Secure your wordpress before its to late. -- MASSIVE WORDPRESS ATTACK (15)

As of this week a huge new botnet consisting of over 100,000 compromised servers has began attacking wordpress installs all over the world by trying to brute force the login page.

Here are a few key things to prevent you from getting compromised and taken offline.

1. Modify your login username to something secure, not admin1 or weak user. Use a random set of chars if you can or set it to a username that is not easily guessed.
2. Set a secure password on the new user. Utilize password websites such as http://strongpasswordgenerator.com/ We recommend utilizing a password encryption service such as https://lastpass.com/
3. Make sure you've removed the admin user from your wordpress.
4. Insure wordpress is up to date and all plugins and THEMES are as well.
5. Secure wordpress with .htaccess to block all unknown ips.

.htaccess example.

<Files wp-login.php> 
Order Deny,Allow 
Deny from all
Allow from replace-with-your-ip  
</Files>

Mods can we get this sticky'd please?

Thanks for the heads up Tyler!

I gave up on WP for this reason.

how do we check to see if they already got in?

Originally Posted by butthole

how do we check to see if they already got in?

First thing I'd do is check the home page source for unknown links.

i recommend Wordfence and Better WP Security plugins, both are pretty feature-rich and have wizards for common security fixes

I have wordfence, cloudflare, and the .htc access deny on my multi-site

All covered.

Butthole, Look at you httacess

FYI this is not just Beyond Hosting, MyHosting and a few other places have been hit too.

This is clearly the work of Anonymous. They must be leading a revolution against Wordpress or something. @#$!.

Its an ongoing thing, we've blocked a few different networks already trying to reduce the impact of this. I gotta say these attacks are getting old fast.

Yep I've been slammed by wordpress hacks...fucking annoying.

I've had a couple of blogs breached too.

I wouldn't mind the ordeal if there was a resemblance of a point to it. Keyboard warrior extremism

This guide; http://community.namecheap.com/blog/...ecurity-guide/ covers a couple of good plugins and ways to secure your WP install. BPS can be a pain to get going (especially with W3TC) but def worth it !

And wordfence as described earlier in this post