Blog

Locking Down WordPress – Preventing Brute Force Attacks

*updated July 4, 2017

People hacking WordPress is not something new.

We have helped many clients protect and/or recover their hacked WordPress sites over the past couple years and we wanted to share some of our best tips with you.

What We Recommend

Basic Ways To Prevent An Attack

1. Log in and remove any unfamiliar admin users.
2. Change your WordPress username (no more admin).
3. Change your WordPress password
   1. Strong Password Generator
   2. Cloudwards Password Generator
4. Set a new nickname (username and nickname should NOT be the same).
5. Turn off user registration unless you are running a member site.
6. Change your FTP password.
7. Change your control panel password.
8. Change your passwords on any emails associated with your blog/website and your domain.
9. Keep your WP, themes, and plugins updated.
10. Delete themes and plugins that you are not currently using.

If you have already been attacked (but don’t know it yet) the hacker may have inserted a backdoor to come back and use later. In this case, simply changing all your passwords will not prevent this. Read on.

Backing Up Your Blog, Beefing Up Security, and Improving Performance

PLEASE NOTE: Some blogs are recommending Limit Logins Attempt as a way to protect your blog/website from the latest attack, but you do need to do much more. The way this attack is being done, installing this plugin alone will not protect you alone.

Have a backup

• BackupBuddy
• BlogVault
• VaultPress
• CodeGuard

Use CloudFlare to improve site performance and security.

Security plugins

• Bulletproof Security
• iThemes Security
• Brute Protect

Spam Protection

• Akistmet
• Mollom
• NoSpamNX
• Spam Free WordPress

Malware Protection

• Sucuri,
• WordFence
• iThemes Security

Limit Logins Attempts

• Limit Logins Attempt,
• iThemes Security

Cache Software

• W3 Total Cache
• WP Super Cache

*** You will need a cache plugin to help balance the load for the important plugins you are installing.

Database Optimize

• WP Optimize

Check how safe your website is:

Google’s Safe Browsing Diagnostic – http://www.google.com/safebrowsing/diagnostic?site=YOURDOMAIN.COM/

Alernative methods would also be using a Managed WordPress Host, who handles the security of the website.

• WPCloud
• Flywheel
• WPEngine
• Synthesis
• Page.ly
• Media Temple

Even More Things You Can Do

1. Disable logins from certain IP’s or blacklist every IP except your own (can cause problems if you are on a dynamic IP).
2. Update the WordPress secret keys.
3. Reinstall WordPress.
4. Scan each computer that accesses your website admin area for spyware, malware, viruses, keyloggers, rootkits, and botnet software.

Asking For Help

1. We have a Maintenance Plan ($25 a month) that includes REGULAR maintenance of your blog, security, back ups, and support if you have any issues at all. 
2. If you have been hacked, we can help you try and recover your site. Contact Us

Resources And Further Reading

We have read several articles on this latest attack:

1. Brute Force Attacks And Their Consequences
2. Mass WordPress Brute Force Attacks
3. Hackers Point Large Botnet at WordPress Sites
4. Global WordPress Brute Force Flood
5. WordPress Attack
6. Protecting WordPress Login Page From Attacks
7. Huge Attack On WordPress Sites Could Spawn Never Before Seen Super Botnet
8. WordPress Global Attack
9. Global WordPress Brute Force Attacks
10. Major Brute Force Attack
11. Brute force attacks on WordPress continue as CloudFlare fends off 60m requests in 1 hour
12. Patching the Internet In Realtime: Fixing The Current WordPress Brute Force Attack
13. Brute Force Attacks Build WordPress Botnet
14. 8 Steps To Secure Your WordPress Blog
15. Defeat The WordPress BotNet

And many other articles on similar topics:

1. How To Handle A Hacked WordPress Install
2. Clean Link Injections Hacked Websites
3. How To Find A Backdoor In A Hacked WordPress Site And Fix It
4. Help Prevent WordPress Site Breaking Hack
5. Top WordPress Security And Spam Plugins
6. Hardening WordPress
7. How To Completely Clean Your Hacked WordPress Installation
8. Removing Malware From A WordPress Blog

Protecting your computer

Windows Malware Removal and Prevention