-
Posts
-
I just received this mail and thought I share for those who haven’t protected their sites:
As of 11am eastern time this morning we are monitoring the largest distributed brute force attack on WordPress installations that we’ve seen to date. The real-time attack map on http://www.wordfence.com became so busy that we’ve had to throttle the amount of traffic we show down to 4% of actual traffic.
A brute force attack is when an attacker tries many times to guess your username password combination by repeatedly sending login attempts. A distributed brute force attack is when an attacker uses a large number of machines spread around the internet to do this in order to circumvent any blocking mechanisms you have in place.
If you’re using the free or paid version of Wordfence you should have the option to “Participate in the real-time Wordfence security network” under ‘Other options’ enabled. This will immediately block any attack originating from an IP address that has attacked other WordPress sites using Wordfence. This is an effective defense against this kind of attack.
We recommend that until this passes you monitor your WordPress websites closely for unusual activity including logins, account creation or changes to the public facing website.
Hey there, and thanks for the heads up.
Although I don’t suggest this plugin (because it can interfere with Paypal) it’s priceless:
http://wordpress.org/plugins/bad-behavior/
Be sure to add these to your whitelist:
https://www.paypal.com/
ipn.sandbox.paypal.com
notify.paypal.com
66.211.170.66EDIT: This forum is almost bulletproof because it uses Bad Behavior, Honey Pot, and Stop Forum Spam — its very hard to get through. WordPress also has plugins for these, but proceed carefully because it can interfere wtih customers too.
You must be logged in to reply to this topic.