Right now there is a worm making its way around old, unpatched versions of WordPress. This particular worm, like many before it, is clever: it registers a user, uses a security bug (fixed earlier in the year) to allow evaluated code to be executed through the permalink structure, makes itself an admin, then uses JavaScript to hide itself when you look at users page, attempts to clean up after itself, then goes quiet so you never notice while it inserts hidden spam and malware into your old posts.

Here are two quick steps to avoid unnecessary risks:

Turn off user registration

This one is simple. Just log in to your administrator screen and visit the “General Settings” screen (listed under Settings) and make sure the checkbox labeled “Anyone can register” is not checked.

Block access to your blog’s admin area

This can be accomplished with simple authentication.

If your site runs on Apache, you can create an .htaccess file in your /wp-admin/ directory to require authentication before the page is displayed. This post provides the necessary steps.

The prolific team at DIY Themes has released the latest version of Thesis, the best theme/framework for WordPress. See what customers are saying about their Thesis experience!

This template is based on a WordPress theme by Minmin. Unfortunately the original theme doesn’t behave uniformly across multiple browsers. Don’t worry, that’s where Thesis comes in.

How Much?

It’s FREE. All I ask is that you leave the attribution link in the footer intact to link back to this site.

If you who already own Thesis, download the template (from SVN or as a zip file) and replace your custom folder with its contents. For more details see the README.txt file part of the distribution.

Don’t Know Enough About Thesis?

Learn all about it here then click “Get Thesis” to buy it today.