As we all know most Popular Blogging Platform is WordPress, and now it is under Brute Force Attack. There are mainly two types of web attacks i.e. Active Attack and Passive Attack. In active attack the attacker tries to gain access of the website resource and change them where in Passive attack there is no change of the contents. Matt Mullenweg has mentioned in a recent post about the Brute Force Attack against WordPress Blogs. Type of attack that is being used to launch the mass scale attack on WordPress sites is Botnet Attack or DDOS Attack. Modus operandi which is being employed to launch attack against WordPress Sites is using WordPress Login which is in most cases admin (by default). Before going on to describe the plugins to recover from a Hacked WordPress Website, Find some of the information about Botnet or DDOS Attack against WordPress
Brute Force Attack against WordPress Blogs
What is Distributed Denial of Service Attack?
Distribute Denial of Service or DDOS Attack is one of the types in which DOS (Denial of Service) Attack can take place. The sole purpose of any DOS attack is to disturb the availability of the resources so that legitimate requests are not replied by the server. DDOS attack is a subclass of DOS attack in which an attacker doesn’t launch the attack on the victim directly, rather attacker infects many computers known as Zombies and then using these thousands of Zombies attack is launched against a victim. It is very harmful attack as there is more than a victim in DDOS attack and it’s very hard traces back to the real attacker as you can’t block DDOS Attack by Blocking a Single IP Address. There is one more term which is used very often in DDOS attacks, BOT is defined as the network of Zombies which are used to launch attacks against a victim.
Image Credit – http://www.sitetrail.com/
How DDOS Attack is launching against WordPress using Brute Force Attack
In the earlier section DDOS attack using Zombies or BOT network is explained and now I will explain how it is used to launch attacks against WordPress Blogs. As all Users of WordPress site knows that by default ‘admin’ is the username which is used to logon into your Blog Administration Dashboard. This is the vulnerability which is being exploited by the attacker in which many Zombies are used simultaneously to launch Brute Force Attack to Hack or gain access of the WordPress Blogs. In Brute Force Attack attacker use every possible combination of password and since they know most of the Blogs are running with ‘admin’ username it makes them easier to break the security.
How to Prevent WordPress from DDOS Attack
In the earlier I have discussed ways to prevent your WordPress from getting hacked. Here I am listing some of the things that should be implemented by WordPress Bloggers to prevent their Blog from Brute Force Attack using Zombies.
- Change WordPress Default username from ‘admin’ to something which is more difficult to guess by attackers
- Create and Use Complex Password with Small and large cap letters with number and a special character makes them harder to get cracked even by a Brute Force Attack
- Use CDN Service such as Cloudfare which offers free CDN service to the Bloggers. Through CDN you can add a rule to detect the signal such Brute Force Attack using Zombies so that the malicious request it stopped.
- Try to Enable and Use Two Step Authentication
These all are the methods that can prevent your WordPress Blogs from getting attacked by a Brute Force Attack, I am going to tell Best WordPress Plugins to detect and prevent from Brute Force Attack
WordPress Plugin to Prevent Brute Force Attack
Here are some of the Best WordPress Plugins to fix Hacking issues on your Blog and Website.
- Recommended – Sucuri is the professional web service which can help to resolve any malware activity on your Blog and Website. Sucuri supports multiple CMS Platforms like WordPress, Joomla and others. Three main services are provided i.e. Monitoring, Alerting and Removal.
1 Wordfence
WordPress Security is a Free Plugin that included everything that are needed to protect your Blog from malicious activity. It has a Firewall, Antivirus, and Malicious URL scans from live traffic. You can scan theme and core files also from the Wordfence Security Plugin.
2 Limit Login Attempts Plugin
As I mention earlier that Brute Force Attack works by trying all the possible password combinations, so it is pretty much clear that the attacker will try different passwords to get the right one. In this case Limit Login Attempts Plugin comes handy which locks out anyone that tries (and fails) to login to your site for a set time.
3 Login Lockdown Plugin
Login LockDown records the IP address and timestamp of every failed login attempt. If more than a certain number of attempts are detected within a short period of time from the same IP range, then the login function is disabled for all requests from that range. This helps to prevent brute force password discovery
DDOS Attack Image Source
