Unless you have been living at the bottom of a well, you are probably well aware by now of the brute force login attacks hammering WordPress sites worldwide. Today, we are enumerating 10 things you should know about this situation and how to harden your WordPress installs — and what to do if you are a victim of these attacks.
Unlike hacks that focus on vulnerabilities in software, a Brute Force Attack aims at being the simplest kind of method to gain access to a site: it tries usernames and passwords, over and over again, until it gets in…. They are, in short, an attack on the weakest link in any website’s security: You. ~~ WordPress Codex
- Some web hosts have been disabling access to the
wp-login.phpfile across all WordPress installs. If that’s the case, you won’t be able to access your WordPress backend; you’ll just have to wait it out. (Or change web hosts because this is really NOT how you cope with this situation.)
- Follow the advice given on WordPress’s own Codex on Brute Force Attacks article.
- Use a plugin that limits unsuccessful login attempts; two to consider are Login Lockdown and Limit Login Attempts
- If your web host is not one who has disabled the
wp-login.phpfile, you can protect it yourself by creating an authenticated user and password and modifying your .htaccess file.
- Read this article and consider how to strengthen your passwords so that they are virtually hack-proof.
- Still not convinced about your login credentials? Then read what WordPress’s creator, Matt Mullenweg, has to say about this recent hack attempt.
- If you are not using a self-hosted WordPress install but are instead blogging at WordPress.com, then enable Two-Step Authentication.
- Did I forget to mention? Update WordPress, update all your plugins; delete the ones you are not using (don’t just disable them; delete them completely from your server); and update your theme if it needs updating.
- DIYers, learn how to rebuild your MySQL database after a hack.
- If the worst happens, you can hire a web developer with experience in threat management to help get your hacked site back on its feet, safe and sound.