.