A while ago I was introduced to a client whose site "was the target of hackers that were deleting all of the content from the CMS". Here's what I discovered: -

A while ago I was introduced to a client whose site "was the target of hackers that were deleting all of the content from the CMS". Here's what I discovered: - the password verification form to access the admin area did the verification check in JavaScript, not on the backend. So if you have JS disabled and click "Submit" on the Admin login form, you're into the admin area. - the "delete" button in the admin area was implemented as an <a href=...> that simply did a GET request (violating the idempotent nature of GET requests). Looking at the logs, it was pretty clear who the "hacker" was: Google. They'd come, follow all of the links, make their way into the admin site, and follow all of the delete content links. I consider the work that the original developers did to be grossly negligent, and I certainly don't fault Google for anything.