Defying Brute Force Attacks on WordPress Logins

Sucuri, the web security specialists, published “Brute force attacks against WordPress sites,” an in depth look at not just the importance of a strong password but the brute force nature and anatomy of login and registration access attacks.

There is a technique known as brute-force attack. Like the name implies, access is gained to your environment through brute force. Often conducted by bots, these attacks will run through a compiled list of common passwords and their permutations (i.e., password, Pa$$w0rd, p@ssw0rd, etc..). Yes, the attackers know that you substitute ‘A’ for an ‘@’ and ‘S’ for a ‘$’. Using this method the attackers are gaining access to your wp-admin, this then allows them to serve spam via your posts, deface your home page like we recently saw with ServerPro, and inject any one of the other types of malware roaming the interwebs.

Because of the consistency and prevalence of these attacks, we decided to test it for ourselves. We created a couple different honey pots with the intent of identifying the types of passwords being used, and to better understand the anatomy of these attacks. It didn’t take long. Within a few days, we had captured so much data that we had to share it with you.

The article features a list of the most common passwords used across all secure logins as well as WordPress, and used in these brute force login attacks. By now you should all know that the most common password used worldwide is “password,” proof that we somehow never learn. I’ve written extensively on how to create a strong password, and it appears it’s time for another lesson, especially on how to deal with the famous “admin” login issue with WordPress.

It’s also time to remind you to update WordPress whenever there is an announcement of a mandatory security release. Don’t wait. There are evil doers just waiting for security vulnerabilities on older, out-of-date versions of WordPress, PHP, MySQL, etc. Update immediately and don’t risk your site.

Creating a Strong Password

In my training programs and college courses I teach people how to create an easy-to-remember and simple password with punch. It involves some creative thought and familiarity with Leetspeak.

The guidelines for a strong password are to use numbers, mixed capitalization, and symbols and never use the same password for everything. People usually panic, assuming that their life is complicated enough without trying to remember 800 passwords, so we make it easy.

Pick a simple, easy-to-remember, or unique word. Make it the same for every password so you will always remember it. Add it to the name of the site, service, or app to make a compound word. If your word was elephant, you would make your Gmail account gmailelephant or elephantgmail, your WordPress site called “My Site” could be mysiteelephant, and your YouTube account elephantyoutube. Sounds simple, but we don’t stop there. It’s important to make your password fairly bullet proof so we translate it into Leet.

For example, if you are accessing your WordPress site, your password might be WordPressjack and convert into Leet as:

W02dPr355j@(k

If you were accessing your Gmail account, an example following this formula for Gmailjack would be:

6m@i1j@(k

Wikipedia’s Leet article features all the variations on the letters of the alphabet that can be found in Leet, showcasing the versatility and flexibility of using Leet to replace alphabet characters in a password.

For example, the following are Leet options for the letter M:

• 44
• /\/\
• |\/|
• em
• |v|
• IYI
• IVI
• [V]
• ^
• nn
• //\\//\\
• (V)
• (\/)
• /|\
• /|/|
• .\\
• /^\
• /V\
• |^|
• AA

So “Gmail” could be spelled 644@i1, 6?/\/\@i1, 6IVIail, Gnn@11, or other Leet variations, opening up a wide range of possibilities. Your Gmail password in Leetspeak could be completely different from the one someone else uses following this format.

In my example above, I used “Jack” as my unique word at the end of the password. You can use any name, place, or any made-up word. A friend likes the word “syzygy” and uses that as the unique first or last word in all their passwords. In Leet, one spelling variation might be $j2`/6j. Combined with WordPress for “WordPresssyzygy,” it could be W02dPr355$j2`/6j, a seriously strong password.

Creating passwords this way keeps them unique and yet easy to remember, and different for everything you are using. With the flexibility of Leet, there are infinite ways to mix and match letters so you could vary the unique word spelling and change it annually. It meets the requirements for a mix of alphanumeric characters and mixed caps and makes it challenging to break through.

Changing the WordPress Admin Username

While WordPress and WordPress.com offer a unique password generator and offer a password strength indicator when you create your own, it doesn’t create the username, save for the default “admin” username upon installation or activation.

The first step in protecting your WordPress site’s security is changing the “admin” username. The second step to truly protecting your username and password is to create a second account for day-to-day use, leaving the administrator user level for those special occasions when you need to go under the hood.

To change the default “admin” username, you need to add a second Administrator account. However, WordPress permits only one unique email account per site, so you have to fool it. I have instructions below on how to do that if you don’t have a second email address.

The instructions for changing the default username from “admin” to anything else is:

1. Go to Users > Invite New.
2. Add a new user (yourself) with the second email address and set the user authority level to Administrator.
3. Log out of your site.
4. Go to your email and accept the invitation and login to confirm.
5. Go to Users.
6. Select the original Administrator account with the username “admin.”
7. Click Delete.
8. In the Delete panel, select Attribute all posts and links to… and select the new username.

From that point forward, log in with the new account as Administrator.

If you use a second email account and wish to use the original email address, after completing the above, go to your User Profile and change the email address back. If you do not have a second email account, most email services permit the plus method of creating custom email addresses. For example, in Google Gmail, you can add a + to your email address to create a unique email such as myemail+wordpress@gmail.com. All email delivered to that email address goes to your myemail@gamil.com address, ignoring the plus words. Check with your email host for their method.

Creating a Safe User Account

I travel extensively and can’t always trust the Internet connection I’m on for security. Nor can most people as they take their blogging experience from the home or office desktop computer to laptops, mobile phones, and tablets. It is more important than ever to create a separate user account for accessing your site in public with less permission authority thus adding some security protection to your site.

The Administrator user level has complete power and control over all aspects of your site, from adding content to injecting code into Themes and Plugins. The Editor and Author user levels restrict access to the customization and code-level features of your site, limiting access to publishing content and comment management, where most of us spend the majority of our time. When I don’t need administrator clearance, I log in with my Editor or Author user accounts. If those usernames and passwords are stolen or broken into, they can only go so far in causing damage.

To create an Author or Editor user account, you will need a second email address (see above for details).

1. Go to Users > Invite New.
2. Add a new user with the second email address and set the user authority level to Author or Editor.
3. Log out of your site.
4. Go to your email and accept the invitation and login to confirm.

When you need to make design or code changes, use your Administrator login. The rest of the time, use your Author or Editor login and you’ve added another level of security to your site.

If you would like to use a WordPress Plugin to change the username and protect the Administrator account, give these a try.

• WPVN – Username Changer WordPress Plugin
• Better WP Security WordPress Plugin
• Lockdown WP Admin WordPress Plugin
• MJP Security Plugin WordPress Plugin
• Allow Multiple Accounts
• Add Multiple Users for WordPress WordPress Plugin

Hat Tip: WP Tavern

---

Subscribe Via Feedburner Subscribe by Email

Copyright Lorelle VanFossen.