Major WordPress Brute-Force Attack

Currently a large distributed brute force attack against WordPress sites has been occurring. A large botnet with more than 90,000 servers is attempting to get into the WordPress admin dashboard by cycling through different usernames and passwords. The attack is widespread and very vigorous. This attack seems to be so powerful that it is affecting almost every major web hosting company around the world.

Similar large-scale attack had occurred in October of 2012 when WordPress.com disclosed that some 50,000 sites were compromised.

What should we do ?

1. The FIRST step is to login to your WordPress and change your password to something very secure. Here is a guide on selecting a strong password.

2. Install the Limit Login Attempts plugin. This will prevent from the attackers to login after certain attempts even if they manage to determine the combination of your login details.

3. Allow access to wp-login.php only to specific range of IP using .htaccess

In October 2011, MobileMe was replaced with iCloud. Because iCloud requires OS X 10.7 Lion and because many of the features of MobileMe don't have direct replacements in iCloud, Apple gave MobileMe a nine month grace period to allow for transition. On June 30, 2012, all MobileMe functions will stop working.

How to prepare for June 30: If you are publishing your iWeb sites to MobileMe, your sites will no longer be available after June 30. you need to signup for any of our hosting plans at: http://www.fastwebhost.com/unlimited-web-hosting.html and follow the iweb uploading instruction listed below:

If you have iWeb '09 (version 3.0) or later, follow these steps from the Mac on which you published your web site.

To check which version of iWeb you have choose iWeb > About iWeb.

1. Open iWeb '09 and click the name of the site you want to publish in the left sidebar. The Site Publishing Settings window appears.

2. In the Site Publishing Settings window, choose FTP Server from the Publish to drop-down menu.

3. Enter the following information:

• Site name (optional)

• Contact email (optional)

• FTP server address  NOTE - Your FTP login details were sent via email when you signed up for your hosting account

• User name

• Password

• Directory and path - upload your website files and folders directly to your /public_html directory, this is also known as your remote directory.  Your homepage should be named "index.html" in order for your website to find and display your website properly.

• Protocol and port - is set by default with your FastWebHost hosting

4. Click the Test Connection button to make sure you have entered your information correctly.

5. Enter the URL for your website

6. Click the Publish Site button

You can learn more here. Read Chapter 2, sections 2.1 and 2.2.