Wordpress under attack

[Richard King]

Wordpress users need to read this:

http://lorelle.wordpress.com/2009/09/04/old-wordpress-versions-under-attack/
http://wordpress.org/support/topic/307660

This lot will help too:

1. Correct directory permissions
2. A policy of strong passwords & usenames
3. Passwording off the wp-admin folder using apache
4. Disallowing directory listings
5. Removing the WP version from the source code
6. Use of a bad behaviour plugin
7. Effective control of comments (and slightly off topic: control of trackbacks and pingbacks)
8. Keeping plugins up to date too
9. Ensuring the version of PHP and SQL on the server is up to date
10. Ensuring the settings for PHP on the server are sensible and promote security

 

[whitey]

Pleased mine is upto date

I had noticed however that my spam plugin rocketed from something like 170 upto 395 spam comments blocked the other day

now it makes sense

 

[Marcel]

Cheers for that, I was given the headsup a couple of days ago. I haven't been attacked (I don't think), but upgraded to 2.8.4 as a precaution. Install went smoothly

 

[KayJay]

Do the upgrade like they tell you and you'll be fine.

 

[Craikeybaby]

I logged into my admin panel yesterday, to sort something else out and noticed that I had a spam comment on one of my posts, when comments have been disabled, I deleted it and upgraded. Hopefully that fixes it!

 

[Marcel]

If youve been hacked, just upgrading wont be enough.
Check the two links Richard posted and see if any of the 'signs' are applicable to you
(The changed permalinks, or the extra user(s))

 

[AboutLee]

Ive just installed wordpress on my site for my new launch! Lol But i know im upto date as i downloaded the latest patch from wordpress! Thanks for the info!

 

[xendistar]

Found this article for actually dealing with an infection

http://blog.ambor.com/2009/07/how-to-remove-go00oglenet-infection.html

Tim

 

[Richard King]

I logged into my admin panel yesterday, to sort something else out and noticed that I had a spam comment on one of my posts, when comments have been disabled, I deleted it and upgraded. Hopefully that fixes it!

You can totally delete the comenting front end code out of your template, and further to that you can cripple it by adjusting a few core files

 

[Craikeybaby]

That has been on my todo list for a while, but I'll be moving away from WP for my site now anyway.