First step would be disabling wp-login functionality and putting CMS on an isolated cluster that sits behind VPN. Looks like it's wide-open; that should tell y

First step would be disabling wp-login functionality and putting CMS on an isolated cluster that sits behind VPN. Looks like it's wide-open; that should tell you all you need to know.