Global Wordpress Brute-force Attacks

Your Wordpress site is under attack right now

Right now there is a very severe and global attack on all Wordpress sites on the Internet.

New status update on the Wordpress attacks as of 11pm Eastern time April 12, 2013.

UPDATE: It seems everyone is advising people to install either Limit Login Attempts or a Wordpress Security Plugin. DO NOT DO THIS. This will not only fail to block the attack, it could crash your server. These attacks come in too fast from too many IP addresses. Please follow this guide instead.

Update 2: Matt Mullenweg, the creator of Wordpress, has confirmed that plugins should NOT be used in this situation:

Most other advice isn’t great — supposedly this botnet has over 90,000 IP addresses, so an IP limiting or login throttling plugin isn’t going to be great

- from TheNextWeb: Brute force attacks on Wordpress continue...

Update 3: They are now providing the correct HTTP_REFERER value, so the htaccess blocking is not always effective.

This is not a joke or a hoax - your site is at risk and may be hacked and sending spam right now.

What all Wordpress site owners need to do right now on all sites

If this is all greek and you don't have a webmaster or developer that can help - call 1-800-926-6167

1. Immediately change your passwords to the Wordpress admin area, FTP, any control panels, and all email accounts
2. Your password should be at least 30 characters and MUST have all of: uppercase and lowercase letters, numbers, and special characters. A good way to come up with a strong password that you can still remember is take a long phrase, song lyrics, a poem, similar, and replace certain letters with uppercase, numbers, and special characters.
3. for example the relatively strong password: th1$l1ttl3p1ggy$3cur3dth31rW0rdpr3$$$1t3 is simply "thislittlepiggysecuredtheirWordpresssite" with i->1, s->$, e=3, and o->0 (zero)
4. Scan your computer for viruses, keyloggers, rootkits, and botnet software
5. Do the same scans for any computer that has had access to your site admin area
6. Update Wordpress and all plugins to the latest versions

Add this to the .htaccess file in your document root (public_html, www, htdocs, etc)

This is in order to stop direct automated attempts to log in to your site:

NOTE: Replace example.com below with your domain (leave the ?. before it and everything else)

<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{REQUEST_METHOD} =POST
RewriteCond %{HTTP_REFERER} !^http://(.*)?.example.com [NC]
RewriteCond %{REQUEST_URI} ^/wp-login\.php(.*)$ [OR]
RewriteCond %{REQUEST_URI} ^/wp-admin$
RewriteRule ^(.*)$ - [R=403,L]
</IfModule>

Now you are going to change the admin username to something difficult to guess

Log into Wordpress admin with your new secure password and follow this guide to change the admin username:

How to change Wordpress admin username

The attackers are simply going through and using a lot of computing power to "guess" the password for the user "admin" - if that user is not there, it will make it no longer worth the computing effort required to guess both the username and password.

Now the most unfortunate part is that these attacks may have actually "hacked" your Wordpress site, meaning you may not know it but someone could be using your account to send spam or even attack other sites.

I recommend having someone familiar with Wordpress look through the site as well as look at the files themselves. If you see anything out of the ordinary on the site like a large amount of spam, certain links redirecting (usually to sites you don't want people going to from your Wordpress blog), or especially files and plugins that are shown in FTP / File Manager (in the wp-content/plugins directory) but are NOT listed in "Plugins", you will need to clean the hacks.

The simplest way to clean up a hack is essentially to "quarantine" the whole site and rebuild, but frequently much of the site can be salvaged.

Basically you will need to download and install the latest version of Wordpress via FTP, copy just the important parts of your wp-config.php from the hacked folder to hook up the database, and re-install clean copies of your theme and plugins. If you are using timthumb in your theme or any plugins, now is a good time to pick a new theme that uses the built-in Wordpress image thumbnails as well as trim down your collection of (potentially vulnerable) plugins.

How do I know the above is (part of) a Wordpress hack? I know exactly what to look for to find even the most well-disguised hacks, but this one is simple - eval and base64 decode together are almost always bad news.

Now for the plugins to install on all Wordpress installations. Search for these from Plugins->Install or click to download.

If you get stuck on any of this or you think your site is still hacked (or hacked again), get help. If all else fails - Call A Developer @ 1-800-926-6167

• Stop Spammer Registrations
• Limit Login Attempts
• Ban Hammer
• Wordpress File Monitor Plus
• Spam Free Wordpress
• W3 Total Cache (if you don't have this or SuperCache already - don't use both)

Further Reading

• WordPress Security: Protection from Hackers and Crackers
• Official Hardening Wordpress Guide
• How to clean hacked Wordpress
• Advice on rebuilding database after a hack
• Removing malware from Wordpress - a Case Study Warning - this one gets technical
• WordPress 3 Ultimate Security

Remember if you need help, call 1-800-926-6167 - on a mobile phone this site will show a green Phone button at the bottom - click it to call us. Be sure to save the number as "Call A Developer"

Peter Stolmar is a Linux Systems Administrator specializing in system security including fixing hacked websites, defending against large scale attacks, and educating users on the importance of "thinking secure".