Well, I found in my GoogleReader a post by Caroline Middlebrook from yesterday about her blog being taken down again by her host. Unfortunately, as I’m writing this and trying to link to it her blog is gone!  So I will just try to recap what she was explaining.

Basically, she hadn’t secured her WordPress installations and her blogs became infected with a nasty Trojan. The virus hijacked her pages and redirected folks to pages full of ads and probably even malware.  She said it was easy to remove (there was some rogue code in one of her themes which was easily deleted), but the problem was how to prevent from happening again?  I’m going to leave it to Caroline to explain the following (once her blog is back up and safe):

• Older WordPress Versions are Dangerous
• Securing Files & Directories
• Installing WordPress Manually

Many of us use WordPress as our blogging platform. It’s easy to install and easy to use.  I admit I still have versions of WordPress running the older versions (the one with the blue interface!).  Check out my blogroll links on my WordPress 2.1.2 site – I didn’t add those in there, so how did they get in there? Luckily the theme I’m using doesn’t show the blogroll!

Your blog is your baby. Your blog is an expression of you and what you teach!  And if you have discovered your blog was sick with viruses or plagues or other types of security issues, I’m sure reacted just as a scared parent should. Panic, hyperventilation, then  frantic researching on how to make your baby better!   Here is a link to the Hardening WordPress page, directly from the source.  Please read the whole page, but really pay attention to the information on keeping WordPress up to date and reporting bugs.  The folks at WordPress can’t help you if they don’t know what’s wrong.

Also, read the sections about securing the Admin page and securing by obscurity.  This is one thing that really irks me about scripts such as WordPress.  Everyone is using it, so everyone knows how to access your admin page.  I admit, if I see a cool service and I think it might be a custom WordPress blog, I will take a peek to see if /wp-admin exists to satisfy my curiosity  Usually, if it doesn’t affect the script, when I install a script that has an admin folder (like /wp-admin, /admin or /administrator), I will simply rename the directory.

A little off topic…

Lately, I’ve been experimenting with Blogger, and I have to say – I’m loving it.  It’s easy to use and you can choose from a variety of templates. Nice users have converted many popular WordPress templates to work with Blogger. The two biggest benefits are you can use your own domain name and its F-R-E-E!  As it’s gaining popularity as a “serious” blogging platform, there are plenty of folks making widgets for Blogger as well.  Now, Blogger is no replacement for running a WordPress blog on your own server, but and I’m just guessing, it must be pretty secure (I mean its Google-owned an all).

And, no one can access your admin page!  (just something to think about)