[NEWS] Wordpress blogs under attack - Beware!

kvmcable said:

It depends on your business plan. Mine involves a lot of websites and a small hosting company for local clients. So for me it was better to learn server management and maintenance. Some people wouldn't have the same requirement so the learning curve might not be a wise investment. For them good managed hosting (very few offer this BTW) is more practical.

Click to expand...

gullsinn said:

I have also received a warning from netfirms.

Click to expand...

sneha said:

I am thinking to move to Joomla will be best choice after wordpress

Click to expand...

bertbaby said:

I posted this in another thread:

One of my hosts, FatCow, told me yesterday that all of their WordPress sites are under attack. Last month alone I saw a 100,000 hits on my wp-login file.

To thwart the attacks I added a security plugin WordPress SEO, timed out the number of logins, began blocking IP addresses and renamed my wp-login files. The number of hits has been reduced greatly but the attacks do continue. Oh, yes I did used Backup Buddy.

Click to expand...

sneha said:

I am thinking to move to Joomla will be best choice after wordpress

Click to expand...

StillSmiling said:

^^^ BWAHAHAHA!!! Funniest thing Ive heard all week! Dude, thanks for the laugh! ^^

Click to expand...

sneha said:

I am thinking to move to Joomla will be best choice after wordpress

Click to expand...

1. The easiest thing you can do to increase the security of your site is to change both the admin username and password. By default, the administrator login name is set to "admin" - and most brute force scripts have this ID and some basic variations (e.g. administrator, root, test, etc...) hardcoded as the IDs they attempt to break into. Change the username for your administrator account to something obscure.
2. Make sure your password is strong. You know the drill: more than 8 characters, letters and numbers, no English words, no dates, mixture of capitals and lower case. Consider using a random password generator and a secure password manager to store it so you don't have to memorize it.
3. Install a security enhancing plug-in. The core Wordpress application lacks some basic security features, such as the ability to limit the number of failed login attempts. Fortunately, you can add functionality like this via some popular plug-ins:
   • Bad Behavior: http://wordpress.org/extend/plugins/bad-behavior/
   • Better WP Security: http://wordpress.org/extend/plugins/better-wp-security/
   • Limit Log-in Attempts: http://wordpress.org/extend/plugins/limit-login-attempts/

bertbaby said:

"Did you try using Cloudflare? from gogol"

No, taking the precautions I outlined above addressed the attacks. Unfortunately, the hosting company is taking a big performance hit on the shared servers. Frankly, as mentioned in an earlier post it's not that hard to figure where the attacks are coming from and to then block the IPs. For shits and giggles I visited one site and it was toxic with malware, fortunately I visited the site with my Ubuntu box!

Click to expand...

garrido said:

From my host provider:

Wordpress sites across the web have recently been targeted by an extensive distributed brute force attack. The attack attempts to gain access to the administrator account on Wordpress sites by systematically running through a variety of password iterations. Since the attack originates from thousands of different IP addresses, it is difficult to block at the network level.
Last night the attack impacted performance for customers on several servers, regardless of whether Wordpress was installed on their site. Our operations and support teams have been working throughout the night, and have taken several proactive measures to mitigate the security threat. In some cases, we temporarily disabled the ability to log in to Wordpress sites that were under attack - which also protected these sites from being compromised. As of this morning, all of our servers are back to normal performance levels and login functionality has been restored.
If you have installed Wordpress on your site please take a minute or two to ensure your site is protected against attacks like this one. Here are some basic security tips:

1. The easiest thing you can do to increase the security of your site is to change both the admin username and password. By default, the administrator login name is set to "admin" - and most brute force scripts have this ID and some basic variations (e.g. administrator, root, test, etc...) hardcoded as the IDs they attempt to break into. Change the username for your administrator account to something obscure.
2. Make sure your password is strong. You know the drill: more than 8 characters, letters and numbers, no English words, no dates, mixture of capitals and lower case. Consider using a random password generator and a secure password manager to store it so you don't have to memorize it.
3. Install a security enhancing plug-in. The core Wordpress application lacks some basic security features, such as the ability to limit the number of failed login attempts. Fortunately, you can add functionality like this via some popular plug-ins:
   • Bad Behavior: http://wordpress.org/extend/plugins/bad-behavior/
   • Better WP Security: http://wordpress.org/extend/plugins/better-wp-security/
   • Limit Log-in Attempts: http://wordpress.org/extend/plugins/limit-login-attempts/

Our operations team will remain vigilant and will continue to proactively respond to any security threats as they arise. Although this attack is particularly extensive, it is unfortunately not uncommon. The single most important thing you can do to protect any aspect of your account (e-mail, FTP, other web apps, etc...) is to use very strong passwords, and insist that your clients / users do the same.

Click to expand...