Sites developed with WordPress have been under attack from a botnet of tens of thousands of computers for the past week.
The botnet is using a brute force attack on the admin users to try and gain access to the sites administration. Once within the administration the hackers will be able to insert malicious code that will help grow the botnet.
According to survey website W3Techs, around 17% of the world’s websites are powered by WordPress which is around 64 million sites, with a readership of over 371 million people each month.
WordPress.com have implemented optional two-step authentication but this has not been officially rolled out to sites hosted on their own server.
WordPress are currently advising that anyone using admin as a user should make sure they use a secure password (we recommend at least 10 characters using uppercase, lowercase, numbers and special characters).
Due to the increased threat to wordpress sites we have manually audited all our clients, updated installations and plugins, made sure no client is using admin, updated insecure passwords, and installed captchas.
Source: BBC