Please download the latest version here:

http://www.bad-neighborhood.com/puzzcaptcha.htm

Version 1.2 is not backwards compatible, so anyone needing the plugin for WordPress 2.3.3 or earlier will have to use version 1.1. I provided links to both versions on the download page, however, as I mentioned there, if you are not running WordPress 2.5.1 or higher then you are open to having your WordPress hacked. I strongly suggest that anyone who still has not upgraded to do so.

I am looking into getting off the blacklist, but until I do some of you may notice certain website returning erroneous 404’s, just so you know.

Also, today I spent a good part of the day modifying the structure of the tables that hold the data for the Google Multi-DC Rank Checker and Yahoo Multi-Keyword Rank Checker.

Hopefully those of you who enjoy the use of those tools will notice better performance on them now. Also, I apologize for any slowdowns the data migration may have caused today.

Thanks.

Thanks.

With the way WordPress is currently set up, attackers are free to use bots for a brute force style of attack that simply guesses at the admin password until they come up with the correct one. There are a couple of solutions out there, each with their own drawbacks. One solution suggested is to restrict which IP’s that can access the wp-admin folder via .htaccess. The two problems with that is that it inhibits regular users from seeing their user preference page once they log in (which is the default page a user sees), and not every blogger is going to be logging in to their blog from the same IP all of the time.

Another solution involves a plugin that sets up a secondary password using Basic HTTP Authentication. While this will thwart many of the generic bots out there, if a blog is specifically targeted it is easy enough for a hacker to code a bot that will send repeated attempts against that login method as well, and again it does interfere with non-admin users when they attempt to log in (which is really a pain if the admin requires registration in order to comment).

Login LockDown takes a different approach. Every failed login attempt is recorded, along with the timestamp of the attempt and the IP address of the user. If a user tries (and fails) to log in too many times within a certain time period, the system then blocks any login requests coming from that IP range until the lock-out is released. The lock-out period defaults to 1 hour, although that can be changed within the admin panel. The number of retires and the time period that they occur within in order to trigger a lock-out are also configurable from the admin section, and admins do have the ability to release an IP block manually (assuming of course that they haven’t locked themselves out ).

The download link for the plugin, as well as the instructions, are located on the Bad Neighborhood website, here: Login LockDown v1.0