WordPress Websites Everywhere are Under Attack: Part 2

WordPress

By Vincent Wondra

April 16, 2013

In case you missed my first post about the recent attacks on WordPress hosts, let me quick summarize.  Last week a botnet of computers targeted WordPress hosts around the globe. The attacks were targeted at WordPress websites where the default “admin” account was still intact. The botnet would then run through an algorithm to try an guess the password by trying the most popular 1000 passwords.  If it cracked your system, your website was added to the botnet of computers and would help target the next WordPress host, growing exponentially as more and more websites were cracked.

Every WordPress hosting provider that I have talked to (Dreamhost, Media Temple, InMotion, and HostGator) had already taken measures to mitigate the damage.  

Matt Mullenweg, a WordPress founder, was on his blog to providing advice. He explained that hackers had been targeting users who never changed the “admin” username for their account. “If you still use ‘admin’ as a username on your blog, change it,” he recommended.

If you have not done so already

Please change your WordPress Password immediately

…(especially if you are still using the Admin username)

  1. Log into your WordPress Dashboard
  2. Go to Users –>Your Profile
  3. Scroll down to the “About Yourself” section and choose a new password that meets these requirements: 
    • Upper and lowercase letters
    • At least eight characters long
    • Including “special” characters (^%$#&@*).
  4. Scroll to the bottom and click on Update Profile

To learn more about this attack, please head on over to Mashable or check out the very detailed article at the iThemes blog.

I'm the Founder & President of The BBS Agency & Prebuilt Sites. I have been building websites since the mid 90's. I fell in love with WordPress many years ago and today help companies leverage it's power. I'd love to help you next!