In reply to Matthew Miller.

There are more potential vectors of attack than just the front door. In this case, they exploited a vulnerability in an outdated plugin to deface a site.

Having a solid password is great first step, but keeping everything up-to-date should always be the next step.