I'm new to Wordpress (I used to do some very Web 1.0 design work when I was a teenager in the 90s) and I just encountered something I'm truly baffled by.
I started a new account at Dreamhost with a new domain, chose the option to pre-install Wordpress, and then out of confusion unchecked Dreamhost's option that says something along the lines of "Uncheck this box if you would like to register the domain later" because I was unclear about some unrelated things.
Later on I registered the domain. Then, out of curiousity, I pointed a browser to it just to see what the default parked page looks like. I was shocked to find that there, viewable and accessible to anyone, was a page of configuration options where user passwords could be set for the first time and other options chosen. I was logged on to Dreamhost at the time so I checked both after logging out and on another machine with a different ip and it was the same. This seems insane to me; anyone could have done anything there. I deleted that installation, reinstalled, and it went to requiring you go to sitename.com/wp-login.php like normal. What happened?