Default 'admin' username (easy to brute-force)

What it is

One of the administrator accounts uses a predictable username, such as "admin" or the site's domain name — handing an attacker half of the login they need to break in by password-guessing alone.

How to fix it

Create a new administrator account with a unique username, move over anything tied to the old one, then remove the default account.