Yesterday my WordPress website got hacked. I thought I had done all necessary things to make it secure. One of my colleagues said that with Greasemonkey we can easily hack sites. Is it true? How can I protect my site secure against it?
The good news is that none of these changes will affect the contents on the server side, or the contents for other users. So if you rely on the server for your validation/verification/signing in/e.t.c., then you have nothing to worry about. If, however, you rely on the client-side code to provide input validation and other kinds of restrictions, then you have deeper problems than GreaseMonkey. Almost all modern browsers contain features to allow the modification of client-side contents, they're mostly called Developer Tools.
My advice to you is to get a competent individual to assess the security situation of your website, and to help you protect it from future attacks.
Potential Attack Vectors
Last but not least, let me echo the advice given by @Adnan:
If you don't know "what" happened, you can't prevent it from happening again. In case you don't know everything about securing a website and server, time has now come to hire a professional...
There's a few things to consider. With Greasemonkey (GM), users (client-side) need to accept the installation of a GM script or write a GM script themselves. Since, the client user has full access to any page the server can download (with that user's authorizations and authentication), the GM script can modify this content or use the content in combination with other pages from the same server or other unrelated servers to present the web page data in any way desired. An example would be a real estate site (RES) that has sale homes' details and pictures on different pages. The RES pages can be acquired with a GM script and put together as one page. Furthermore, the square footage (or square meters) or tax information can be pulled from the Assessor's website and mashed together as one page with the RES info. Alone, this is not sinister. However, if you've blocked right click or have block protected content on your page, a clever script writer may be able to bypass the protections (as is possible by simply adjusting the elements in the HTML via developer tools).
Here's where there can be some more issues. A lot of websites do not protect their assets and APIs very well. By leaving permissions open to more assets, the script writer may be able to reverse engineer the page's scripts and pull more assets. With the APIs, this is another story. By not restricting APIs on the site, a GM script can make extra requests to the APIs. For example, say the username was part of an API. The script could change the hard-coded username and put another username in the script that would pull the info of someone else. Maybe the site sells some sort of service for searching and the user can only do a search by geographical locations or interests but not both. If the API is not properly locked down, this search can be extended to both with a GM script.
As for brute force attacks, one browser alone is probably not a great army. If the desire is to make attacks or even hit the site many times to try passwords, there are many other tools that are suitable for attacking.
So is Greasemonkey a cracker's tool? Yes, but it only allows the client to see what is already there due to bad website security. If there is a GM script installed without a current user's knowledge, the script can spy on current user's actions by trapping passwords or other information from pages that are familiar to the script.
Again, the advice given by @Adnan: