Mohamed Sharaf
Menu
Security

GoDaddy’s WordPress breach: change those passwords

Data on up to 1.2 million Managed WordPress customers was exposed, including some passwords in plain text.

· 1 min read

Yesterday GoDaddy said someone used a compromised password to get into its Managed WordPress system in September. Up to 1.2 million customers are affected. Exposed: email addresses, the original WordPress admin passwords set at creation, sFTP and database usernames and passwords, and some SSL private keys.

If you host WordPress there:

  1. Change the WordPress admin password, sFTP and database passwords. GoDaddy says it reset some, but do it yourself.
  2. Check for unknown admin users and plugins you didn’t install.
  3. Reissue SSL certificates if you’re told yours was affected.
  4. Watch for phishing using your customer number or email.

And the general lesson: passwords should never be stored in a way the provider can read back. If a service can show you your password, ask why.

ShareWhatsAppLinkedInXTelegramFacebook