I'm a new WordPress user. Are there any guides online with best practices that I can follow? (Some suggestions I see in this thread: rate-limiting plugin, don't have user id #1, don't have user "admin".)
Huge attack on WordPress sites could spawn never-before-seen super botnet
21–30 of 86 posts
Re: Huge attack on WordPress sites could spawn never-before-seen super botnet
#22I'm a new WordPress user. Are there any guides online with best practices that I can follow? (Some suggestions I see in this thread: rate-limiting plugin, don't have user id #1, don't have user "admin".)
Start here: http://codex.wordpress.org/Hardening_WordPress
Find a good host, use a secure password password, pay attention to the 3rd party plugins you're installing, and keep your install updated.
Re: Huge attack on WordPress sites could spawn never-before-seen super botnet
#23Another nice bit of advertising for Cloudflare..
There's some more about this on their blog:
http://blog.cloudflare.com/patching-the-internet-fixing-the-...
Re: Huge attack on WordPress sites could spawn never-before-seen super botnet
#24Not surprisingly one of the most commonly scripted search query at Blekko is for wordpress themes in one way or another. We do what we can to not return them any useful data.
Re: Huge attack on WordPress sites could spawn never-before-seen super botnet
#25Time to start moving away from TurdPress.
Re: Huge attack on WordPress sites could spawn never-before-seen super botnet
#26tldr; automated scripts attacking default wordpress username with weak password. Welcome to the internet.
Re: Huge attack on WordPress sites could spawn never-before-seen super botnet
#27I'm a new WordPress user. Are there any guides online with best practices that I can follow? (Some suggestions I see in this thread: rate-limiting plugin, don't have user id #1, don't have user "admin".)
You can add HTTP basic auth to your wp-login.php and wp-admin/ paths, which will require that the user provide authentication before ever getting to pass data to those scripts. That can protect you against vulnerabilities in the software, but it won't protect you from bad passwords.
Re: Huge attack on WordPress sites could spawn never-before-seen super botnet
#28Rate-limiting login attempts out-of-the-box is something Wordpress should have included a LONG time ago. Maybe 1% of installs will setup the plugin to do this. No idea why they haven't added this yet.
Unfortunately it doesn't look like that would do any good here.
With over 200k different botnet controlled machines, all that tracking the IP sources would do here is create massive blocklists. There's already evidance growing that the botnet is trying 2-3 passwords per source IP - effectively bypassing existing limiting plugins.
A solution to the above is to limit the logins per account per timeframe, but that just locks the legitimate users out, causes the botnet to spread out the attack over longer periods, and ultimately only has a negitive affect for the user.
The Hosts are feeling the pain though, i've seen some hosts are disabling access to wp-login.php entirely, this tells me that the shared hosts are having resource issues, so a limit-login style plugin would do zero to help them, it'd still cause massive problems for the host.
WordPres, Joomla, and other smaller CMS's are being targetted here, so this is by no means just WordPress's problem either.
Re: Huge attack on WordPress sites could spawn never-before-seen super botnet
#29Don't know if this is a dumb question: but would it be possible for a good party to use the same method to get admin access and install rate-limiting login plugins on all of these insecure WordPress blogs? Seems like that would be badass.
Re: Huge attack on WordPress sites could spawn never-before-seen super botnet
#30"...the distributed attacks are attempting to brute force the administrative portals of WordPress servers, employing the username "admin" and 1,000 or so common passwords." I'm a little surprised that such a simple attack vector is a legitimate threat in creating a "super botnet."
On older Wordpress installs (pre-3.0 I believe), you couldn't change the username of the first user from "admin" when setting up a blog, and you had to manually change it later. Yes, it was stupid.