Both plugin authors have already patched their plugins. Because these are widely used and it is a serious WordPress vulnerability (which has now been made extremely public), we decided to push an automatic update to all Lightning Base-hosted sites. This means you should be taken care of. If the plugin authors add any additional security updates in the next few days we will push those out as well.

Unlike the brute force attack we recently posted about, this requires no action on our clients’ part, so we will not be bothering everyone with another security-related email. If you always want to catch these types of updates, we have an RSS feed or you can follow us on Twitter/Facebook.

As always, if you have any questions, don’t hesitate to get in touch.

A brute force attack in progress.

What is a Happening?

WordPress sites of all kinds are seeing large amounts of traffic trying to login at wp-login.php. This is what we refer to as a brute-force attack – rather than using some fancy trick to compromise your site, a hacker is just going at it with a giant list of passwords and hoping to find one that works.

The attack uses thousands of IP’s and is almost certainly the product of a botnet, most likely of compromised desktop machines. By using a large network it is harder to block the attack (we can’t just mark a few IP’s in the firewall) and the attacker has the ability to do a tremendous amount of volume.

It appears that sites are being targeted largely at random. There are a variety of ways that the Internet can be scanned for WordPress installations, and I would guess the attack is using a system to automatically scan for WP installations, and then roll through each URL to attempt a compromise. More popular sites seem to more frequently be targets, which could be intentional, or might just be a byproduct of how the sites are being found.

One of the primary ways the attack was noticed was that some hosts started seeing downtime due to high load. When the attack starts hammering away hard enough at a site, servers without enough excess capacity get bogged down or possibly even inaccessible. Lightning Base has not seen any occurrence of downtime related to this attack, which is likely due to the headroom on our servers and pre-existing brute force protection.

The Lightning Base Response

Brute force attacks against WP are nothing new – Lightning Base has always had some basic protection against these kinds of exploits. The attacks have historically been much more limited than we are seeing now however.

In order to provide further protection, we have tweaked our brute force rules to be considerably more aggressive. This may result in a legitimate user being blocked from logging in to a site. These blocks are temporary – I would suggest trying to avoid them by typing your password carefully and not visiting the wp-login.php page excessively. If you do get blocked, come back an hour out so later, and contact support if you still can’t get in.

Also, just to note, if an IP is blocked from one site, it will be blocked from logging in to all sites on that server. For those of you with multiple sites, you will be at higher risk of accidentally being blocked if you are rapidly logging in to multiple sites. This is helpful, however, as it provides substantially better protection.

We will continue tweaking our rules as we learn more about the attack.

The Reality of a Brute Force (Strong Passwords Win)

The interesting thing about a brute force attack like this is that it should not work. If you use a password that is over 8 characters and includes upper/lower case letters, numbers, and symbols, the number of possible combinations rises into the quadrillions. To have even an off-chance of getting it right, trillions of guesses would be required.

Our servers might be fast, but they aren’t fast enough to allow trillions of guesses, even if we wanted them to (and remember, that would only make for a slim chance of getting in) . Add in the protections we have put in place, and it would be unlikely to see more than a few thousand guesses, even with many IP’s.

The problem is that many users use terrible passwords. The attack is almost certainly not guessing completely random combinations – it most likely uses words, acronyms, or other more common strings, combined with some numbers or symbols perhaps. This can rapidly knock down the number of guesses required to the thousands, which gives them a real shot if users have not used random passwords.

Morale of the story: A few letters or a word combined with a number is not secure at all. A random combination of characters is incredibly secure.

What You Can Do

In order to avoid being compromised by a brute force attack, the first thing you should do is make sure you have a strong password. To do this, login to your WordPress dashboard, then in the menu click Users -> Your Profile. Near the bottom of the page there is a password change box, which includes a handy password strength indicator. Make sure you choose a password that maxes out that bar.

That should make you very safe. Add in our brute force protection and you probably have nothing to worry about.

There are also a large number of plugins dealing with security. You are free to run most any of these on our system. I don’t believe any are necessary, however, given what we have seen.

And just to reiterate: use a strong password.

If you have any questions about what is going on, or particular concerns about your site, please open a support ticket (https://secure.lightningbase.com/submitticket.php) and we will be happy to help out.

There won’t be anything obviously exciting for most users, but this does contain a few bug fixes and addresses security issues.

Sites set to receive either major or minor updates should receive this update automatically tonight. For everyone else, I recommend you update at your soonest convenience. This does fix some potential security problems and is unlikely to cause issue with many plugins or themes.

In other news, we’ve been trying to get some updates done to the Lightning Base service in the midst of bringing on new clients. You will hopefully be seeing updates here in the coming weeks regarding some exciting additions and improvements to what we offer.

If you have any questions, as always, just get in touch.

Getting Upgraded

We’re considering this a major update – if you’re set to have major updates automatically run, the upgrade should have already taken place and there will be a backup in your account. Clients configured for minor updates only (which is generally our recommendation) will not receive this update automatically.

As always, I strongly encourage everyone to update soon. Keeping up to date gives you access to any new features, and is a key part of keeping your WordPress installation secure. You’ll want to check your plugins/themes for updates as well, as there are always a slew of them released in time with new WP versions, often offering tweaks for compatibility with the new release.

We have not seen any problems with our hosting configuration and WordPress 3.5. If you do upgrade and experience any issues, get in touch and we’ll be happy to help.

What’s New in WordPress 3.5?

This new version has some nice features, especially the upgraded media manager:

WordPress 3.5 Media Manager

It’s nice to use, and will be even better for those of you that like to create galleries.

Also included is the new 2012 theme, a high-resolution dashboard, integration with “favorite” plugins from WordPress.org, and more.

As usual, there are also a couple changes that could cause confusion. The “HTML” tab in the post editor has been renamed “Text,” although it still operates the same way. I believe this change is related to the fact that the tab has never offered complete HTML support. The other possibly confusing change is that the “Links” menu has been removed from new installs – not many people seem to use that, but if it’s something you like, there is a plugin to get back the Links menu.

More Info

If you want some information straight from the source, you can check out the WordPress.org blog post regarding “Elvin.” Also interesting is to look at the WordPress download count – you can still be among the first million!

We’ve been up and running in Frankfurt now for over a month, and have already brought over some existing clients, as well as a few new ones that just couldn’t wait.

The Same Thing, But Across An Ocean

Our European setup is basically identical to the US location, with the same redundant systems, the same WordPress-specific server setup, and of course the same service our current customers receive.

New customers will benefit from the experience we have working with US clients, hosting their WordPress based websites. We’ve made numerous improvements over that time, hitting version 2.0, what could be called 3.0, adding many useful features, and increasing the expertise of our support.

Even better, you can access the remote location from your same account. You’ll need an additional plan, but you can easily create and manage both US and Europe sites right inside our control panel.

Why Europe? Why Frankfurt?

The Internet is all just up in the clouds right? So why bother?

Speed

Frankfurt is over 5000 miles from Las Vegas. Or a little under .2 seconds, in terms of Internet distance. I expect sites hosted in Europe will experience a solid .1+ second improvement in response times for European users as compared to our US location. This isn’t a lot, but it counts on every single pageload – and with sites that experience thousands of these, that equals hours saved every month.

More importantly, this .1 second is a perceivable difference, especially on a fast connection. We want your sites to be fast, and there’s no reason to handicap ourselves by using servers that are too far away. Our CDN helps with the static content, but there’s no getting around the distance on that initial response to every single click.

Regarding Frankfurt – within Europe it’s a great location. It is relatively central, has a tremendous number of Internet connections running through it, and is not in a place likely to suffer a major natural disaster. We are also able to partner with the same company for datacenter space as in the US.

Regulation

The EU has a set of privacy regulations that are different from those in the US. We aren’t lawyers here and I’m not going to try and give legal advice about how to deal with that fact. But I know some companies feel more comfortable if private information (such as phone numbers and email addresses included in form submissions) are kept within the EU, and now we can help them do that.

Which Location is Best for You?

So where should you have your site hosted? First, remember that this is not a critical decision – our hosting often results in performance gains of several seconds over the old hosts’ of transfer sites. So relatively speaking, geography does not matter as much. But if you want that last little bit of speed, proximity counts. Here are some thoughts:

- If almost all your visitors are in the US or Europe, it’s an easy choice. This is typical for small businesses located in either place.
- The US location is faster to North America, South America, Eastern Asia and generally Australia.
- The European location is faster to Europe, Africa, the Middle East, Western Asia, and generally India.

If you have a blend of traffic from many countries, it’s nice to be located near the server yourself, as it will make the dashboard more responsive.

How To Get Setup

Getting your site running at our Frankfurt location is easy. Visit our shopping cart, choose your plan, and you’ll get an option to register a domain. Once you enter your domain, you’ll see this:

Select Your Location

That location box is a new addition, which defaults to Las Vegas. But give it a click and you can change it to:

European Location Selected

Your account will be automatically provisioned on a server at our Frankfurt location. WordPress will be auto-installed, and if you registered a new domain with us, it should be pointed at the server and ready to go within a few minutes.

What’s Next?

Adding a second location to our setup has been a big change. For those of you not located near either of our datacenters, the good news is that adding one will make it easier to add more, and I do expect to bring additional locations online over the coming year. If there’s a city you would prefer, let us know.

We have some other new features on the way as well, including an upcoming email service, and a number of upgrades to our client area. These should roll out in the next few weeks – you’ll see updates on this blog as they happen.

If you have any questions, or need help getting an account setup, don’t hesitate to get in touch.

To see the formal announcement, read the press release below.

Press Release

Lightning Base Expands: Adds European Location to Managed WordPress Web Hosting Service

Lightning Base LLC announced today the public availability of its managed WordPress web hosting in Europe, providing faster response times and a local regulatory environment for European firms.

Lightning Base has opened to new clients its WordPress hosting service in Frankfurt, Germany, This location uses the same highly available configuration on which Lightning Base’s US location currently runs and offers clients faster connections to Europe, Africa, the Middle East, and Western Asia. Combined with Lightning Base’s global CDN, this will enhance the WordPress host’s ability to serve customers from around the world.

“Lightning Base serves a global client base, and has seen increasing demand for WordPress hosting in Europe. Although our included CDN mitigates some of the disadvantage of a distant server, our Frankfurt system will provide for lightning-fast response times throughout Europe and nearby locations” said Chris Piepho, founder of Lightning Base. “We hope to continue adding locations over the coming year to better serve clients in all parts of the world.”

The Frankfurt location offers response times to European cities that are approximately one tenth of a second faster than those from Lightning Base’s US servers. Businesses will also benefit from their data remaining in the EU, potentially circumventing concerns regarding privacy and data protection in another jurisdiction. European customers will continue to benefit from Lightning Base’s CDN, with edge points throughout the continent, and geographically distributed DNS service, which includes a London node for fast DNS resolution.

Lightning Base is in the midst of a series of enhancements to its WordPress hosting service. Recent updates include:

- A new, redundant and easily-scaled hardware configuration.
- The ability for clients to automatically unblock their IP from Lightning Base firewalls by logging into the client area.
- A system status site offering clients information regarding any issues, and a public uptime page offering prospective customers a view into the service’s reliability.

The company will also be upgrading its client area and releasing a new email service for WordPress hosting clients in the coming weeks.

Existing customers can have their WordPress sites migrated to the new European location by opening a ticket and requesting a transfer. New clients can easily select the location while signing up for service on the Lightning Base website. WordPress sites hosted in Germany will be charged the same competitive rates currently provided to US customers.

About Lightning Base

Lightning Base is a managed WordPress hosting provider founded in 2011 and based in Minneapolis, MN. The company provides fast, reliable, and easy to use WordPress installations at servers based in Las Vegas, NV and Frankfurt Germany, combined with an included CDN for worldwide content distribution. Free managed services include site transfer or installation, caching setup, automatic updates, backups, and experienced WordPress support. For more information visit: lightningbase.com.

SERVER DOWN – My WordPress site is down. It doesn’t respond to FTP or anything else. I also can’t access the Lightning Base website or the control panel. Are your systems down? Help!

Luckily, almost every mail we’ve received like that was because of the same thing – our firewall blocking the customer. Their site was still accessible to the rest of the world.

What Happened?

Lightning Base is designed keep your WordPress sites secure. Part of this involves a fairly aggressive, active firewall. If someone is trying to guess your SFTP password, they get blocked. If they’re posting malicious code to your site, they get blocked. If they start scanning for vulnerabilites, they get blocked.

But on the other hand, if you forget your SFTP password… you might get blocked as well. Or if you do something else that looks suspicious, which can happen when working on a site. A lot of webhosts just let this stuff through, because dealing with support requests from clients is a hassle (it’s also harder to lock things down when you’re not just focused on WordPress), but we don’t.

Add in the fact that our firewalls can communicate, so getting blocked from one piece of our infrastructure might keep you off other parts – and you have a recipe for trouble. When you get blocked, the connection just dies, the server never responds. It appears the server is down.

So Unblock Yourself (Automatically!)

The first fix for this is that we have moved the main Lightning Base control panel onto a completely separate system. So if you get blocked from your site, you probably won’t be able to visit the main Lightning Base website, but secure.lightningbase.com (the control panel) and status.lightningbase.com should still be available.

Even better, when you login to secure.lightningbase.com, it will automatically register your IP, check the firewalls for blocks, and clear your IP if it’s listed. Simple.

If that does not work, or you’re trying to unblock a client, you can also manually clear IP’s from the firewall.

Unblock IP in the Lightning Base support menu

This will allow you to access your WordPress site again.

Unblock your IP with this form

You get a simple form, pre-filled with your detected IP address (or you can enter another). For security’s sake, we’ll only allow limited usage of this, but it should be plenty for the occasional accident. As always, our support staff is happy to help out as well.

Our New Status Page

In addition to the above, Lightning Base now has a much more robust system for informing clients of our system status.

If you are having trouble accessing your site, I encourage you to visit status.lightningbase.com.

Lightning Base Status Page

This page includes a blog and Twitter feed which will be updated if an issue will not be resolved within a couple minutes. It also has instructions for unblocking yourself from the firewall, who to contact for help, and a link so you can check the server status.

And An Automated Monitoring Site

Server status is provided by our new public monitoring page – up.lightningbase.com

A Portion of the Lightning Base Monitoring Site

This page is automatically generated by Pingdom, making it completely independent of our infrastructure. You might notice some extra services on there… both the EU hosting location and email service will be announced in the coming days/weeks.

Any Feedback?

I’m excited about the firewall unblocking addition, as it will let our customers easily resolve one of their most common issues, rather than nervously waiting for our support staff to help out.

In the event of a real problem, the status page will provide a quicker (and less support-intensive) option for getting updates. And our new monitoring page should both be convenient for customers and great for showing off Lightning Base’s reliability.

If you have any thoughts on how we could make these upgrades more useful, please get in touch.

In light of this, we’ve upgraded.

What’s Improved?

In our new system, sites run off ultra-fast storage in Raid 10, just like before. But this storage is now continually replicated in a second building. If there’s a serious problem on the server, the system can be automatically booted up in the second availability zone. This should be nearly immune to hardware failures – even if the building burned down.

In addition to the better redundancy, these are upgraded servers. We’re providing access to the same number of processors per plan as before, but these are faster systems, so customers are getting a free upgrade in performance. The new servers will also provide us with more disk space at a lower cost (thank you, falling hardware prices) and I expect to pass on some of that to our customers through larger storage quantities in the coming weeks.

For the curious, our new system is located at SwitchNap in Las Vegas. This is a state-of the art datacenter with great connectivity, redundancy, and security (check our site next week for the public announcement of our new European location, using the same highly-available setup, which is already open for current customers).

Getting Started on the New Setup

Anyone who signs up for a new account, or existing customers creating a new hosting plan, will automatically be setup on the new system. If you’re an existing customer and would like be moved, open a support ticket and we’ll help get that done. It does require an IP change, but there should not be any downtime associated with getting switched over.

More to Come

I’m excited about what’s happening at Lightning Base – the above-mentioned upgrades, upcoming service in Europe, and a couple more announcements coming down the pipe. Our systems have gradually improved over the past year to the point where we can increasingly focus on new features and making the experience of managing your sites at Lightning Base easier and more enjoyable.

If you’re not a customer yet and want to get all the news – sign up for updates via email.

As always, if you have any questions – get in touch.

It is a maintenance release, fixing bugs and improving security.  You can see more information regarding the changes at the WordPress Codex article on 3.4.2.

If your site at Lightning Base is set to auto-upgrade for minor or major core updates, it was upgraded last night. You should have emails both informing that your site was backed up, and that an upgrade was completed.

As always, if you need help performing an upgrade or have issues with the new version, please get in touch. This is a minor release so it should be safe to upgrade most sites already on 3.4.x.

Enter our new feature – easy cloning of your WordPress site.

Easy WordPress Cloning at Lightning Base

Click clone, choose a subdomain or domain that is setup on our system, and you’ll have a copy of your site in seconds. Tweak to your heart’s content!

Once you’re done, it’s easy to uninstall the clone (see the uninstall button above) and repeat the changes on your main site.

What if you want to replace your main site with the clone? We do not currently support cloning over your main site, but can help you make the switch. Open a support ticket and we’ll be happy to assist. I expect we’ll publicly document the process for self-service in the near future.

All of these menus are located in our advanced control panel – if you’re a customer that is not yet using this self-service option, contact Lightning Base and we’ll get you going. And if you’re not yet a customer, try out our service today.

Why the Change?

When Lightning Base started, hosting DNS seemed unnecessary – many domain registrars provide it free, and Cloudflare also provides high-quality, free DNS. It didn’t take long, however, to realize that many clients found using an outside DNS service confusing, and that it stopped us from helping clients manage their records when they needed help.

We could have just stuck a DNS service on our webhosting servers and called it a day, but with the importance of DNS I wanted to do it better.

Our New Global DNS Service

Today we’re launching a new, global DNS service (existing clients may have noticed the manage DNS links popping up in their control panels over the last few days). Our network includes servers on the US East and West coasts (New York and LA area), Europe (London) and Asia (Tokyo).

For the main domain on a hosting plan, there is an easy to use management area in our billing/support panel:

Lightning Base DNS Management

For those of you running multiple domains on a single plan, add-on domain DNS can be accessed in our advanced control panel:

Advanced Panel DNS Editor

The distributed network of servers should make for good performance anywhere in the world, and also provides an important level of redundancy. To test it out, you can visit the website http://lightningbase-dns.com. Existing customers that host DNS elsewhere are free to continue using their current service, or move to this new option. Feel free to contact support if you need help making the switch.

New domains automatically have the records needed for our hosting added to their settings, and will get Google-Apps compatible MX records automatically as well (as most of our clients use this free email service). If you’re moving over an existing domain, please check the records in your control panel before changing your nameserver settings.

What’s Next

The DNS service was put together partially so that new site setup can be completely automated – from purchasing a domain to having WordPress installed and running. We’ll have an announcement regarding that in the next few days.

We’re also updating and improving our WordPress-specific Varnish configuration, which will lead to even better performance for everyone’s sites.

Finally, we’re working on more reseller solutions – the DNS service can be rebranded, which is one piece in creating a truly white-label offering, which will hopefully be announced next week.

Stop back for more updates, or learn more about our WordPress hosting plans.