Hacked WordPress sites are being defended by their attackers