That assumes the key is actually on the server.
I assume even if it isn't, attacker could deface the website so heavily everyone would know they win.
alt Hacker News
I assume even if it isn't, attacker could deface the website so heavily everyone would know they win.