Most site takeovers do not start with a clever exploit. They start with a guessable admin login. Here is the short checklist that actually closes the door.
Jstrange
