Security analysts have detected an ongoing attack that uses a huge number of computers from across the Internet to commandeer servers that run the WordPress blogging application.

The unknown people behind the highly distributed attack are using more than 90,000 IP addresses to brute-force crack administrative credentials of vulnerable WordPress systems, researchers from at least three Web hosting services reported. At least one company warned that the attackers may be in the process of building a “botnet” of infected computers that’s vastly stronger and more destructive than those available today. That’s because the servers have bandwidth connections that are typically tens, hundreds, or even thousands of times faster than botnets made of infected machines in homes and small businesses.


What does this mean? It means that self-hosted WordPress users are at serious risk of being hacked. An attack of this magnitude has a high chance of cracking your password.

According to CloudFlare’s Prince, the distributed attacks are attempting to brute force the administrative portals of WordPress servers, employing the username “admin” and 1,000 or so common passwords. He said the attacks are coming from tens of thousands of unique IP addresses, an assessment that squares with the finding of more than 90,000 IP addresses hitting WordPress machines hosted by HostGator.

Back up your blogs and make sure your passwords are extra strong. But also? Don’t panic. It might not happen to you, and if it does, you’ve done your part to shut them out. Right?

Spread the word, make sure people know to change their passwords and back-up, and go do the same as soon as possible. If you can let your host know, do so. And take a look at the two plugins mentioned in the article I linked. Limit Login Attempts and Better WP Security.

Jax has an excellent post on how to protect your site from the admin account hack. It tells you exactly what you need to do to stay secure so please make sure you take a look and follow her advice! 🙂