Category: WordPress

Distributed Brute Force Attack On WordPress wp-login.php

April 15, 2013

Over the last few days many WordPress websites have encountered problems due to a massive distribute brute force attack on the wp-login.php script. The hackers are using a network (botnet) of compromised servers (bots) to repeatedly attempt to login to WordPress using common usernames and weak passwords. The botnet may contain as many as 90,000 unique IP addresses. The scale of the attacks has created problems at some hosting companies: IX Web Hosting http://status.ixwebhosting.com/2013/04/11/global-server-wordpress-issues/ Hostgator http://blog.hostgator.com/2013/04/11/global-wordpress-brute-force-flood/ Daniel Cid at Sucuri Blog discusses how these attacks have increased over the last few days: http://blog.sucuri.net/2013/04/mass-wordpress-brute-force-attacks-myth-or-reality.html There are a number of ways to mitigate the attacks including: Password Protect wp-login.php This is a good solution if you have a limited number of people who have to login to WordPress. Here are instructions from Hostgator on how to add password protection: http://support.hostgator.com/articles/specialized-help/technical/wordpress/wordpress-login-brute-force-attack Other hosts and control panels should be similar. Rename wp-login.php This solution

Find TimThumb Versions

March 11, 2013

Versions of the TimThumb script prior to 1.34 have a serious security vulnerability. Here’s a one liner to find the versions of all TimThumb installs on a server:


find -name '*.php' -exec grep -q TimThumb {} \; -exec grep "'VERSION'" {} \; -print

find -name '*.php' -exec grep -q TimThumb {} \; -exec grep "'VERSION'" {} \; -print

Discourage HTTPS On WordPress

January 16, 2013

Recently we had a WordPress site where that used HTTPS (SSL) on the login/admin areas. But we wanted to discourage HTTPS for non-admin URL. Here are the rewrite rules that ended up using in a .htaccess file:


RewriteEngine On
RewriteCond %{HTTPS} on
RewriteCond %{REQUEST_URI} !^\/wp\-admin
RewriteCond %{REQUEST_URI} !^\/wp\-login.php
RewriteCond %{REQUEST_URI} !^\/wp\-includes
RewriteCond %{REQUEST_URI} !^\/wp\-content\/plugins
RewriteRule (.*) http://%{HTTP_HOST}%{REQUEST_URI} [R,L]

RewriteEngine On

RewriteCond %{HTTPS} on

RewriteCond %{REQUEST_URI} !^\/wp\-admin

RewriteCond %{REQUEST_URI} !^\/wp\-login.php

RewriteCond %{REQUEST_URI} !^\/wp\-includes

RewriteCond %{REQUEST_URI} !^\/wp\-content\/plugins

RewriteRule (.*) http://%{HTTP_HOST}%{REQUEST_URI} [R,L]

Find All WordPress Instances On A Server

July 11, 2012

Here’s a handy one-liner to find all instances of WordPress on a server as well as their version numbers:


find . -name 'version.php' -path '*wp-includes/*' -print \
   -exec grep '$wp_version =' {} \; -exec echo '' \;

find . -name 'version.php' -path '*wp-includes/*' -print \

-exec grep '$wp_version =' {} \; -exec echo '' \;

This is not original, I found it here.

WordPress URL Rewrites On Plesk 10 Windows

May 19, 2012

We needed to get URL rewrites working on a Plesk 10 Windows server for a client wanting friendly URLs in WordPress. Turned out to be pretty easy …. 1. Make sure the Microsoft IIS URL Rewrite 2 extension is installed. You can find it here: http://www.iis.net/download/URLRewrite 2. Create a web.config file in the folder where you have WordPress installed with the following:


<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.webServer>
<rewrite>
    <rules>
        <rule name="Main Rule" stopProcessing="true">
            <match url=".*" />
            <conditions logicalGrouping="MatchAll">
                <add input="{REQUEST_FILENAME}" matchType="IsFile" negate="true" />
                <add input="{REQUEST_FILENAME}" matchType="IsDirectory" negate="true" />
            </conditions>
            <action type="Rewrite" url="index.php/{R:0}" />
        </rule>
    </rules>
</rewrite>
</system.webServer>
</configuration>