In reply to Eric.

Not necessarily,

Guess I will break this into multiple parts.

Hackers work in a variety of ways and the tools available to them are actually considerably more sophisticated than Wordpress or Joomla or Magento etc. Alot of hackers are literally "top notch" programmers which is in one way why I never understood their activities. Some look to benefit from what can be stolen and sold. Some just enjoy it. Some work for companies. Some are not even programmers at all but just able to use the myriads of tools that exist.

With Wordpress I am 99.9% sure a database exists of "known WP sites". Whether by "bots" or search engines usage and other means.

There are many many tools both created be hackers and industry itself where the applications sole purpose is to identify security flaws. Hewlett Packards "Fortify" application for Web/Net use tries to find security holes. Its state of the art. Its $45,000 or so.

Optimally any theme or plugin before public distribution would be run against such a tool and perhaps even a few others. That should be part of the "mantra" at Joomla or WP or Magento etc. But logistically thats overhead. It doesnt mean things even get caught necessarily. But its "something".

As I said, I'd have to believe with a application as widely used as WP is that hackers have database(s) of known sites to target. So many current sites are already in the "targets" reticule.

However, new sites popping up may not yet be.

So the question comes to mind of "How do they find them?"

Signatures, a footprint.

Those can be anything that comes back to the browser as anything coming back to the browser can be viewed. I can write a program in less than 5 minutes that will show me all data from HTML, to CSS to Javascript, URL data and POST data in Visual Studio using Microsoft's Browser Object or Firefoxes Mozilla Dynamic Link Libraries or Chromes.

This is one of the reasons for a "SSL Everything Push". That doesnt stop a smart programmer from getting at anything really. But, what it DOES do is begin the technology unto a path where a USER readable form of web data and a SERVER readable form of web data CAN now enjoy separation. So down the pike 10 years what you or I code .vs. the data the browser actually renders from are QUITE different ensuring security. The cloud also has its part in that role but to explain how and what is coming is WAY beyond the scope of this blog.

A signature can be comments, javascript, css, anything coming out of the server on HTTP transport.

For example, this little tidbit from our framework in process of coding:

function tsk_DoHeadFilters(){
add_filter('the_generator', 'tsk_RemoveWpVersion');
}

function tsk_RemoveWpVersion() {
return '';
}

This will change the meta generator tag which normally says Wordpress and the version.

I removed a bunch of stuff but just these few lines get rid a a very common signature used to identify what is running the site. Just replace what in the content="TSK'.TSK_EDITION. with whatever you like content="SquirrelsGoneWild" for example.

Point being this:

If you were in a battle do you run into the middle of the battlefield trusting that your armor will protect you against everything? Or do you use the battlefield to the best of your ability to stay out of the line of fire?

Thats what signatures/footprint is about.