UPDATE 4 – In case you’re looking for the Cliffs Notes on WordPress security – or, what I learned from restoring a site:
Step 1: until you’re off of the default settings, assume that every hacker is circling like a herd of sharks. You might think that a hacker cares about how popular your site is, or how many posts you have. I’m here to say if it can happen to me, it can happen to you too. The way these things are written, they’re looking for backdoors, workarounds, and any other vulnerability they know about. Your Alexa ranking has nothing to do with the bot’s decision-making process.
Step 2: see what your viewers see. I didn’t get an e-mail alert or a notice that something was awry; I noticed a link leading to a pill site, which led me down this whole rabbit hole.