Image: CloudFlare

If your WordPress admin pages suddenly become sluggish, unreachable or you’re unable to log in there’s a good chance your site is being attacked.

According to CloudFlare CEO Matthew Prince, the attack is using brute force against WordPress’ admin pages using the old default username “admin” and then trying thousands of passwords. There’s nothing new about that approach, but what makes this attack different, and particularly potent, is that the attackers have some 90,000 unique IP addresses at their disposal.

For its part CloudFlare has pushed out an update that “detects the signature of the attack and stops it.”

Popular WordPress Host HostGator reports that it too has “seen over 90,000 IP addresses involved in this attack.”

WordPress creator Matt Mullenweg has also weighed in, pointing out that it’s been over three years since WordPress used the username “admin” as the default for new installations.

However, there are no doubt a great many sites that still have — whether they use it or not — the “admin” user account hanging around in WordPress. It’s also worth noting that, while this attack appears limited to trying the “admin” username, a more sophisticated approach could do the same thing, but with unique usernames — for example, find the most frequently used account name on the public site, assume it’s an admin account and run the same attack against the admin pages. So far that hasn’t happened.

“Here’s what I would recommend,” writes Mullenweg on his blog, “if you still use “admin” as a username on your blog, change it, use a strong password, if you’re on WP.com turn on two-factor authentication, and of course make sure you’re up to date on the latest version of WordPress.”

Unfortunately, given the number of IP addresses that seem to be at the attackers’ disposal, other common security measures — like tools that limit logins by IP address — aren’t going to be terribly effective against this attack. Short of getting rid of the default “admin” account (if it still exists), there isn’t a whole lot you can do to stop the attacks (unless you want to use a web application firewall like CloudFlare or ModSecurity). Be sure to contact your hosting company if you think your site has come under attack.

This post with tweetable sentences highlighted by Save Publishing. Image: Screenshot/Webmonkey

Save Publishing is a bookmarklet that highlights any tweetable sentences on a given page. You can grab it from SavePublishing.com or head over to GitHub if you’d like to see the source (Save Publishing is written in CoffeeScript).

The bookmarklet is the work of former Harper’s editor Paul Ford, perhaps better known as @ftrain. Ford says the project started as a joke, but “now it’s serious and I use it all day.”

I expected the novelty to wear off quickly after I used it a few times, but now it’s been a few days and I still find myself using it. Sometimes the faintly ridiculous manages to become useful. What would make Save Publishing more useful is a way to use it within Twitter clients like Tweetbot, but thus far that’s not possible.

Image: Rob McKaughan/Flickr

Good web typography needn’t be difficult, but typography can be a complicated and sometimes intimidating subject for newcomers.

To help you understand typography a bit better — and create better-looking websites with your new understanding — developer Tommi Kaikkonen created his Interactive Guide to Blog Typography. The guide offers a nice hand-holding walk through of the elements that make for good typography on the web, helping you not just make more readable sites, but understand why they’re more readable.

For most suggestions in Kaikkonen’s guide there’s an interactive button to toggle different line-heights, fonts and measures so you can see for yourself why those elements matter and how they contribute to making your site easier to read.

Among the suggestions in Kaikkonen’s guide are to set a readable measure (the number of characters on a line), frame content with white space (to put emphasis on the main part of the page), avoid pure black for text and, unless you really know what you’re doing, stick with just two different fonts.

There is one part of the guide we can’t totally endorse — the last suggestion, which is to use font-variant: small-caps; even if the font you’re using doesn’t actually have a small-caps variant. With some fonts — the traditional six fonts of web design, for example — you can get away with this, but if you’re using fancier fonts like those from Google Web Fonts or TypeKit this can make for some really awful results; proceed with caution on that one.

WordPress earns a Bitcoin merit badge. Photo: Ben Ostrowsky/Flickr.

The move makes WordPress one of the largest, most reputable online services to accept the fledgling Bitcoin currency.

Bitcoin is an online currency that allows buyers and sellers to exchange money anonymously. According to a post on the WordPress blog, the appeal of Bitcoin for WordPress is that, unlike credit cards and PayPal, “Bitcoin has no central authority and no way to lock entire countries out of the network … merchants who accept Bitcoin payments can do business with anyone.”

The anonymous aspect has made Bitcoin a target for law enforcement agencies, but for WordPress it means that users living in any of the over 60 countries currently blocked by PayPal (and many credit card companies) now have a way to pay for WordPress upgrades and services.

While setting up a basic blog on WordPress.com is free, there are paid upgrades available for custom themes, custom domains or to remove ads from your site.

Bitcoin is in your WordPress. Image: Screenshot/Webmonkey.

Automattic, WordPress’ parent company, accepts Bitcoin payments through Bitpay.com, which has now been integrated into the WordPress.com payment interface alongside the PayPal and traditional credit card options. WordPress is foregoing the Bitcoin “confirmations” process, which would help protect the company against fraud. Here’s an explanation from the FAQ:

We could wait for the first confirmation (typically 5-10 minutes) but we prefer to make the customer experience as smooth as possible. Making you wait for confirmations would virtually eliminate our risk but we’re confident that with digital products like ours the risk is already acceptably low.

Note that while WordPress is accepting Bitcoin payments, it may not work for everything just yet. The option to pay with Bitcoin appears to be limited to upgrade bundles at the moment. Purchasing custom themes or domains by themselves is not currently possible due to what WordPress calls “technical complications.”

WordPress adopting Bitcoin is good news for users in countries like Haiti, Ethiopia, or Kenya, which are often blocked by traditional payment systems. It’s also good news for Bitcoin supporters who now have another, very large, every legitimate company on their side.

Photo by Owen W Brown/Flickr/CC

Daniel Bachhuber, a friend who works at WordPress, oohed and aahed. I asked him why he liked it so much and he said a couple of things.

The discussion was focused on this topic: How do blogs need to evolve?

I wasn’t asked to be part of the discussion, but since this is the open web, and they made their discussion public, I can say what I have to say. It’s up to them if they want to include it in their discussion.

I’ve even provided the “source code” for this post — just the text with a little bit of structure, and some attributes, with an open architecture for more attributes. So they can do more than link to it. They can “include” it.

The advantage of doing it this way is:

1. I maintain the original.
2. It can be included in as many places as it’s relevant.
3. If I want to update it, I can, and it would update in all the places it is viewable.
4. Because I can update it, that means relative writing will be kept to a minimum. People can say what they think without making an issue of who’s right and who’s wrong. Because they might not stay right or wrong for very long!

In the thread Evan Williams says that Twitter has a big advantage because it already has all the integration tools people want. It’s understandable he would think that, I suppose, having participated in creating Twitter, but I don’t agree. Here’s why.

1. When I quoted Daniel in the second paragraph, you wouldn’t believe the dance I had to do to get a link to the tweet onto the clipboard so I could link to it from my post. Even though I’ve done it dozens of times, I still made three mistakes for every action that worked.
2. Twitter has a 140-character limit, which means that for any kind of complex thought, beyond a grunt or snark (which is likely to be misunderstood because there wasn’t room to explain it) I’m going to have to include a link, which of course must be shortened.
3. As they point out in the thread, Twitter is a company town. The archive belongs to them, to do with as they please. I have no say in the future uses of my own writing.
4. Finally, the strongest point — even Twitter agrees it’s not self-contained, because they support oEmbed, which allows them to include content that’s hosted on other servers. However, they aren’t even open about being open. You can only participate if you’re a “partner.” I don’t know who pays who for this, or if anyone pays, but they admit that being open to content hosted elsewhere is necessary, but it isn’t available to the people. In other words, we’ve given up all the beauty of the internet, for what exactly? What did we get in return?

Anyway, even if I was invited to participate, all I would do is post a pointer to this blog post. Because here I own the editorial tools and can make them work any way I want to. There is no 140-character limit. There’s no problem getting a permalink. I own the archive. Sure if you want to participate it’s a bit of work, you have to set up a blog somewhere. That’s okay with me. For a little bit of work you get a whole lot of freedom. That’s a good deal.

This post first appeared on Scripting News.

Dave Winer, a former researcher at NYU and Harvard, pioneered the development of weblogs, syndication (RSS), podcasting, outlining, and web content management software. A former contributing editor at Wired magazine, Dave won the Wired Tech Renegade award in 2001.
Follow @davewiner on Twitter.

To get the latest version head over to the WordPress downloads page. If you’re already using WordPress you can update from the WordPress dashboard (naturally we suggest backing up your files and database before you upgrade).

Among the changes that make WordPress 3.3 well worth the upgrade is the new responsive admin design. While there are mobile apps from managing your WordPress site on the go, the actual web admin has never adapted to small screens. That changes with WordPress 3.3 and its new responsive admin page, which reflows content to fit the screen you’re using.

Responsive design — that is, using liquid layouts and scaling media to fit any screen size — is moving into the mainstream in a hurry. The past year has seen several high-profile websites relaunched with responsive designs, but WordPress 3.3 is likely the most widely used site yet to embrace responsive design.

Other changes in WordPress 3.3 include a slicker sidebar with “flyout” submenus which put everything in the admin site just a single click away. There’s also a new drag-and-drop uploader, which means you can drag and drop images from your desktop right into the media upload box in the admin (provided you’re using a browser that supports HTML5′s drag-and-drop API). Behind the scenes WordPress is using Plupload to handle the drag-and-drop features. In browsers that support it Plupload will use HTML5; for older browsers it falls back to Flash.

Anyone working on a site with numerous writers and editors will be happy to know that this release features much improved co-editing support. If you’ve ever seen messages like “Warning: [username] is currently editing this post,” you’ll be happy to know that it will now only appear when someone is actively editing a post. Previously the message would often appear even if your co-writer simply left the window or tab open in their browser.

For a complete list of changes and new features in WordPress 3.3, see the release notes.

The popular blog publishing tool WordPress has joined the growing cadre of sites dropping support for Microsoft’s Internet Explorer 6 web browser. The recently upgraded WordPress.com brings a handful of new features and a revamped, cleaner design in the admin pages, but perhaps the biggest news in the release is that the admin pages no longer support IE 6.

Users visiting the admin section of WordPress.com with IE 6 will now see a message to upgrade their browser (the same message will appear in the self-hosted WordPress 3.2 when it is released in June). The WordPress blog says it’s dropping IE 6 because, “it has required increasingly complex code trickery to make the WordPress dashboard work in the IE 6 browser, which was introduced 10 years ago and does not support current web standards.”

WordPress is just the latest in a long list of sites that have abandoned IE 6, including Gmail, YouTube, Basecamp and hundreds of others.

Indeed you’d be hard pressed to find a web developer who wants to keep supporting IE 6. Even Microsoft has set up a website that essentially dances on the grave of IE 6 (after WordPress announced it would drop IE 6, Microsoft actually said “thank you WordPress“).

However, according to Net Applications, IE 6 still has almost 12 percent user share worldwide. In the U.S. the number is just under 3 percent, but in China it’s still nearly 35 percent.

Compounding the problem are the number of corporate intranets that require IE 6. Microsoft is hard at work trying to convince large corporations to upgrade — if you’re still using IE 6, that means you haven’t upgraded to Windows 7, which is Microsoft’s real goal with the kill IE 6 campaign — but for Microsoft’s biggest customers, upgrading means investing millions of dollars in new infrastructure.

While developers may enjoy dropping IE 6 because of its subpar support for web standards, for end users that’s generally not a concern. What is, or at least should be, the bigger concern for users is that IE 6 is less secure.

If you’re part of the tiny segment of users that can — but haven’t — upgraded from IE 6, we suggest doing so. Grab a copy of Firefox or Chrome and join the modern web.

See Also:

• Microsoft Kicks Off Campaign to Kill Internet Explorer 6
• Google Drops Support for IE6, Firefox Goes Mobile
• Install Google Chrome Frame Without Admin Privileges
• Internet Explorer Isn’t Dead. And Wow, Look at China

Google’s Page Speed testing tool, which recently went from a browser add-on to a web-based tool, now sports a new API. The Page Speed Online API allows outside applications to send URLs to Page Speed and get back a list of things the site developer can do to speed up the page in question.

If you’d like to try it, head over to the new documentation page and request an API key. Sample apps include using the Page Speed Online API to display suggestions for speeding up sites or even combining the API with the Google Charts API to show a visual breakdown of the page’s resources.

For a more practical example of how the Page Speed Online API can help out your site, check out the latest version of the W3 Total Cache plugin for WordPress. If you’re not already using W3 Total Cache in your WordPress installation, we highly recommend you install it, especially now that the plugin taps into the Page Speed API. W3 Total Cache now sends your pages to the Page Speed Online API and then offers Page Speed suggestions, right in the WordPress dashboard.

See Also:

• Speed Up Your Site With Google Analytics New Page Speed Tools
• Google Page Speed Now Works in any Web Browser
• Yahoo’s YSlow Page Speed Tool Now Available for Chrome

The word “server” is enough to send all but the hardiest nerds scurrying for cover.

The word usually conjures images of vast, complex data farms, databases and massive infrastructures. True, servers are all those things — but at a more basic level, they’re just like your desktop PC.

Running a server is no more difficult than starting Windows on your desktop. That’s the message Dave Winer, forefather of blogging and creator of RSS, is trying to get across with his EC2 for Poets project. The name comes from Amazon’s EC2 service and classes common in liberal arts colleges, like programming for poets or computer science for poets. The theme of such classes is that anyone — even a poet — can learn technology.

Winer wants to demystify the server. “Engineers sometimes mystify what they do, as a form of job security,” writes Winer, “I prefer to make light of it… it was easy for me, why shouldn’t it be easy for everyone?”

To show you just how easy it is to set up and run a server, Winer has put together an easy-to-follow tutorial so you too can set up a Windows-based server running in the cloud. Winer uses Amazon’s EC2 service. For a few dollars a month, Winer’s tutorial can have just about anyone up and running with their own server.

In that sense Winer’s EC2 for Poets if already a success, but education and empowerment aren’t Winer’s only goals. “I think it’s important to bust the mystique of servers,” says Winer, “it’s essential if we’re going to break free of the ‘corporate blogging silos.’”

The corporate blogging silos Winer is thinking of are services like Twitter and Facebook. Both have been instrumental in the growth of the web, they make it easy for anyone publish. But they also suffer denial of service attacks, government shutdowns and growing pains, centralized services like Twitter and Facebook are vulnerable. Services wrapped up in a single company are also vulnerable to market whims, Geocities is gone, FriendFeed languishes at Facebook and Yahoo is planning to sell Delicious. A centralized web is brittle web, one that can make our data, our communications tools disappear tomorrow.

But the web will likely never be completely free of centralized services and Winer recognizes that. Most people will still choose convenience over freedom. Twitter’s user interface is simple, easy to use and works on half a dozen devices.

Winer doesn’t believe everyone will want to be part of the distributed web, just the dedicated. But he does believe there are more people who would choose a DIY path if they realized it wasn’t that difficult.

Winer isn’t the only one who believes the future of the web will be distributed systems that aren’t controlled by any single corporation or technology platform. Microformats founder Tantek Çelik is also working on a distributed publishing system that seeks to retain all the cool features of the social web, but remove the centralized bottleneck.

But to be free of corporate blogging silos and centralized services the web will need an army of distributed servers run by hobbyists, not just tech-savvy web admins, but ordinary people who love the web and want to experiment.

So while you can get your EC2 server up and running today — and even play around with Winer’s River2 news aggregator — the real goal is further down the road. Winer’s vision is a distributed web where everything is loosely coupled. “For example,” Winer writes, “the roads I drive on with my car are loosely-coupled from the car. I might drive a SmartCar, a Toyota or a BMW. No matter what car I choose I am free to drive on the Cross-Bronx Expressway, Sixth Avenue or the Bay Bridge.”

Winer wants to start by creating a loosely coupled, distributed microblogging service like Twitter. “I’m pretty sure we know how to create a micro-blogging community with open formats and protocols and no central point of failure,” he writes on his blog.

For Winer that means decoupling the act of writing from the act of publishing. The idea isn’t to create an open alternative to Twitter, it’s to remove the need to use Twitter for writing on Twitter. Instead you write with the tools of your choice and publish to your own server.

If everyone publishes first to their own server there’s no single point of failure. There’s no fail whale, and no company owns your data. Once the content is on your server you can then push it on to wherever you’d like — Twitter, Tumblr, WordPress of whatever the site du jour is ten years from now.

The glue that holds this vision together is RSS. Winer sees RSS as the ideal broadcast mechanism for the distributed web and in fact he’s already using it — Winer has an RSS feed of links that are then pushed on to Twitter. No matter what tool he uses to publish a link, it’s gathered up into a single RSS feed and pushed on to Twitter.

Dave Winer's RSS-centric vision of a distributed web image by dave winer via flickr

Winer will be first to admit that a distributed system like he imagines is still a little ways off, but as they say, the longest journey starts with a single step. For Winer EC2 for Poets is part of that first step. If you’ve never set up your own server, don’t even really totally understand what a server is, well, time to find out. Head on over to the EC2 for Poets site and you’ll have a server up and running fifteen minutes from now. The distributed web awaits you.