Originally published at: http://boingboing.net/2017/03/08/how-a-fishing-guides-wordpre.html
…
What, no outrageous “phishing” pun?
7 Likes
Eric doesn’t sell anything on his site. It consists of posts about fishing and a phone number to book trips. No hacker would bother with a site like that, right?
Wrong. There are bots trying every IP address, and when they get a web server, try every Wordpress exploit that they can. Even if you’re not running Wordpress.
8 Likes
8 Likes
An easy first step is make a custom URL for your wordpress admin log-in page
2 Likes
It doesn’t help if your FTP password is password.
1 Like
But Weebly’s safe, right?
2 Likes
Unfortunately bots are aggressively using XMLRPC and more recenntly WP-REST exploits rather than brute-forcing the login screen. I recommend the WordPress Plugin WordFence (free or Pro) and asking hosting providers to configure fail2ban on their WordPress hosting servers 
1 Like
Yeah wordfence seems to be working well for me. One of our websites ended up hosting a load of casino pages. Luckily we were retiring it anyway so it didn’t matter too much. Wordfence has kept everything else secure so far touch wood.
But “passw0rd” is still good, right?
2 Likes
Any site that uses a dynamic CMS like WordPress, Drupal, Joomla, etc., requires frequent maintenance by an expert. Just because it looks like a simple brochure doesn’t mean that it’s as safe as a piece of paper. If it has a dynamic underlying application, it will have vulnerabilities waiting to be found. The commonly used ones will certainly be hit. Custom built systems are more likely to have vulnerabilities, but they are less likely to be found and shared in the wild (since they only affect one site instead of millions). But of course, a maintainer familiar with the system will be rare.
These systems are sold as an ‘easier’ and ‘cheaper’ solution, allowing people to edit their own content without having to hire someone to maintain the site, to people who would often be better off with a static site anyway. Unfortunately, static site generators are still almost all geared toward techies and not site owners.
Another solution? Block access to any PHP you aren’t directly using, and use a 2FA plugin. This, auto updates, and jetpacks security plugin will virtually eliminate incursion attempts.
Ask me how I know 
4 Likes
This topic was automatically closed after 5 days. New replies are no longer allowed.
