Wordpress Blog Hijacked?

[dravid]

Not with this plugin. Pretty much anyone can hijack your username and password and take over your blog…not if you’re using this wp plugin.

 

[paul]

What number do you dial ?

Is there a charge for this ?

 

[Cormac]

I don't get it. Why would somebody use SMS instead of something like email to two step authenticate their login?

Who pays for the text message?
What if the SMS server is down? - Can I still login?
What does the plugin author do with my mobile number?

There are other ways to get hijacked other than simple username/password breaches. Just use SSL on your login page if you are concerned about u/p sniffing.

 

[Forbairt]

safest thing is to never put your wordpress blog online ... don't put it on any computer that is in any way connected to the internet as well ...

 

[gav240z]

Wordpress is ok...

safest thing is to never put your wordpress blog online ... don't put it on any computer that is in any way connected to the internet as well ...

LOL. To be fair wordpress is targeted for the same reasons that MS windows and IE are. Because a majority of websites use it.

Safest way to keep your wordpress installation from being exploited is to keep it up to date and run it on a secure hosting service.

I recently failed to keep up to date and paid the price. Albeit a small one.

One thing I hate about WP is that it outputs <meta generator="Wordpress 2.5.1"> its just a red flag to a bull when it comes to scripts / script kiddies. Of course there are other ways to tell its WP but why make it more obvious than need be.

 

[paul]

I am going to run this on all my blogs tonight : WordPress › WordPress Exploit Scanner WordPress Plugins

 

[Cormac]

I installed it earlier, Paul.
It gave me a few alerts about a spell checking plugin I installed for TinyMCE. Handy plugin.