WordPress is the world’s most popular content management system which makes it an obvious target for attempted attacks by hackers.

In 2013 a global brute-force attack began hitting WordPress installations on virtually every web host in existence around the world.

These attacks were caused by botnets (computer networks infected with viruses and programmed to attack other vulnerable sites).

How To Protect Your WordPress Site From A Brute-Force Attack

What Are Brute Force Attacks?

A brute-force attack is a technique used to break an encryption or authentication system by trying all possibilities.

(Source: Chinese University Of Hong Kong)

One of the many ways hackers use to try and break into a WordPress site is by trying to guess the site’s administration login username and password. This is achieved using software tools and scripts that automatically tries to guess hundreds of possible login combinations in minutes.

If you’re using obvious user names and predictable passwords, your website could be easily hacked by the script’s persistent attempts to work out your site’s login details.

This is called a “brute force” attack.

What Is A Botnet?

A botnet is a number of Internet-connected computers communicating with other similar machines in an effort to complete repetitive tasks and objectives. This can be as mundane as keeping control of an Internet Relay Chat (IRC) channel, or it could be used to send spam email or participate in distributed denial-of-service attacks. The word botnet is a combination of the words robot and network.

(Source: Wikipedia)

A “Botnet” is a network of computers that have been infected with malicious scripts or software code, which are then controlled remotely as a group, often without the computer owners’ knowledge.

Botnets are normally used used to blast mass spam emails.

The screenshot below was taken from a site that monitors online security showing the locations of the command centers of ZeuS – a botnet that has been actively infecting computer networks all around the globe since 2009 …

(The Zeus botnet has been actively compromising computer networks all around the globe since 2009. Image: SecureList.com)

These botnet attacks on WordPress sites were highly distributed and well organized. Over 90,000 IP addresses were identified by several hosting companies in the initial attack alone, when millions of attempts to force their way into WordPress users admin areas took place. The brute force attacks continued after this, with over 30,000 WordPress sites being hacked per day.

News of this brute-force attack was widely reported in all of the major webhosting companiesand leading technology media publications, such as Forbes, TechNews Daily, BBC News, PC Magazine, Tech Crunch, and even on the official US Department of Homeland Security website …

(WordPress powers millions of sites around the world, which makes it a target for hacking attempts)

Does This Mean WordPress Is Not Secure And We Should Stop Using It?

No. In fact, there are many good reasons why you should continue using WordPress if you are concerned at all about the security of your web presence.

To learn why WordPress is a secure platform for websites, read this article: Can You Build A Secure Business Online Using WordPress?

It’s important to note that, in the case of April 2013 brute force botnet attack described above, there was no WordPress vulnerability being exploited (the same script was also attacking sites built using other CMS platforms like Joomla).

Mike Little, the co-founder of WordPress, said this about the brute force attacks:

It is a “simple” script that attempts to login using the admin login and a generated password. So if your password is too short or based on dictionary words it will be guessed and then the script can login legitimately and do whatever it wants including installing scripts (as plugins) or editing files. The attack tries to guess your password, if it succeeds, the most secure site in the world is wide open because they have your password.

(MikeLittle.org)

How To Protect Your WordPress Blog From Brute Force Attacks – Ten Security Checks

You may think that your website or blog has no significant value to hackers, but the reality is that all websites are valuable to a malicious user.

If a malicious user can find a way to access and take over your web site, that blog can then be employed as a “bot” to attack more valuable web sites.

Additional undesirable consequences of being hacked include being blacklisted by Google, having spammy links advertising things like casinos, discounted fashion, etc. in your content, malicious redirects to phishing sites, drive-by downloads (adding malicious scripts on your visitors’ computers), and lots of other nasties.

The harsh reality is that software-driven bots are trying to hack into your website as you are reading this. Whether they can be successful will depend on how difficult you can make it for them to keep trying until they work out how to get access, or are forced to give up and go look for a less protected target.

How Much Information About Your WordPress Site Are You Broadcasting To Hackers?

Does your website run on WordPress? If so visit a site like Hackertarget.com and run your website through their WordPress security check …

(Hackertarget – WordPress Security Scan Source: Hackertarget.com)

You will see that the scan will display a number of results and information about your site setup …

(Hackertarget – WP security check results. Product image source: Hackertarget.com)

It should be obvious after using this scanning tool that if you are able to see all of this information, then so can hackers.

(Product image source: BlogDefender site)

The ability to see which version of WordPress you are using, which plugins and themes you have installed on your site, and which files have been uploaded to certain directories can be useful information to hackers, as this can inform them about exploitable security weaknesses, especially in older versions.

If your site or blog is driven by WordPress and you are not taking appropriate steps to harden your site, it’s practically guaranteed that, at some point in time, someone will attempt to hack your website, because these brute-force attacks are systematically targeting WordPress sites around the world!

Typically, when a website gets broken into, website owners can find themselves “locked out” of their own site, or notice that their files have been altered or even that their content has been completely wiped out. Typically, sites will become infected with malicious software or viruses without the owner even being aware of it.

To avoid the heartache and aggravation of discovering that your website has been hacked into, below are 10 essential and effective security checks that will help to protect your WordPress site from being brute-force attacked.

Note: A few of the recommended steps shown below require some technical understanding of how to modify core WordPress or server files. If you lack these technical skills, or don’t want to mess around with file code, then ask your web host or a professional WordPress service provider for assistance.

***

Security Measure #1 – Contact Your Web Host

Contact your webhosting service provider and ask them what precautions have been put in place to help prevent your site from being attacked, and what is done to make sure that your files and data get backed up.

Check that your webhosting company regularly backs up your server files and that, if anything should happen, you can quickly and easily get back your site.

Security Measure #2 – Perform Complete WordPress Backups And Keep Your Website Frequently Up-To-Date

You should never rely just on your webhosting service for your site backups. Instead, learn how to manage your WordPress site or get this service done for you and develop a habit of religiously performing a full site maintenance routine on a frequent basis (e.g. daily, weekly, fortnightly, etc …)

A full WordPress maintenance routine ensures that:

• All unnecessary data and files are removed,
• All WP files and data are free of errors, optimized and backed up,
• All WordPress software, plugins and themes are up-to-date,
• etc …

A full WP maintenance routine looks like this …

(Maintaining your WP website regularly backed up and up-to-date is vitally important for WordPress security. Screenshot: WPTrainMe.com)

Again, we cannot stress enough how vitally important maintaining your WordPress web site completely backed up and updated is. WordPress site maintenance is not hard or time-consuming, but it must be done to ensure the security of your website or blog. If you don’t want to learn how to do WP site maintenance yourself, get someone else to do it but make sure this gets done. Backing up your website is the second most important thing you should do after making sure that you still have a pulse!

If you don’t want to perform manual backups, there are a number of free and paid WordPress plugins you can use. You can read about a WordPress backup plugin that can automate your backup process here: Backup, Copy & Protect Your WordPress Site With Backup Creator WP Plugin

Security Measure #3 – Make Sure That Your Username Is Not “Admin”

The large scale brute-force botnet attack on WordPress is mostly attempting to compromise website administrator panels and gain access to sites by exploiting WP installations using “admin” as the account name.

For reasons of website security, avoid setting up a WordPress site with the username “admin”. This is the first thing hackers will test. If your blog’s username is admin, then change this immediately.

For a detailed tutorial on how to change your WordPress username, go here: Changing Your Admin User Name In WordPress

Security Measure #4 – Your Password

A “brute force” attack occurs when a malicious script continually tries to guess the right combination of characters in a password and username that will give the hacker entry to your site.

Unless some measure is put into place to stop the brute force attack (see further below for a couple of effective ways to do this), the “bot” will just continue to attack your site until it eventually “cracks” the code.

Weak passwords, therefore, are very easy targets for hackers. Make sure that you change your password to a string containing at least eight or nine characters long, with upper and lowercase letters, and “special” characters (e.g. ^, #, @, etc).

You can use a password management software tool like Roboform to generate unguessable passwords …

(Roboform is a password software you can use to help you generate strong login passwords)

For a detailed step-by-step tutorial created especially for admin users that shows you how to change your login password, go here: What To Do If You Need To Change The Login Password

Security Measure #5 – Protect Your wp-config.php File

The wp-config.php file allows WordPress to communicate with the database to store and retrieve data and is used to define advanced WordPress options.

(wp-config.php)

If a hacker breaks into your WordPress website, they will search for the wp-config.php file, because this file contains important information about your site’s database, security keys, etc. Getting access to this information would allow them to change anything in your database, create a user account, upload files and take control of your site.

To protect your WordPress site from attacks and even being used as part of a bot net, therefore, you must prevent your wp-config.php file from being accessible. This requires knowing how to edit database information, move files around in your server and changing access permissions.

Security Measure #6 – Delete Or Rename Unnecessary Installation Files

Rename or delete your install.php, upgrade.php and readme.html files.

These files can be deleted after installation. If you don’t want to remove these files, then just rename them.

Security Measure #7 – Update Your WordPress Blog, Plugins & Themes

Hackers are always on the lookout for vulnerabilities in older versions of WordPress that can be exploited, including outdated versions of WP plugins and themes.

Ensure that all of your WordPress software files, themes, plugins, etc. are always up to date.

Security Measure #8 – Disable Your WordPress Theme Editor

WordPress comes with a built-in editor feature that lets site administrators edit plugin and theme code inside the dashboard area.

In WordPress, you can access your WordPress Theme Editor by selecting Appearance > Editor in your main menu …

(The WordPress theme editor is accessible using the admin menu)

The WordPress theme editor lets anyone accessing your blog view and change your WP theme files, and create havoc on your site.

If you want to prevent unauthorized people from accessing your WordPress Theme editor, you will need to disable it. This can be done by editing your wp-config.php file.

Security Measure #9 – Prevent Access To The WordPress Uploads Directory

The WordPress “uploads” folder stores all the media that gets uploaded to your site.

By default, this folder is visible to anyone online. All someone has to do to see the contents stored in the “uploads” directory is navigate to your directory using their browser …

(WordPress uploads directory)

If any files stored in his folder have vulnerabilities that can be exploited by hackers, this can threaten the security of your site.

Protecting your directories will prevent online users from viewing your ‘uploads’ folder and other important directories. This can be done using plugins, setting file permissions, adding a blank index.php file (this is literally a file with nothing in it called “index.php”) to your uploads directory, and so on. Again, it’s best to use a professional if you are unsure about what to do.

Security Measure #10 – Use Security Plugins

There are some great security plugins for WordPress available that specifically address most common security issues faced by WordPress site owners, such as preventing unauthorized users from gaining access to vital areas of your site, protecting your files from botnets, preventing unauthorized file uploads, etc.

Many WordPress plugins address some but not all areas of WordPress security. One WordPress security plugin that seems to do a comprehensive job of scanning, fixing and preventing issues that could lead to hackers accessing your files and causing irreparable damage to your site is SecureScanPro.

(SecureScanPro – complete security software for WordPress)

SecureScanPro is easy to install and easy to use, and does a great job of addressing most of the security areas that WordPress users need to address.

Another great plugin you may want to look at using is BlogDefender.

Blog Defender Security Product Suite

(Blog Defender Security Plugin)

This product is a package of WordPress security video tutorials, WordPress plugins and tools, plus WordPress security documentation in PDF and DOC formats.

BlogDefender scans you WordPress installation for security vulnerabilities …

And then shows you how to easily fix these …

If you don’t want to purchase a premium security plugin like SecureScanPro or BlogDefender, then use various free WP plugins, such as Limit Login Attempts …

WordPress is a secure web platform, but neglecting essential maintenance tasks like making sure that your WordPress software, plugins and WP themes are kept up-to-date, tightening file and data protection and taking other necessary precautions can expose your site to attacks by hackers and bots.

No matter what kind of business you run or plan to run online and how small you think your web presence is, securing your site is something you cannot ignore.

As one last reminder, below is the advice given by a security expert to all WordPress users after the mass brute-force attacks on WordPress in April 2013 …

Owners of websites based on WordPress CMS must improve at least basic security settings and implement best practices such as the use of robust passwords and the accurate management of “admin” accounts.

Pierluigi Paganini, Chief Information Security Officer, Security Affairs

***

As you can see, website security is very important if you run a WordPress site. Hopefully, the information in this article has provided you with the initial guidelines and direction you need to prevent brute force attacks on your WordPress site. If you need any further help or assistance with WordPress security, please seek help from a professional WordPress security specialist, or search for a WordPress service provider in our WordPress Services Directory.

We also recommend subscribing to WPCompendium.org to be notified when we publish new tutorials on WordPress security and reviews of new security plugins and solutions.

***

***