Image: CloudFlare

If your WordPress admin pages suddenly become sluggish, unreachable or you’re unable to log in there’s a good chance your site is being attacked.

According to CloudFlare CEO Matthew Prince, the attack is using brute force against WordPress’ admin pages using the old default username “admin” and then trying thousands of passwords. There’s nothing new about that approach, but what makes this attack different, and particularly potent, is that the attackers have some 90,000 unique IP addresses at their disposal.

For its part CloudFlare has pushed out an update that “detects the signature of the attack and stops it.”

Popular WordPress Host HostGator reports that it too has “seen over 90,000 IP addresses involved in this attack.”

WordPress creator Matt Mullenweg has also weighed in, pointing out that it’s been over three years since WordPress used the username “admin” as the default for new installations.

However, there are no doubt a great many sites that still have — whether they use it or not — the “admin” user account hanging around in WordPress. It’s also worth noting that, while this attack appears limited to trying the “admin” username, a more sophisticated approach could do the same thing, but with unique usernames — for example, find the most frequently used account name on the public site, assume it’s an admin account and run the same attack against the admin pages. So far that hasn’t happened.

“Here’s what I would recommend,” writes Mullenweg on his blog, “if you still use “admin” as a username on your blog, change it, use a strong password, if you’re on WP.com turn on two-factor authentication, and of course make sure you’re up to date on the latest version of WordPress.”

Unfortunately, given the number of IP addresses that seem to be at the attackers’ disposal, other common security measures — like tools that limit logins by IP address — aren’t going to be terribly effective against this attack. Short of getting rid of the default “admin” account (if it still exists), there isn’t a whole lot you can do to stop the attacks (unless you want to use a web application firewall like CloudFlare or ModSecurity). Be sure to contact your hosting company if you think your site has come under attack.

WordPress earns a Bitcoin merit badge. Photo: Ben Ostrowsky/Flickr.

The move makes WordPress one of the largest, most reputable online services to accept the fledgling Bitcoin currency.

Bitcoin is an online currency that allows buyers and sellers to exchange money anonymously. According to a post on the WordPress blog, the appeal of Bitcoin for WordPress is that, unlike credit cards and PayPal, “Bitcoin has no central authority and no way to lock entire countries out of the network … merchants who accept Bitcoin payments can do business with anyone.”

The anonymous aspect has made Bitcoin a target for law enforcement agencies, but for WordPress it means that users living in any of the over 60 countries currently blocked by PayPal (and many credit card companies) now have a way to pay for WordPress upgrades and services.

While setting up a basic blog on WordPress.com is free, there are paid upgrades available for custom themes, custom domains or to remove ads from your site.

Bitcoin is in your WordPress. Image: Screenshot/Webmonkey.

Automattic, WordPress’ parent company, accepts Bitcoin payments through Bitpay.com, which has now been integrated into the WordPress.com payment interface alongside the PayPal and traditional credit card options. WordPress is foregoing the Bitcoin “confirmations” process, which would help protect the company against fraud. Here’s an explanation from the FAQ:

We could wait for the first confirmation (typically 5-10 minutes) but we prefer to make the customer experience as smooth as possible. Making you wait for confirmations would virtually eliminate our risk but we’re confident that with digital products like ours the risk is already acceptably low.

Note that while WordPress is accepting Bitcoin payments, it may not work for everything just yet. The option to pay with Bitcoin appears to be limited to upgrade bundles at the moment. Purchasing custom themes or domains by themselves is not currently possible due to what WordPress calls “technical complications.”

WordPress adopting Bitcoin is good news for users in countries like Haiti, Ethiopia, or Kenya, which are often blocked by traditional payment systems. It’s also good news for Bitcoin supporters who now have another, very large, every legitimate company on their side.

Meet Twenty Twelve, the latest default WordPress theme. Image: Screenshot/Webmonkey.

The default WordPress theme is quite possibly the most widely used design on the web; the minute you sign up for or install WordPress you have a website that uses the default theme. Every year WordPress unveils a new look that will grace every “just another WordPress site.”

This year’s theme, Twenty Twelve, is the first to embrace responsive design, adapting its layout to fit any screen. The WordPress admin pages are already responsive, and the last few default WordPress themes have accommodated small screens, even using some responsive design tools like CSS @media, but this is the first default theme to fully embrace responsive design and fluidly adapt to any screen.

Twenty Twelve marks something of a departure for the default theme. Gone are the banners and featured images atop posts. Instead Twenty Twelve sticks with a largely black-and-white look that puts the emphasis on typography and a new typeface, Open Sans.

If you’d like to use Twenty Twelve on your WordPress.com site, just head to the dashboard and select Themes, (under Appearance). If you’re hosting your own WordPress install, you’ll soon have access via the Extend theme directory. And of course the new theme will be bundled with WordPress 3.5 due later this year.

This year’s theme was designed by former NFL player Drew Strojny, though as with all things WordPress there was plenty of help from the WordPress community. The WordPress blog has more details about Twenty Twelve and there’s a live demo you can check out as well.

To get the latest version head over to the WordPress downloads page. If you’re already using WordPress you can update from the WordPress dashboard (naturally we suggest backing up your files and database before you upgrade).

Among the changes that make WordPress 3.3 well worth the upgrade is the new responsive admin design. While there are mobile apps from managing your WordPress site on the go, the actual web admin has never adapted to small screens. That changes with WordPress 3.3 and its new responsive admin page, which reflows content to fit the screen you’re using.

Responsive design — that is, using liquid layouts and scaling media to fit any screen size — is moving into the mainstream in a hurry. The past year has seen several high-profile websites relaunched with responsive designs, but WordPress 3.3 is likely the most widely used site yet to embrace responsive design.

Other changes in WordPress 3.3 include a slicker sidebar with “flyout” submenus which put everything in the admin site just a single click away. There’s also a new drag-and-drop uploader, which means you can drag and drop images from your desktop right into the media upload box in the admin (provided you’re using a browser that supports HTML5′s drag-and-drop API). Behind the scenes WordPress is using Plupload to handle the drag-and-drop features. In browsers that support it Plupload will use HTML5; for older browsers it falls back to Flash.

Anyone working on a site with numerous writers and editors will be happy to know that this release features much improved co-editing support. If you’ve ever seen messages like “Warning: [username] is currently editing this post,” you’ll be happy to know that it will now only appear when someone is actively editing a post. Previously the message would often appear even if your co-writer simply left the window or tab open in their browser.

For a complete list of changes and new features in WordPress 3.3, see the release notes.

The popular blog publishing tool WordPress has joined the growing cadre of sites dropping support for Microsoft’s Internet Explorer 6 web browser. The recently upgraded WordPress.com brings a handful of new features and a revamped, cleaner design in the admin pages, but perhaps the biggest news in the release is that the admin pages no longer support IE 6.

Users visiting the admin section of WordPress.com with IE 6 will now see a message to upgrade their browser (the same message will appear in the self-hosted WordPress 3.2 when it is released in June). The WordPress blog says it’s dropping IE 6 because, “it has required increasingly complex code trickery to make the WordPress dashboard work in the IE 6 browser, which was introduced 10 years ago and does not support current web standards.”

WordPress is just the latest in a long list of sites that have abandoned IE 6, including Gmail, YouTube, Basecamp and hundreds of others.

Indeed you’d be hard pressed to find a web developer who wants to keep supporting IE 6. Even Microsoft has set up a website that essentially dances on the grave of IE 6 (after WordPress announced it would drop IE 6, Microsoft actually said “thank you WordPress“).

However, according to Net Applications, IE 6 still has almost 12 percent user share worldwide. In the U.S. the number is just under 3 percent, but in China it’s still nearly 35 percent.

Compounding the problem are the number of corporate intranets that require IE 6. Microsoft is hard at work trying to convince large corporations to upgrade — if you’re still using IE 6, that means you haven’t upgraded to Windows 7, which is Microsoft’s real goal with the kill IE 6 campaign — but for Microsoft’s biggest customers, upgrading means investing millions of dollars in new infrastructure.

While developers may enjoy dropping IE 6 because of its subpar support for web standards, for end users that’s generally not a concern. What is, or at least should be, the bigger concern for users is that IE 6 is less secure.

If you’re part of the tiny segment of users that can — but haven’t — upgraded from IE 6, we suggest doing so. Grab a copy of Firefox or Chrome and join the modern web.

See Also:

• Microsoft Kicks Off Campaign to Kill Internet Explorer 6
• Google Drops Support for IE6, Firefox Goes Mobile
• Install Google Chrome Frame Without Admin Privileges
• Internet Explorer Isn’t Dead. And Wow, Look at China

Google’s Page Speed testing tool, which recently went from a browser add-on to a web-based tool, now sports a new API. The Page Speed Online API allows outside applications to send URLs to Page Speed and get back a list of things the site developer can do to speed up the page in question.

If you’d like to try it, head over to the new documentation page and request an API key. Sample apps include using the Page Speed Online API to display suggestions for speeding up sites or even combining the API with the Google Charts API to show a visual breakdown of the page’s resources.

For a more practical example of how the Page Speed Online API can help out your site, check out the latest version of the W3 Total Cache plugin for WordPress. If you’re not already using W3 Total Cache in your WordPress installation, we highly recommend you install it, especially now that the plugin taps into the Page Speed API. W3 Total Cache now sends your pages to the Page Speed Online API and then offers Page Speed suggestions, right in the WordPress dashboard.

See Also:

• Speed Up Your Site With Google Analytics New Page Speed Tools
• Google Page Speed Now Works in any Web Browser
• Yahoo’s YSlow Page Speed Tool Now Available for Chrome

WordPress, one of the most popular blogging platforms on the web, reached a new milestone Thursday with its 3.0 release.

This one is nicknamed “Thelonious,” and you can run an update your own WordPress installation by clicking on the update link at the top of your blog dashboard. It’s also available for download.

The big news is that WordPress MU, a multisite tool that can be used to run a whole network of blogs, has become one of WordPress’ default features. You can now manage as many different blogs as you want from one single WordPress installation.

There are a number of updates to the user-facing part of WordPress. The admin has been redesigned: It’s been slimmed down and made easier to navigate with a more accessible layout and color scheme. Some of the menu choices have been renamed to be more descriptive.

There are also new contextual help tabs on every panel inside the admin, so it’s less likely you’ll be left wondering, “what’s this do?” For promoting your posts on Twitter, there’s a new tool that lets you generate a short URL for your post as you’re composing it.

The WordPress team has built a new default theme called “Twenty Ten” to show off all the new features in Thelonious. Much like Kubrick, the old default theme, Twenty Ten is pretty minimal, but it’s a good starting point for learning how to tweak and customize WordPress.

For theme developers and site administrators, WordPress 3.0 has a number of enhancements. The new MU integration is a big plus if you’re running a blog network, or even two different sites that share resources and authors. There’s also a new set of APIs you can use to make building custom headers, backgrounds, menus and custom post types easier. To see the full list of enhancements, see the list at the WordPress Codex.

Here’s a video tour of the new stuff:

Webmonkey’s entire website uses WordPress. Most of Wired.com, too. We’ve used several open source publishing platforms over the years, from home-cooked template solutions built with XSSI, to MediaWiki (which we still use on the How-To Wiki). But WordPress is the easiest we’ve found for managing a fast-moving, multi-author environment.

The name Thelonious is a tribute to the jazz pianist and composer Thelonious Monk. The nickname also gives a nod to two other popular web platforms, “Rhythm-A-Ning” and “Ruby on Rails My Dear.” Any relation to Django and Ellington is purely coincidental.

See Also:

• Get Started With WordPress
• Dreamweaver CS5 First Look: More WordPressy, More Firebuggy
• Typekit Now Offering Custom Fonts For WordPress Blogs

Monk photo courtesy Library and Archives Canada/CC/Wikimedia Commons

As you may have noticed, we’ve given Webmonkey an entirely new coat of paint.

The visual design has been refreshed — something we’ve been doing every couple of years since we launched in 1996 — and we honestly think the site has never looked better. It took a lot of hard work by everyone on the Wired.com technical and design teams to pull it off.

As pretty as it is, there are other changes behind the scenes that we feel are just as important. We simplified the site navigation and upgraded our search tool, making it much easier to find blog posts and tutorials around specific topics. We also upgraded our publishing system, which will allow us to use photos, screenshots and galleries in more interesting ways in our reviews and tutorials.

Most notably, however, this latest redesign of Webmonkey brings to an end a two year experiment. In May of 2008, we moved all of the tutorial content on the site (over 500 articles and reference pages) to a wiki. We asked all of our readers to chip in and help improve our educational content by contributing edits. Many of you jumped in, offering updates, tips, links and corrections. Certain communities really made a difference — in particular, our Django tutorial, our Python tutorial and our series on JavaScript frameworks all benefitted greatly from reader edits. We sincerely appreciate all of the work that everyone put in to improve our content.

But the wiki experiment didn’t pan out. Spam became a huge problem, and despite our best efforts to automate our defenses, keeping spam bots and vandals off the site put serious strain on our small team. Also, while MediaWiki is great software (we’ll continue to use it on Wired’s How-To Wiki), fully incorporating the wiki content into the rest of Webmonkey, which was and still is running WordPress, proved to be a challenge. Search, site navigation and content discovery were suffering because of it.

In February, we froze edits on the wiki and began porting everything into WordPress. All of the legitimate edits and updates that were made by our readers while the wiki pages were open to the public have been preserved in the WordPress versions. We also found some time to update some of the older articles, too.

Now, the tutorials easier to find. They look better (thanks to Alex Gorbatchev’s SyntaxHighlighter) and the multi-page lessons are easier to navigate. And while the spam bot armies are locked out for good, the tutorials are open for comments just like blog posts. So if you spot something that needs updating or fixing, just leave a note and we’ll attend to it.

There’s still some work to be done. Over the next few weeks and months, we’ll continue updating the content library, beefing up the number of templates in the Reference section and building out the directories. In the near future, we’re going to install Disqus to handle comments, so you will be able to log in using OpenID, Facebook Connect, your Twitter or Yahoo credentials, or an existing Disqus login if you want to leave a comment anywhere on the site.

So for now, click around the site. Follow us on Twitter and become a fan on Facebook if you haven’t already. And of course, please let us know what you think of the new Webmonkey in the comments.