WordPress web sites are becoming more and more time consuming on a weekly / daily basis to keep up with the following items:
1. WordPress Plugin Updates (Careful use of any plugin)
2. Regular Scheduled Backups (Weekly / Monthly)
3. Proactive Security Updates ( WP Security Scan)
4. Performance Optimization
5. Malware prevention / cleanup & Performance Scans ( WordFence & GravityScan)
6. 24/7 Uptime Monitoring
WordPress websites needs continuous monitoring, maintenance and upgrading so that it can give optimum performance and stay safe from the hackers. But if your website is destined to be doomed someone should be there to restore the site from clean/latest backup.
Websites aren’t paintings that you hang up on the wall after they’re complete; they are an investment that needs to be looked after to keep the positive ROI.
With WordPress maintenance, I am pledging time to be your client’s website “bodyguard.” If anybody messes with your business, I’m going in there, guns blazing. Otherwise, you’ll sit quietly in the corner, keeping one eye shut and the other on the door.
Yes, this is different than regular ‘site maintenance‘, which has been outlined in your contracts. ‘Site maintenance’ has been focused on making changes to content / images on your current pages. Changes prices, changing content, adding fresh news are all examples of your existing ‘site maintenance’ agreement. WordPress Maintenance deals with security, backups, prevention and keeping up with various plugin updates.
Security is one of the most important aspects of running a website these days, as there truly are a lot of malicious people out there that can and will try to target your website (whether to try and steal your data, use your PC for a DDoS, or a number of other reasons known only to them).
WordPress web sites are constantly being hacked, or rather are ATTEMPTED to be hacked on a daily basis. WordPress security is all about proactivity. You know what they say, an ounce of prevention is worth a pound of cure, especially on the web. Most WP attacks initiate from Russia, China, France, India, Ukraine and the good ol’ USA.
(Great WP Security Article) – WordPress Security: The Ultimate Guide
(Best WP Security Plugins) – WordFence, iThemes Security, Sucuri Security, All in One WPSecurity, BulletProof Security. (Article)
Latest WordPress Security News
The total attacks from the top 25 attacking IPs decreased by 8% from August. Brute force attacks made up 91% of total attacks for September, the same as August. Complex attacks accounted for 9% of the volume.
Turkey topped the list this month with 11 of the top 25 IPs after having disappeared from the list last month. The four most active IPs were from Ukraine, with PP SKS-Lugan hosting three of them.
‘REDACTED‘ and ‘Revelance‘ themes were attacked a great deal in the past month w/ ‘mTheme-Unus‘ and ‘RightNow‘ themes being attacked the most!
The average number of daily brute force attacks was down 9% from last month after growing the previous two months. Daily attack volumes were stable for most of the month, but plummeted on the 27th, dropping by roughly half for the final five days.
Ukraine, Korea , followed by the United States were the top attacking IP addresses the past 2 months.
Theme Attacks – The most attacked theme was the ‘twentyseventeen’ theme, followed by the ‘sketch’ theme. ‘0 mTheme-Unus’, ‘Canvas’, ‘Flat-Bootstrap’, ‘Parallelus-Salutation’ were also themes that were heavily attacked.
The total attacks from the top 25 attacking IPs decreased slightly from 133 million in June to 124 million in July. Brute force attacks made up an amazing 87% of total attacks for July, up from 67% in June. Complex attacks accounted for 13% of the volume. As usual, the list is dominated by Russia, Ukraine, Turkey and India followed by the United States.
This list shows the themes with the greatest total number of attacks. mTheme-Unus, Canvas, Clockstone, Parallelus- Churchope, Dejavu, Elegance, Infocus, Epic, Trinity & Sealight.
This list shows the plugins with the greatest total number of attacks. Wp-Mobile-Detector, WP-Symposium, Recent-Backups, WP-Rocket & Really Simple Guest Post.
Backups Are Critical to Your WordPress Security Strategy – If your site is compromised, having access to backups can make your life considerably easier. The fastest way to recover from a hacked website is to restore the latest version of the site that existed prior to the hack. You will still need to close the security hole the attacker used to compromise your site after your site is back up and running, but at least you’ll have your site back to working order in hours or even minutes.
Without a good backup on hand, you’ll need to either manually clean your hacked websiteor pay an expert to do it for you. Many companies provide site cleaning services, including Wordfence. Many of them are quite reasonably priced, but with the right backup service you should be able to avoid this expense altogether.
UpdraftPlus Premium – BackUp Buddy –
Top Countries w/ Hackers
Russia 184.108.40.206 – Petersburg Internet Network ltd.
Ukraine 220.127.116.11 Pp Sks-lugan
UK 18.104.22.168 Aspire Technology Solutions Ltd
US 22.214.171.124 DataShack, LC
Korea 126.96.36.199 Korea Telecom
The hostname included is the PTR record (reverse DNS record) that the IP address owner created for the IP, so this is not reliable data, but we still include it for interest. For example, we have seen PTR records that claim an IP is a Tor exit node, when, based on traffic, it is clearly not. We also include the city and country, if available.
The total attacks from the top 25 attacking IPs increased from 137 million in April to 144 million in May. Brute force attacks made up 72% of total attacks for May, up from 68% in April. Complex attacks accounted for 28%. Turkey and Ukraine continued to dominate the top 25 list, accounting for 16 of the IPs on the list.
Popular WordPress Security Myths – Because of its incredible popularity as a platform, WordPress enjoys a sizable, generous community of users that spend their time sharing information, resources, tips and insights with other WordPress users online. Understandably, online security is at the forefront of concerns for many site owners, and a lot of the online conversation about WordPress centers around the best ways to keep your site safe from hackers and security breaches.
All That’s Needed to Lock Down a Site Is a Secure Username and Password – Certainly, using a strong password and unique admin username on your WordPress website is an important part of securing your site. After all, one of the basic tactics of hacker bots is to try a few thousand passwords with the default WordPress username “admin.” But the truth is that even if you have a secure username and password for your website, hackers may still be able to break into and take down your website using other means, such as security vulnerabilities in outdated plugins, data breaches or phishing. Sites that aren’t protected by two-factor authentication, which sends a code to your cell phone every time you log in as an admin, are especially at risk of exposure.
My Site Is Safe Because It Has an SSL Certificate – An SSL (or Secure Socket Layer) certificate adds a layer of security to the communication that takes place between your website and your visitors. Unfortunately, the security that an SSL certificate offers your website is purely transactional: it protects the information being passed between your site and your visitors, but – crucially – not the data housed on the site itself.
WordPress Itself Is an Insecure Platform – WordPress is the most popular content management software right now, Due to its popularity, WordPress has endured a few high-profile security scares in the past few years. While it may be the case that WordPress may be subject to more attacks than less popular CMSs, this doesn’t mean that WordPress is inherently less secure. On the contrary, because it powers millions of websites, WordPress has a passionately active international community of users and developers that collectively work 24/7/365 to find and patch any possible security vulnerabilities. The overwhelming vast majority of security compromises and hacking incidents – nearly 80% – are the result of outdated software and/or password exploits – that is, they’re due to either a weak username/password combo, or due to a vulnerability that the site admins failed to patch or fix in time, not an inherent flaw in the software itself.
Maintaining and optimizing the security of your website can seem like a very daunting and complicated undertaking. Site owners may struggle to parse an endless stream of information and advice that sometimes may even conflict. Determining what will really work and what is simply “security theater” can be extremely challenging, but armed with a good endpoint firewall, a secure username and password with two-factor authentication, and the most up-to-date site software, you can get a lot of peace of mind knowing that you’re making it as hard as possible for anyone to get through your website’s well-maintained defenses.
The distribution of brute force attacks compared to complex attacks among the top 25 attackers remained roughly the same. 32% of attacks on WordPress sites in April were complex attacks. 68% were brute force attacks. Brute force attacks remain by far the most popular attack method on WordPress sites.
Turkey made up a total of 11 of our top 25 attacking IPs in April. There are a total of 5 separate ISPs in Turkey that contributed to the top 25 attacking IPs.
Attacks on Themes in April 2017 – The most commonly attacked themes on WordPress for the month of April is surprisingly stable. Almost all themes in our top 25 were also in the list last month with a slight reshuffling.
mTheme-Unis, infocus, echelon, elegance, awake, dejavu, churchope, fusion, contruct, epic, authentic, NativeChurch, antioch, trinity, method, persuasion, myriad, modular, parallelus-mingle, infocus2, lote27 & urbancity.
Attacks by Country for April – Our usual suspects are still at the top of the list of the top countries from where attacks on WordPress originate.
Russia, Ukraine, US, Turkey, India, China, France, Brazil, Korea, Phiippines and Italy.
What does “Secure” actually mean in Chrome browser?
In order for a website to be labeled as ‘Secure’ by Chrome, it needs to set up SSL on its web server. As part of that process, it needs to contact a certificate authority (CA) to get a ‘certificate’. The CA is supposed to verify that the website owner actually owns the website. This process is called ‘domain validation’. Other than verifying that the domain owner actually owns the website, the CA is not required to do anything else.
In Chrome, when you see “Secure” in your browser location bar, it means that the connection between your browser and the website you are connected to is encrypted. It also means that the person who installed the certificate on the website actually owns the site domain. It does not mean that the domain is “Trusted”, “Safe”, “Not malicious” or anything else.
LetsEncrypt is providing valid SSL certificates to phishing sites
Until relatively recently, CAs would generally not issue an SSL certificate to a site that is obviously trying to pretend it is apple.com or microsoft.com. However, there is a new CA called LetsEncrypt which issues free certificates to websites who want to use SSL.
Even if a CA revokes a certificate, Chrome still shows it as “Valid” and “Secure”.
It turns out that this certificate has been “revoked”. What that means is that Comodo, the CA in this case, realized that the certificate belongs to a malicious website after they issued it and they decided to mark it as invalid.
Because Chrome does not check certificate revocation lists in real-time, it shows the certificate as valid in the location bar and the site as “Secure”. Chrome is unaware that Comodo has revoked the certificate after Comodo realized they should not have issued it in the first place.
What should you do to ensure you stay safe on the web?
The best way to protect yourself against malicious sites, in this case, is to check your web browser’s location bar and read the full website hostname that appears there.
Look at the location bar above. You should see ‘https://www.wordfence.com/….’. When visiting any website that you plan to exchange sensitive data with, check the full hostname after ‘https://’ and before the next forward slash. If you don’t recognize it or if it looks like it has some weird stuff on the end, close the window immediately and think carefully about how you ended up on that website.
Brute Force Attacks on WordPress in February 2017
As you can see we experienced a huge spike in brute force attack activity this February starting at approximately February 20th and sustaining until the end of the month. As a reminder, these are simply login guessing attacks. Wordfence blocked an average of 30 million brute force attacks per day across the websites that we protect in February. This is an increase from the 26 million attacks per day average we saw in January.
Attacks on Themes for February 2017
Once again we are not seeing much change in the rankings in the themes that are targeted for attack in WordPress. mTheme-Unus | ChurchOpe | Lote27 | Authemtic | Echelon | Elegance | Awake | inFocus | Dejavu | Persuasion | Fusion | Construct are the MOST attacked.
Attacks on Plugins for February 2017
Our biggest gainer among attacked plugins in February is wp-pagenavi which gained 28 places. Attackers occasionally install fake versions of this plugin once a site is compromised. These may be attempts by attackers to access a fake plugin as part of a check to see if a site has been compromised. These are blocked by Wordfence. – WP-Symposium, WP-ecomerce-shop-styling, recent-backups, candidate-application-form, wptf-image-gallery, wp-mobile-detector are the MOST attacked plugins.
Attacks by Country for February 2017
Russia, US, France, Ukraine, Turkey, Netherlands, India, Chine, Germany, Italy are where most attacks are initiated.
That concludes the attack report for February 2017. I hope this has given you a clear picture of the threat landscape that confronts WordPress currently. In this report the new topology analysis we included has provided unique insight on how threat actors spread themselves across countries and hosting providers.
We saw a huge spike in brute force attacks in February and an average drop in the number of complex attacks. There was little change in the attacked themes and some change in the plugins we are seeing targeted.
(From Airtable) Most Active IPs
In the table below we have listed the most active attack IPs for December 2016.
188.8.131.52 31.8 – Ukraine
184.108.40.206 12.4 – Russia Phoenix
220.127.116.11 6.3 – Ukraine
18.104.22.168 6.0 – Russia Petersburg
22.214.171.124 5.6 – Ukraine Kyivstar
126.96.36.199 5.5 – France
Complex Attacks vs Brute Force Attacks
A brute force attack is a password guessing attack that is simplistic and has a low likelihood of success. At Wordfence we consider a ‘complex’ attack to be an attack that tries to exploit a vulnerability in WordPress or a WordPress plugin. If you are using Wordfence to protect your WordPress website, brute force attacks are blocked by our brute-force protection and complex attacks are blocked by the Wordfence firewall. The top two IPs, one in Ukraine and one in Russia, are both using complex attacks to target WordPress websites.
Brute Force Attacks
If you recall our post on December 16th where we described a “Huge Increase in brute force attacks in December“, we saw a marked increase in the number of attacked sites starting in late November.