Security Threat: WordPress Under Attack

Re: Security Threat: WordPress Under Attack by _ck_ on Saturday September 05, 2009 @09:34AM (#806504)

Install this simple plugin on any version of WordPress to block bad queries like that:

http://pastebin.com/f6697b79

It could easily be expanded to also look at $_POST data which is another form of attack you'll never see in your logs.

[ Parent | on HN ]

Re: Security Threat: WordPress Under Attack by duskwuff on Saturday September 05, 2009 @03:12PM (#806901)

The bad queries show up after your blog has already been hacked.

[ Parent | on HN ]

Re: Security Threat: WordPress Under Attack by _ck_ on Saturday September 05, 2009 @11:45PM (#807436)

Part of the attack is via XSS using $_GET queries that are very long. Apache defaults to accepting URLS up to 4K long which is insane and allows such attacks to happen. 255 characters is a far better lockdown with very few if any false positives.

[ Parent | on HN ]