WordPress under attack! Protect your WordPress website

Hey folks!

…especially those running their blogs off WordPress.

Word just in is that there’s a massive attack going on currently on WordPress websites. I’ve extracted information from valid sources below:

ResellerClub

…We did a detailed analysis of the attack pattern and found out that most of the attack was originating from CMSs (mostly WordPress . Further analysis revealed that the admin accounts had been compromised (in one form or the other) and malicious scripts were uploaded into the directories.

Today, this attack is happening at a global level and wordpress instances across hosting providers are being targeted. Since the attack is highly distributed in nature (most of the IP’s used are spoofed), it is making it difficult for us to block all malicious data.

To ensure that your customers’ websites are secure and safeguarded from this attack, we recommend the following steps:

1. Update and upgrade your wordpress installation and all installed plugins
2. Install the security plugin listed here
3. Ensure that your admin password is secure and preferably randomly generated
4. Other ways of Hardening a WordPress installation are shared athttp://codex.wordpress.org/Hardening_WordPress

These additional steps can be taken to further secure wordpress websites:

• Disable DROP command for the DB_USER .This is never commonly needed for any purpose in a wordpress setup
• Remove README and license files (important) since this exposes version information
• Move wp-config.php to one directory level up, and change its permission to 400
• Prevent world reading of the htaccess file
• Restrict access to wp-admin only to specific IPs
• A few more plugins – wp-security-scan, wordpress-firewall, ms-user-management, wp-maintenance-mode, ultimate-security-scanner, wordfence,http://wordpress.org/extend/plugins/better-wp-security/. These may help in several occasions

…

From Hostgator

There is an on-going and highly-distributed, global attack on WordPress installations across virtually every web host in existence.  This attack is well organized and again very, very distributed; we have seen over 90,000 IP addresses involved in this attack.

At this moment, we highly recommend you log into any WordPress installation you have and change the password to something that meets the security requirements specified on the WordPress website.  These requirements are fairly typical of a secure password: upper and lowercase letters, at least eight characters long, and including “special” characters (^%$#&@*).

You have now changed your WordPress password, correct?  Good.

The main force of this attack began last week, then slightly died off, before picking back up again yesterday morning.  No one knows when it will end.  The symptoms of this attack are a very slow backend on your WordPress site, or an inability to log in.  In some instances your site could even intermittently go down for short periods.

We are taking several steps to mitigate this attack throughout our server farm, but in the same breath it is true that in cases like this there is only so much that can actually be done.  The servers most likely to experience service interruptions will be VPS and Dedicated servers hosting high numbers of WordPress installations, due to the incredibly high load this attack has been seen to cause.

If you are hosted on a VPS or Dedicated server and you would like for us to take a more severe, heavy-handed approach to mitigate this attack, we can do this via means such as password-protecting (via .htaccess) all wp-login.php files on the server.  If you would like our assistance with this, please contact us via normal support channels.

Again, this is a global issue affecting all web hosts.  Any further information we could provide at this moment would be purely speculation.  Our hope is that this attack ends soon, but it is a reminder that we must all take account security very seriously.

…

So, please follow the steps highlighted to better secure your website and prevent yourself from being hacked.

I’ll update this blog post as soon as I have further information