After my blog was hacked a few months ago, I’ve been understandably more security conscious on my blog. One of the things I’ve done is install a few security plugins (most notably Wordfence Security). Wordfence is an absolutely fantastic security plugin, it monitors the files on your site to make sure that they don’t change unexpectedly, and more importantly, it monitors login attempts (and other page requests on your site) for potentially harmful login attempts.
Over the past few weeks, a global brute force attack has been targeting WordPress installations. I first found out about it because Wordfence started notifying me that there were more failed login attempts than usual.
Protect yourself and your blog with the following crucial steps:
Don’t use “admin”:
If you have a user named “admin” on your WordPress installation, get rid of it! If it is your only admin user, create a new one, log out of admin, and in as your new admin user, and then delete the user named “admin.” The brute force attack is trying thousands of passwords with the user named admin.
Use a good password:
Please don’t use “password” or “admin” or “god” or your birthday, pet’s name, or any other easily guessed password. Use a good password. The brute force attack is trying both a list of the top 10,000 passwords and a dictionary random word attack. Protect yourself, don’t use a password that is easily broken!
Use a security plugin to prevent login attempts:
As I mentioned above, I use Wordfence Security by Mark Maunder. This plugin is fantastic. Not only can you set it up to lock people out if they fail to log in a certain number of times, but you can rig it where if they try a username you don’t have (like admin, because you followed step 1) it will lock them out immediately.
It will also notify you when it has locked someone out and can notify you if someone successfully logs in. This way you can have a warning if someone does manage to break through your secure password.
It also monitors the files on your WordPress installation and notifies you if any of the files in your themes and plugins unexpectedly change. This is a great plugin and I highly recommend it.
I hope this helps you secure your blog from this attack.
Battering Ram Image Credit: flickr.com/noii