Hello everyone I will help a friend to test the security behind their WordPress site,

I thought about to start to do a scan with Burpsuite and also WPScan, I also believe I will find a acunetix useful.

When I read a lot about the way people is penetration-testing wp-sites a lot of people is using sql injection on older versions of WP, though I believe this site is pretty new. Also a lot people is using brute-forcing though that builds on you have got a good word-list.

What is your suggestions?

Notice also I am not interested in break their Webserver in a any way.

Thank you in advance