WordPress hosting: Do not try this at home!

Compromised WordPress blogs were used to host nearly 12,000 phishing sites in February. This represents more than 7% of all phishing attacks blocked during that month, and 11% of the unique IP addresses that were involved in phishing.

WordPress blogs were also responsible for distributing a significant amount of web-hosted malware — more than 8% of the malware URLs blocked by Netcraft in February were on WordPress blogs, or 19% of all unique IP addresses hosting malware.

WordPress is the most common blogging platform and content management system in the world: Netcraft's latest survey found nearly 27 million websites running WordPress, spread across 1.4 million different IP addresses and 12 million distinct domain names. Many of these blogs are vulnerable to brute-force password guessing attacks by virtue of the predictable location of the administrative interface and the still widespread use of the default "admin" username.

But remarkably, not a single phishing site was hosted on Automattic's own WordPress.com service in February. WordPress.com hosts millions of blogs powered by the open source WordPress software. Customers can purchase custom domain names to use for their blogs, or choose to register free blogs with hostnames like username.wordpress.com.

Automattic's founder, Matt Mullenweg, was one of the original authors of WordPress when it was released in 2003. Automattic later handed the WordPress trademark to the WordPress Foundation in 2010, but still contributes to the development of WordPress. Such familiarity with the product likely explains why blogs hosted at Automattic are significantly more secure than average.

Bloggers can also go it alone — anybody can download the WordPress software from wordpress.org and deploy it on their own website, and some hosting companies also offer "one-click" installations to simplify the process. Bloggers who install WordPress on their own websites will often also be responsible for keeping the software secure and up-to-date. Unfortunately, in many cases, they do not.

Even well-known security experts can fall victim to security flaws in WordPress if it is not their core activity. For example, in 2007, the Computer Security Group at the University of Cambridge found their own Light Blue Touchpaper blog had been compromised through several WordPress vulnerabilities.

Versions of WordPress after 3.7 are now able to automatically update themselves, provided the WordPress files are writable by the web server process. This has its own security trade-off, however, as an attacker exploiting a new and unreported vulnerability (a zero-day) that has the ability to write files will have free rein over the whole WordPress installation — an attacker could even modify the behaviour of WordPress itself to disable any future automatic security updates.

Insecure plugins

Over its lifetime, WordPress has been plagued by security issues both in its core code and in the numerous third-party plugins and themes that are available. One of the most widespread vulnerabilities this decade was discovered in the TimThumb plugin, which was bundled with many WordPress themes and consequently present on a large number of WordPress blogs. A subtle validation flaw made it possible for remote attackers to make the plugin download remote files and store them on the website. This allowed attackers to install PHP scripts on vulnerable blogs, ultimately facilitating the installation of malware and phishing kits. Similar vulnerabilities are still being exploited today.

Many of the phishing sites blocked in February were still operational this month, including this Apple iTunes phishing site hosted on a marketing company's website.

Dropzones for WordPress phishing content

Note that the above phishing content is stored in the blog's wp-includes directory, which is where the bulk of the WordPress application logic resides. More than a fifth of all phishing content hosted on WordPress blogs can be found within this directory, while another fifth resides in the wp-admin directory. However, the most common location is the wp-content directory, which is used by just over half of the phishing sites.

The wp-content directory is where WordPress stores user-supplied content, so it is almost always writable by the web server process. This makes it an obvious dropzone for malware and phishing content if a hacker is able to find and exploit a suitable vulnerability in WordPress, or indeed in any other web application running on the server. Shared hosting environments are particularly vulnerable if the file system permissions allow malicious users to write files to another user's wp-content directory. Some examples of directory structures used by phishing sites hosted in this directory on WordPress blogs include:


The wp-includes and wp-admin directories can also be written to by other users or processes if the WordPress installation has not been suitably hardened. Failing to harden a WordPress installation and keep all of its plugins up to date could result in a site being compromised and used to carry out phishing attacks. Enabling automatic background updates is an easy way to ensure that a WordPress blog is kept up-to-date, but a significant trade off is that every WordPress file must be writable by the web server user.

Some other examples of directory structures seen in phishing sites hosted on WordPress blogs include:



Interestingly, the wp-admin directory appears to be the favourite location for Apple phishing sites – these make up more than 60% of all phishing sites found in this directory.

Vulnerable WordPress blogs can also be used for other nefarious purposes. A botnet of more than 162,000 WordPress blogs (less than 1% of all WordPress blogs) was recently involved in a distributed denial of service (DDoS) attack against a single website. Attackers exploited the Pingback feature in these WordPress blogs (which is enabled by default) to flood the target site with junk HTTP requests, causing it to be shut down by its hosting company.

A quarter of the phishing sites hosted on WordPress blogs in February targeted PayPal users, followed by 17% which targeted Apple customers.

Please contact us (sales@netcraft.com) for pricing or further details about any of our anti-phishing and web application security testing services.

Most Reliable Hosting Company Sites in February 2014

Rank Performance Graph OS Outage
DNS Connect First
1 Qube Managed Services Linux 0:00:00 0.000 0.100 0.039 0.081 0.081
2 ServerStack Linux 0:00:00 0.008 0.087 0.076 0.150 0.150
3 Hosting 4 Less Linux 0:00:00 0.017 0.174 0.125 0.248 0.634
4 Datapipe FreeBSD 0:00:00 0.021 0.077 0.018 0.037 0.055
5 XILO Communications Ltd. Linux 0:00:00 0.021 0.199 0.069 0.166 0.261
6 www.dinahosting.com Linux 0:00:00 0.021 0.233 0.087 0.175 0.175
7 Server Intellect Windows Server 2012 0:00:00 0.021 0.075 0.101 0.638 0.998
8 Pair Networks FreeBSD 0:00:00 0.025 0.226 0.085 0.170 0.562
9 iWeb Linux 0:00:00 0.033 0.155 0.090 0.177 0.177
10 Anexia Linux 0:00:00 0.050 0.131 0.103 0.453 0.746

See full table

London-based Qube Managed Services had February's most reliable hosting company site, www.qubenet.co.uk, which successfully responded to all requests sent. This is the second time in six months Qube has had no failed requests, having also achieved it back in September. Qube's reliability is perhaps due to the routing infrastructure it has in place at its data centres in London, New York and Zurich. Qube's carriers include Level 3 Communications and Zayo (formerly AboveNet), both of which are known for their extensive network coverage across Europe and America.

In second place is ServerStack with two failed requests. ServerStack has maintained a 100% uptime record over the past year and offers a 100% uptime service-level agreement from its data centres in Amsterdam, New Jersey and San Jose. ServerStack uses the nginx web server to serve its website and also some of world's busiest websites, including a site which serves 150 million pageviews per day.

In third place with four failed requests is Hosting 4 Less. Hosting 4 Less has a 99.9% uptime guarantee and has been providing web hosting services for over 15 years. It owns and operates a Californian data centre facility which is privately peered via multiple gigabit connections to the Internet backbone.

FreeBSD powered the sites for both Datapipe (lowest connection time within the top 10) and Pair Networks. Windows Server 2012 powered Server Intellect and the remaining seven sites ran Linux, including first place Qube.

Netcraft measures and makes available the response times of around forty leading hosting providers' sites. The performance measurements are made at fifteen minute intervals from separate points around the internet, and averages are calculated over the immediately preceding 24 hour period.

From a customer's point of view, the percentage of failed requests is more pertinent than outages on hosting companies' own sites, as this gives a pointer to reliability of routing, and this is why we choose to rank our table by fewest failed requests, rather than shortest periods of outage. In the event the number of failed requests are equal then sites are ranked by average connection times.

Information on the measurement process and current measurements is available.

Microsoft neck and neck with Amazon in Windows hosting

Microsoft has edged ahead of Amazon to become the largest hosting company as measured by the number of web-facing Windows computers. The pair have been neck and neck for almost nine months: Microsoft now has 23,400 web-facing Windows computers against Amazon's 22,600. Barring companies with large connectivity aspects to their businesses — including China Telecom, Comcast, Time Warner, and Verizon — Amazon and Microsoft are the largest Windows hosting companies in the world, though the market is still fragmented with each having just over 1% of the market.

Microsoft's growth is predominantly a result of the growth of Windows Azure: Azure now accounts for close to 90% of all web-facing computers at Microsoft. Windows Azure has grown by almost 50% since May 2013, during the February 2014 Web Server survey Netcraft found 27,000 web-facing computers (both Windows and Linux) using the cloud computing platform. Many of Microsoft's own services are powered by Windows Azure including Office 365, Xbox Live, Skype, and OneDrive.

Windows Azure Web Sites service — available to the general public since June 2013 — may be the driving force behind Azure's growth. This Platform as a Service allows existing applications written in ASP, ASP.NET, PHP, Node.js, or Python to be deployed on an automatically scaling platform without managing individual computers. Microsoft also provides pre-configured software packages, such as WordPress, which can be used immediately with the Web Site service.

With over 1% of all Windows web-facing computers in the world hosted at Azure, Microsoft is now defeating the Windows hosting providers which it still partners with, and which four years ago would have been its sole revenue source in the hosting market.

Azure Regions

Azure's data centres are split into regions and geos: there are several regions within each larger geo (formerly major regions).

United States US West (California), US East (Virginia), US North Central (Illinois), US South Central (Texas)
Europe Europe West (Netherlands), Europe North (Ireland)
Asia Pacific Asia Pacific East (Hong Kong), Asia Pacific South-East (Singapore)
Japan Japan East (Saitama Prefecture), Japan West (Osaka Prefecture)

The two new Japanese Azure regions were made available to the general public on 25th February 2014, less than a year after they were first announced. Whilst all other Azure regions all share the same price for virtual machines (from 2¢ per hour), the two new Japanese regions are more expensive: virtual machines start at 2.7¢ (Japan East) and 2.4¢ (Japan West) per hour. Neither Japanese region was detected in the February 2014 web server survey which ran in mid-January.

More than half of all web-facing Azure computers are hosted within the United States. US East is the most populated US region, closely followed by US West. However, Europe West is the most populated Azure region in the world, accounting for 20% of all web-facing Azure computers. In total, 52% of Azure's web-facing computers are in the United States, 36% are in Europe, and only 12% are in Asia Pacific.

Being able to use Windows Azure in China could offer new opportunities to non-Chinese companies who wish to increase their internet presence in China, although Netcraft has previously noted a number of issues which could hold back the growth of cloud computing in China.

For additional performance when serving content to users around the globe, the Windows Azure Content Delivery Network (CDN) can be used. This allows end users to download content from one of more than 20 different CDN node locations, which is likely to be quicker than downloading the non-cached content directly.

Whilst Azure operates across the globe certain features, such as redundancy, can only operate within the same geo. Furthermore, some Azure services are not available in all regions – for example, Azure Web Sites cannot be deployed in US South Central or Asia Pacific South-East, and the Windows Azure Scheduler is only available in one region per geo.

Operating systems

Windows Azure virtual machines exhibit the TCP/IP characteristics of the operating systems installed on them, and thus it is possible to remotely determine which operating systems are being used by Azure customers.

Windows Server 2008 is the most popular operating system installed on Azure instances, although this is not necessarily a choice that is down to the customer — for example, when using the Blob storage service to expose files over HTTP/HTTPS, the user cannot choose which operating system to use.

Windows Server is used by 90% of all web-facing computers at Azure, including three computers which still appear to be running Windows Server 2003. The remaining 10% use Linux, with Ubuntu being the most commonly identified distribution.

Unsurprisingly, Microsoft IIS and Microsoft HTTPAPI are the most common web servers on the Windows Server computers at Azure; however, a few hundred websites use Apache on Windows. As expected, Apache is the most common web server for websites served from Linux machines at Azure (62%) followed by nginx (33%).

Preview services

Several Azure services are currently offered only as preview services, which means they are made available only for evaluation purposes. Some of these preview services have had well-established Amazon equivalents for several years. For example, the Windows Azure Scheduler preview service offers similar functionality to Amazon's Simple Workflow Service (SWF), which has been available for 2 years.

Microsoft's preview services also include the Azure Import/Export Service, which allows users to transfer large amounts of data into Windows Azure Blob storage. Customers can send an encrypted hard disk to Microsoft and the data on the hard disk will be uploaded directly into the Blob storage account. Microsoft currently only accepts hard disk deliveries from the United States (although the service can be used to send data to and from European and Asian cloud regions). Amazon's own Import/Export service has been available since 2010.

Blob Storage

Windows Azure Blob (Binary Large Object) Storage is Microsoft's answer to Amazon's Simple Storage Service (S3). Both allow large files such as video, audio and images to be stored, although while Amazon has no storage limits, individual blobs on Azure have a storage limit of 200TB. Blobs can be mounted as drives and accessed from a web application as if they were ordinary NTFS volumes. If this is the only way a Blob is used, then the frontend computer responsible for that Blob will not be directly measurable over the internet: Netcraft measures only publicly visible computers with corresponding DNS entries and which respond to HTTP requests.

Microsoft offers both locally redundant storage (replicas are held within a single region) and geo-redundant storage (replicas are held in multiple regions within a single geo). Read-Access Geo Redundant Storage is currently available as a preview service. This allows customers to have read access to a secondary storage replica so that it may still be accessed in the event of a failure in the primary storage location.

Users of Windows Azure

Some well known users of Windows Azure include the Sochi 2014 Olympic Games, luxury sports car manufacturer Aston Martin, Taiwanese electronics brand BenQ, McDonald's Happy Studio, and the Have I been pwned? website, which allows users to see whether their email addresses or usernames have been affected by any publicly released website security breaches.

Troy Hunt, the developer of haveibeenpwned.com, uses Windows Azure Table Storage to store more than 160 million records much more cheaply than a comparable relational database. In fact, one of his complaints about Windows Azure is that it is too damn fast: "The response from each search was coming back so quickly that the user wasn’t sure if it was legitimately checking subsequent addresses they entered or if there was a glitch". Hunt also described how he used SQL Server on Windows Azure to analyse last year's Adobe data breach, which with 153 million records. After downloading the breach data to a low-spec Azure virtual machine, he then upgraded the virtual machine to an 8-processor system with 56 gigabytes of RAM and completed his on-demand analysis at an estimated cost of $12.

Most Reliable Hosting Company Sites in January 2014

Rank Performance Graph OS Outage
DNS Connect First
1 Datapipe FreeBSD 0:00:00 0.007 0.090 0.020 0.039 0.059
2 Qube Managed Services Linux 0:00:00 0.007 0.109 0.041 0.083 0.083
3 Hyve Managed Hosting Linux 0:00:00 0.007 0.257 0.064 0.126 0.127
4 Netcetera Windows Server 2012 0:00:00 0.007 0.056 0.070 0.156 0.292
5 Swishmail FreeBSD 0:00:00 0.007 0.133 0.073 0.144 0.189
6 Bigstep Linux 0:00:00 0.011 0.314 0.065 0.137 0.228
7 www.uk2.net Linux 0:00:00 0.011 0.152 0.069 0.142 0.224
8 Server Intellect Windows Server 2012 0:00:00 0.011 0.089 0.099 0.635 0.984
9 Midphase Linux 0:00:00 0.015 0.262 0.120 0.243 0.444
10 Anexia Linux 0:00:00 0.019 0.127 0.093 0.436 0.717

See full table

All of the top five hosting company sites started the year with only two failed requests each. The average connection times were used to break the tie for first place.

Managed services provider Datapipe had January's most reliable hosting company site, with two failed requests and an average connection time of 20ms. Datapipe was the fastest within the top 10, and second overall. Datapipe provides managed enterprise cloud services via its Stratosphere cloud computing platform; delivered from Datapipe's global network of data centres in conjunction with Amazon Web Services. Datapipe acquired Newvem in September which has combined its managed AWS with a cloud optimisation platform. Datapipe has not had a single outage since 2006, and is only two months away from having 8 years of 100% continuous uptime.

In second place is last month's number one — Qube Managed Services, followed by UK based Hyve Managed Hosting in third place with average connection times of 41ms and 64ms respectively. Qube's hosting services are delivered from data centre facilities in London, New York and Zurich. This month is Qube's fifth consecutive month in the top 10.

Hyve Managed Hosting, in third place, offers a 100% network uptime guarantee by utilising multiple Tier 1 backbone providers and peering with multiple networks in multiple global locations. In December Hyve launched SecureShare which allows its customers to host their own encrypted file sharing servers which are protected behind its hardware firewalls, IPS systems and DDoS defense devices provided as part of its SecureCloud services.

Elsewhere in the full table this month Codero received $8M in financing from Silicon Valley Bank (SVB) and Farnam Street Financial. Codero is planning to deploy new data centres across the U.S. and Europe and expand its hosting portfolio to serve more customers.

FreeBSD powered Datapipe's site, at the top of the table, and also corporate email services provider Swishmail in 5th place. The remaining hosting company sites ran Linux except for two running Windows Server — Netcetera in 4th place and Server Intellect in 8th place.

Netcraft measures and makes available the response times of around forty leading hosting providers' sites. The performance measurements are made at fifteen minute intervals from separate points around the internet, and averages are calculated over the immediately preceding 24 hour period.

From a customer's point of view, the percentage of failed requests is more pertinent than outages on hosting companies' own sites, as this gives a pointer to reliability of routing, and this is why we choose to rank our table by fewest failed requests, rather than shortest periods of outage. In the event the number of failed requests are equal then sites are ranked by average connection times.

Information on the measurement process and current measurements is available.

Most Reliable Hosting Company Sites in December 2013

Rank Performance Graph OS Outage
DNS Connect First
1 Qube Managed Services Linux 0:00:00 0.004 0.100 0.043 0.087 0.088
2 Hosting 4 Less Linux 0:00:00 0.004 0.171 0.124 0.245 0.627
3 New York Internet FreeBSD 0:00:00 0.007 0.140 0.074 0.148 0.577
4 Pair Networks FreeBSD 0:00:00 0.007 0.234 0.083 0.169 0.572
5 www.dinahosting.com Linux 0:00:00 0.007 0.245 0.087 0.177 0.177
6 Webair Internet Development FreeBSD 0:00:00 0.011 0.167 0.073 0.154 0.353
7 Server Intellect Windows Server 2012 0:00:00 0.011 0.073 0.101 0.330 0.701
8 XILO Communications Ltd. Linux 0:00:00 0.019 0.202 0.068 0.136 0.234
9 Swishmail FreeBSD 0:00:00 0.019 0.126 0.074 0.146 0.192
10 ServerStack Linux 0:00:00 0.019 0.088 0.076 0.151 0.152

See full table

Qube Managed Services had the most reliable hosting company site in December 2013, making December Qube's fourth consecutive month in the top ten after attaining first place in September. Qube provides managed hosting services out of data centers in London, New York and Zurich. Qube and Hosting 4 Less, which placed second, both saw only a single failed request over the month with Hosting 4 Less losing out on the top spot due to a slightly longer average connection time (0.04s vs. 0.12s).

Swishmail made an appearance at ninth in the table, taking its total number of appearances in the top ten in 2013 to nine. This means that both iWeb and Swishmail jointly hold the record for the most frequent appearances in the top ten in 2013. Swishmail provides corporate email services on a FreeBSD platform, while iWeb provides dedicated servers, managed hosting and colocation services on a Linux platform.

To sign off the year, WebAir made its first appearance in the table for 2013, placing sixth. WebAir offers hosting services out of data centers in Los Angeles, Amsterdam, Montreal and a 'flagship' facility in New York (NY1), which WebAir claims offers 'the lowest network latency to Europe via direct feeds to Transatlantic fiber'.

Five of the top ten most reliable hosting company sites were running Linux, while four ran FreeBSD. Server Intellect ran the single Windows Server-based site to complete the list: Windows Server makes a reappearance after not placing in the top ten in November.

Netcraft measures and makes available the response times of around forty leading hosting providers' sites. The performance measurements are made at fifteen minute intervals from separate points around the internet, and averages are calculated over the immediately preceding 24 hour period.

From a customer's point of view, the percentage of failed requests is more pertinent than outages on hosting companies' own sites, as this gives a pointer to reliability of routing, and this is why we choose to rank our table by fewest failed requests, rather than shortest periods of outage. In the event the number of failed requests are equal then sites are ranked by average connection times.

Information on the measurement process and current measurements is available.

DigitalOcean now growing faster than Amazon

Cloud computing provider DigitalOcean is now growing faster than Amazon Web Services. Our December 2013 Web Server Survey showed a month-on-month gain of 6,514 web-facing computers at DigitalOcean; Amazon, meanwhile, grew by an almost as huge 6,269 web-facing computers. Together, the two companies accounted for more than a third of the internet-wide growth in web-facing computers in December.

DigitalOcean is now the 15th largest hosting company in terms of web-facing computers — a remarkable feat considering DigitalOcean had only 280 web-facing computers at the start of this year. Although Amazon is still the largest hosting company (by web-facing computers) and has nearly six times as many web-facing computers in total, the rapid growth at DigitalOcean may have startled those at Amazon who thought their major competitors were Microsoft Azure and Rackspace.

Whilst DigitalOcean competes directly with Amazon EC2, there are a number of Amazon Web Services which do not have a DigitalOcean equivalent. For example, Amazon offer file storage (S3), load balancing (Elastic Load Balancing), and a Content Delivery Network (CloudFront). However, by simplifying their offering — lack of support for Microsoft Windows is notable — and not offering enterprise features, DigitalOcean appeals to users with straightforward requirements such as small businesses and developers.

The cheapest virtual computer ("droplet") at DigitalOcean uses solid state storage and costs less than one cent per hour, about a third of the price of Amazon's cheapest on-demand instance. Unsurprisingly, such competitive pricing is attracting a large number of completely new customers as well as enticing other hosting companies' customers to switch to DigitalOcean.

Sites migrating from Amazon to DigitalOcean

818 existing websites migrated from Amazon to DigitalOcean this month, whereas only 88 sites moved in the opposite direction. Although the difference seems significant, the largest gains at DigitalOcean actually consist of new sites: DigitalOcean is currently hosting 490,000 websites, 120,000 of which were not present in last month's survey as per the Netcraft December 2013 Hosting Provider Switching Analysis.

Sites which migrated from Amazon to DigitalOcean include text messaging service Phonify (plus its API at api.phonify.io), several Windshield Guru sites, and real-time crowd photo sharing site zingly.

DigitalOcean growth trends and a timeline of events can be viewed at http://trends.netcraft.com/www.digitalocean.com