Security

The Wake-Up Call A few days ago my hosting provider sent me a friendly message: “Warning: 500 emails have just been sent by your account.” Not what you want to read on a Saturday evening. My first thought: someone dropped a PHP shell on my WordPress blog and is using it as a spam cannon. I renamed PHPMailer as an emergency brake and started digging. What It Actually Was The good news: no shell. WordPress core and all plugins passed their checksum checks, and there were no unknown admin logins. The culprit was my own security plugin. Wordfence was blocking a brute-force wave of about 500 login attempts, and it was configured to send me an email for every single block, with no hourly limit. So the security plugin did its job and still got me an abuse warning. ...

One of the worst things you can do on the internet is use the same password for different websites. When one of the webites is hacked or there is an bad sysadmin they can use your password to login your email or other sites to steal all your private information and worst case scenario your bank account. Every self respected browser has an built-in password safer but when your computer/laptop is stolen or hacked by a mad person (in dutch we call them klootzakken ;) ) they can easily steal all your passwords. So don’t use the built-in password safer (or configure a strong master password). ...