Many of the sites I have built use a plugin called WordFence. This provides a number of methods for protecting your site. It was only when I added this plugin into a site several years ago was I able to see what is really going on. It reveals hackers attempting to get into your site and uses several methods to keep them out.
They have recently carried out a survey with around 870 respondents replying about their experiences of hackers getting into sites. It shows the most common attacks and describes what they are and why hackers use them.
You can read the article here: https://www.wordfence.com/blog/2016/04/hackers-compromised-wordpress-sites/#comment-25733