At this time there is an attack being perpetuated by an unknown group of people, the attack is using more than 90,000 IP addresses to brute-force crack vulnerable WordPress and Joomla portals. WordPress is one of the most popular blogging platforms used around the world, this makes it A-1 target for these kind of attacks.

The goal of the attack is to gain access to already compromised accounts, and if that fails, go on fully exhaust a sites resources, and make the site come up unavailable.

Cloudfare indicated in a blog that another one of the concerns of an attack like this is that the attacker is using a relatively weak botnet of home PCs in order to build a much larger botnet of beefy servers in preparation for a future attack. These larger machines can cause much more damage in DDoS attacks because the servers have large network connections and are capable of generating significant amounts of traffic.

Matt Mullenweg the creator of WordPress stated that if you still use “admin” as a username on your blog, change it, use a strong password, if you’re on WP.com turn on two-factor authentication, and of course make sure you’re up-to-date on the latest version of WordPress. Do this and you’ll be ahead of 99% of sites out there and probably never have a problem. Most other advice isn’t great — supposedly this botnet has over 90,000 IP addresses, so an IP limiting or login throttling plugin isn’t going to be great (they could try from a different IP a second for 24 hours).

There are also a number of things that you can do to protect yourself, one easy one comes to mind, do not use obvious passwords. Also you can get a security plugin, and even for non-code savvy users it is an effective way to secure your site.