Recent news of a “brute force” attack on WordPress sites world wide left many scrambling to protect their sites. While I kept a close eye on the sites I manage (this one included!) none of those sites were significantly impacted. Yes, hundreds, and even thousands of attempts to gain access were made on some sites, and some websites were sluggish for users at times, but that seems to have been the extent of the attack on “my” sites! I am happy to report that none of the sites I manage were “hacked” and the attempts were limited to just that – attempts.
I’ve added the Limit Login Attempts plugin to my basic arsenal. While the Bad Behavior plugin blocks the attempts, and logs the numbers, IP addresses, and other information, it does not STOP the attempts. A site being overrun with login attempts will run sluggishly or be shut down by the server. Limit Login works to lock out an IP address after a set number of unsuccessful login attempts so no repeated attempts can be made, so it reduces the number of access attempts and lessens the traffic. I have installed this on all my sites and now include it as “standard”.
Just for your information, the following is a list of plugins that I typically install on websites as part of my standard setup:
- All in One SEO/WordPress SEO
- BackupBuddy/BackWPup
- Bad Behavior
- *Limit Login Attempts
- Spam Free WordPress
- Tailored Login
- wp-jquery-lightbox
* added as a result of the recent attacks, as recommended by several WP gurus
Other plugins may be (and most likely WILL be) added to accomplish specific goals on your site. The above listed plugins provide security and functions I feel are necessary on ANY website and I consider them “standard”.
Additional steps I have taken since the “attacks”:
- Implemented strong, randomly generated passwords for all my Administrator logins on WordPress sites
- Put my site on CloudFlare CDN to improve both security and efficiency of website performance – I will be adding client sites if this works as I expect
- More frequent site checks to ensure sites are functioning properly (twice or more weekly rather than just weekly)
It’s been an interesting month, and I have learned a few things, and made my site(s) and yours safer and more secure. And that’s a good thing!