I recently took a few weeks off blogging. Those few weeks turned into more than I expected because of a minor technical hitch. A couple of people I know had their self-hosted WordPress website hacked recently. Since I have the same type of installation, I followed a great article written by Marcy Kennedy on securing a WordPress site. It was all pretty easy stuff to follow. Well, ok, easy because Marcy wrote a guide even an idiot could follow, and I’m a certified idiot.
Everything went well. I installed plugins, changed usernames and stuff. Extra pages on the admin page told me this, that, and the other were all now protected from hacker voodoo. I slept like a lamb that night, happy that my site was safe for harm. And it was. Very safe. Completely protected. Unhackable.
Yes, no fear of harm to my website … because the following morning I couldn’t remember my new password. Was it uppercase-underscore, control-seven, alt-backspace? Grrrr. One of the handy dandy security features I added to my blog was a plugin to lock IP addresses out after a few unsuccessful login attempts … for 24hrs. Oh glee.
To cut this tedious story short, I finally got the correct combination of neurons together to remember the password and I’m back in business (I have a black belt in the bleeding obvious).
So, is there a point to this story? Yes. The lockout plugin records the failed login attempts, and in the past week the following *&@#^% scum have tried to log into my site. I’m pretty sure they weren’t going to share their secret recipes for brownies if they succeeded.
220.127.116.11 admin (1 lockout)
18.104.22.168 admin (1 lockout)
22.214.171.124 Admin (2 lockouts)
126.96.36.199 Admin (2 lockouts)
188.8.131.52 Admin (2 lockouts)
184.108.40.206 admin (22 lockouts), anyone (1 lockout), 2012july (1 lockout), sherry (1 lockout), places (1 lockout), delivered (1 lockout), important (1 lockout), reading (1 lockout), igelblackwel (1 lockout), but (1 lockout), there (1 lockout), same (1 lockout), elblackwe (1 lockout), lear (1 lockout), litter (1 lockout)
220.127.116.11 admin (3 lockouts)
18.104.22.168 Admin (1 lockout)
22.214.171.124 Admin (1 lockout)
126.96.36.199 Admin (1 lockout)
188.8.131.52 administrator (1 lockout)
These ip addresses range all over the world, with the Netherlands being the most active. Mind you, if these people go to all the trouble of trying to logging into my site, I’m sure they’re capable masking their real IP address, so they could be from anywhere. On the upside, my web host has tools to block ip addresses, so some of these are history, although I expect they’ll just pop up from a different address.
I feel like I want to rant and rave and put 20,000V between their keyboard and their mouse, but until the http syntax is updated with an “electrocute the buggers” command, I’ll have to make do with Marcy’s advice and my new password … whatever it is.
What passwords have you forgotten lately?