Hackers Point Large Botnet At WordPress Sites To Steal Admin Passwords And Gain Server Access
If you're running a WordPress site, now would be a good time to ensure you are using very strong passwords and to make sure your username is not “admin.” According to reports from HostGator and CloudFlare …
Context & Ripple Effects
The attack follows a pattern that has been building for years: hundreds of WordPress blogs were hijacked to serve malware back in April 2010, and a breach of WordPress.com's servers exposed source code in April 2011. What is new here is scale and method — rather than exploiting software flaws, attackers are pointing a large botnet at admin login pages themselves, brute-forcing credentials on self-hosted sites.
The story travelled unusually widely for an infrastructure incident: HostGator, Ars Technica, Krebs on Security, Forbes, AllThingsD and The Next Web all picked it up on or about April 12, 2013, with HostGator and CloudFlare serving as the primary witnesses. That breadth reflects how much of the web sits on WordPress and shared hosting.
First-order effects
- Site owners running default 'admin' usernames or weak passwords face immediate account-takeover risk, since the botnet gains full server access once an admin password falls.
- Hosts like HostGator absorb the direct load, as sustained brute-force traffic across thousands of customer sites taxes shared-infrastructure resources.
Second-order effects
- CloudFlare's role as first observer positions it and similar edge networks to sell login protection and rate-limiting as a service, converting the threat into demand for its mitigation layer.
- Hosting providers are pushed toward mandatory hardening — forced password resets, login throttling, and dropping 'admin' as a default username — raising baseline costs across the shared-hosting market.
Third-order effects
- If botnet-scale credential attacks become routine, authentication defense migrates from individual site owners to infrastructure providers, making two-factor and network-level login protection a default expectation rather than an opt-in.
- WordPress's dominance as a CMS makes it a single high-value target, so its ecosystem's security posture increasingly shapes the security of the open web as a whole.
The trend: Botnet-driven credential attacks against the web's dominant publishing platforms are shifting the burden of authentication security from individual site owners up to hosts and edge-network providers.