Public Service Announcement: Blog under attack (probably yours, too)

I have a WordPress Plugin called Limit Login Attempts that I’ve been running for a while. It basically gives a quick and easy way to limit brute force attempts on your WordPress site by blocking IPs that have invalid logins. It’s pretty configurable for as simple as it is, and one of the things it will do is email you if an IP has been blocked.

My email has been blowing up for the last three days.

This happened in December and January, too. That’s about the same time as a couple pro-gun blogs were hacked and people were wondering if it was some sort of conspiracy. It’s not. It’s just script kiddies.

So do two things today–today–if you run a WordPress site:

1. Install Limit Login Attempts
2. Rename the default ‘admin’ account to something else (and not to your domain name)

I’d say 95% of my invalid login attempts use the admin account. The other 5% use “gunscarstech”, “gunscarstech.com”, “qwerty”, or “administrator” to log in. During the last attack, I added all the IPs to my global deny list at my hosting provider. You might want to do the same.