Why Everything You Thought You Knew About Protecting Your Site Is Changing
Part 4 of 4 — Iceberg’s “Websites in the AI Era” Series
This is the final post in Iceberg’s four-part “Websites in the AI Era” series. In Part 3, we introduced the threat: AI tools can now find and exploit WordPress vulnerabilities for under $50 a run, with no security expertise required. Part 4 is about what comes next, and what every WordPress site owner needs to do differently because of it.
All four predictions in this article come from a developer at Iceberg, Ega, whose focus across this series has been the security implications of increasingly capable AI models. These aren’t abstract concerns. They’re specific, practical changes to how WordPress sites need to be protected and monitored.
Ega: The Death of the Password-Only Login
Relying on simple passwords will be universally recognized as a critical vulnerability in the face of automated credential stuffing.
For WordPress: 2FA everywhere especially for admin accounts. Non‑default login URL. XML‑RPC off. Login throttling. No file editing. No PHP in uploads. Cloudflare in front.
“Mitigations whose security value comes primarily from friction rather than hard barriers may become considerably weaker against model-assisted adversaries.”
So, while a non-default login URL will hold against dumb bot and human. Only real barriers like 2FA, WAFs, file permissions, signed updates will hold.
Let’s translate the key terms here, because they’re important. “Credential stuffing” is an automated attack where software tries thousands of username and password combinations in rapid succession. This is the digital equivalent of someone trying every key on a giant keyring until one works. “2FA” stands for two-factor authentication. Think of it like needing both your house key and a separate security code to get inside. Even if an attacker gets your password, they can’t log in without that second factor.
“XML-RPC” is an older WordPress feature that most sites don’t need anymore, but that attackers can use as a back door if it’s left active. A “WAF” (web application firewall) is a security filter that stands between your website and the internet, blocking suspicious traffic before it even reaches your site.
The Anthropic quote Ega cites is the key insight: security measures that work because they’re slightly annoying to humans are becoming ineffective against AI-assisted attacks that can work through that friction automatically. Only hard technical barriers hold.
What this means for your business: If your WordPress admin accounts don’t have 2FA enabled, turn it on today. If you’re not sure whether XML-RPC is active on your site, ask your developer. These aren’t advanced configurations — they’re baseline protections that are now mandatory, not optional.
Friction-Based Security Is Weakening
“Mitigations whose security value comes primarily from friction rather than hard barriers may become considerably weaker against model-assisted adversaries.” — Claude Mythos Preview
This point flows directly from Ega’s password prediction and deserves its own space. The security approach that most small websites have relied on (obscurity, mild inconvenience, hoping not to be noticed) is being eroded by AI tools that are patient, fast, and cheap to run repeatedly.
Here’s the practical difference. A CAPTCHA (the “prove you’re not a robot” puzzle), a non-standard login page URL, or a long password requirement: these all work by making life inconvenient for human attackers. An AI-assisted attack doesn’t get tired or discouraged. It can iterate through these obstacles systematically without slowing down.
Security needs to shift from “make it hard for humans” to “build walls that AI-assisted tools cannot simply compute past.” Web application firewalls, verified software updates, and strict file permissions are the kinds of protections that belong in that category.
What this means for your business: Review your security setup with this question in mind: does this protection depend on an attacker giving up, or does it actually block the action? If it’s the former, it needs to be rethought.
Backups Are Your Last Real Safety Net
Off‑site snapshots of both files and database is a necessity not because it’s neat, but because rollback windows are shrinking. Sites that can roll back to yesterday will survive; sites that can only roll back to last month won’t.
Ega’s framing here is worth sitting with: backups aren’t a housekeeping task you do because it’s tidy. A backup is what separates a bad day from a truly catastrophic one.
Your WordPress website is made up of two parts: your files (the code, images, and design) and your database (the content, posts, and customer records). A complete backup captures both. An “off-site” backup means it’s stored somewhere other than your website’s own server, because if the server is compromised, a backup stored on that same server is compromised too.
As AI tools shorten the time between vulnerability and active exploit, the window for catching an attack before significant damage is done shrinks with it. A site that can restore to yesterday’s clean state recovers in hours. A site whose last backup is three weeks old may not recover cleanly at all.
What this means for your business: Check three things right now: when your last backup ran, where it’s stored, and whether it includes both your files and your database. If you’re not sure of all three, that’s the first priority. Our Hosting & Maintenance service includes regular off-site backups as standard.
Ega: Monitoring Becomes the Only Early Warning System That Works
Uptime monitoring, log review, form submission testing. These are the signals that tell you something is wrong before your customers do.
“A customer told us the checkout page looked wrong.”“A client told us their blog posts were suddenly about crypto scams.”
“A client told us their blog posts were suddenly about crypto scams.”
“We only realised something was wrong when a customer said our site kept redirecting them to a random store.”
“We only realised something was wrong when a customer said our site kept redirecting them to a random store.”
By then, the attacker has already done their work quietly in the background. Search rankings tanked, Google has flagged it, site and company reputation hurt, and days of professional cleanup bill ahead. That means the attack hurt both revenue and trust.
The three customer quotes in Ega’s prediction are the most quietly alarming thing in this entire series. In each case, the business owner didn’t discover the breach, a customer did. That means the attacker had already finished their work. Content replaced. Redirects installed. Malware embedded.
By the time the business knew, Google had likely already started penalizing the site for serving harmful content, and customers had already had an experience they might not report and might not return from. The cleanup bill is real. The harder loss is the customers who had a bad experience, didn’t bother to say anything, and just didn’t come back.
“Uptime monitoring” alerts you the moment your site goes down. “File integrity monitoring” watches your website’s files and sends an alert if anything is changed without your knowledge. Regularly testing your key pages, contact forms, checkout pages, and login pages catches issues before a customer does. Monitoring creates a detection layer between the attack and the customer notification.
What this means for your business: If you’re relying on customers to tell you when something is wrong with your site, you don’t have a monitoring plan. This is something we handle directly for clients on our Hosting & Maintenance plan. It’s the difference between catching a problem in hours versus finding out from a customer review.
The Bigger Picture Across All Four Predictions
Ega’s four predictions share a single underlying logic: the threat landscape has accelerated, and the defenses most WordPress sites rely on haven’t kept pace. The response isn’t panic. It’s specificity. Enable 2FA. Test your backups. Set up monitoring. Shrink your plugin footprint. None of these are complicated. They’re just the ones that separate the sites that recover quickly from the sites that don’t recover at all.
This Has Been Iceberg’s “Websites in the AI Era” Series
Across four posts, the Iceberg team has shared what we’re watching, what we’re building, and what we’re warning about. The thread running through all of it is the same: AI isn’t just changing what websites can do. It’s changing what they need to do to stay visible, trustworthy, and secure.
If any part of this series made you look at your own site differently, that’s a conversation worth having.
Talk to a Real Human About Your Website
We answer the phone. We review your site. We tell you what we actually find. Our Hosting & Maintenance includes the monitoring, backups, and fast patching that this new environment demands. If you want a team that’s keeping up with what’s coming and not just what’s worked before, we’d love to work with you! Give us a call at 763-350-8762 – we are Website Developers Who Answer the Phone!®
