So last week half the WordPress-running internet got a scare, and I'm a little embarrassed to admit it took me until Thursday night to actually do anything about it on my own site.
Quick recap for anyone who missed it because they were, understandably, glued to the news out of Boston instead: starting around April 11th, security folks at CloudFlare, HostGator, and a few other hosts started noticing a huge spike in brute-force login attempts against WordPress admin panels. We're talking tens of thousands of different IP addresses, all hammering away at wp-login.php, mostly trying the username "admin" with a rotating list of dumb-but-common passwords. Matthew Prince over at CloudFlare wrote it up and floated the theory that whoever's behind it isn't just trying to deface blogs for fun, they might be quietly building a botnet out of compromised web servers for something bigger down the road, which is a way more unsettling idea than "some kid is defacing WordPress sites."
HostGator apparently force-reset a bunch of customer passwords without asking first. I don't host with them so I can't say how that went over, but I'd guess not great, even if it was the right call.
Anyway. Techpad has run on WordPress since roughly the beginning, and I will confess, right here, that my admin username was "admin." I know. I KNOW. It's the default, it's lazy, and I've been telling other people for years not to do exactly this. There's a particular flavor of embarrassment in reading a security writeup and realizing you are, personally, the example of what not to do. I changed it Thursday night at close to midnight, created a new user with actual admin rights, demoted "admin" down to a subscriber with no login capability, and then went through and picked an actual password instead of the "clever" scheme I'd been using since maybe 2009 (a word plus a number plus a symbol, always the same shape, which if you think about it for ten seconds is barely better than no scheme at all).
I also finally installed a login-attempt limiter plugin, which locks an IP out after a handful of failed tries. Should've done this ages ago. It's free, it took about ninety seconds to set up, and I have no excuse for waiting this long other than the classic blogger disease of assuming bad things happen to other people's sites.
Here's my actual gripe though: WordPress still ships with "admin" as the suggested username by default in a lot of one-click hosting installs, and has for years. That's not really a WordPress core problem anymore since you can set it during install if you're paying attention, but plenty of hosts have older install scripts that don't ask, they just set it and hand you the login. If your platform's entire security model relies on millions of non-technical users happening to remember to change a default, you don't really have a security model. You have a hope.
I don't think this particular attack wave is anything close to catastrophic, to be clear. Most of the sites getting hit had weak passwords already, and the sites that get compromised this way tend to get used for spam pages or malware redirects rather than anything dramatic. But it's a good reminder that "small personal blog nobody reads" isn't actually a form of security. Bots don't care how many subscribers you have. They're not targeting you specifically, they're just running down a list.
If you run a WordPress site and you haven't looked at this yet, it genuinely takes fifteen minutes: change the username off admin if it's still admin, pick a real password (a password manager helps enormously here, I finally started using one for this exact reason), and grab a login limiter plugin. None of it is exciting. All of it is the kind of maintenance that only feels worthwhile after you've had the scare.
In unrelated site business, I'm still slowly migrating my RSS reading habits off Google Reader before the July shutdown, and Feedly has been fine so far, though the import from Reader dropped a couple of my older folder groupings and I haven't bothered fixing them. More on that another time, maybe, if I ever actually finish sorting it out.