I don’t really have a take on the security angle at this point - it’s not something I’ve looked into. There’s nothing like getting hacked to motivate you though! Just like losing all your files can be a good motivator for doing more regular backups. Perhaps I’ll put this on my “to-do” list.

Thanks for letting me know about this; I didn’t realize it was happening. The first of the two subscribe checkboxes was provided by the Brian’s Threaded Comments plugin, and the second one by the Subscribe to Comments plugin. It took a while to figure out, because I had forgotten that “Brian’s threaded comments” required me to replace the comments.php file in my theme folder, so activating and deactivating comments-related plugins did all sorts of weird things. I’ve removed “Brian’s threaded comments” since comment threading is available with Better Comments Manager. Either checkbox subscribed you correctly, but it was odd to have two. Also, was glad to remove the modified comments.php and replace it with the original anyway, as, apparently, it’s easy to forget about the modification!

Regards,

Dale

That’s a good question. The password I was using at the time wasn’t too complex, so I just assumed some password-cracking tool figured it out. However, I spoke with Yahoo! hosting support about it, too, and their take was that even without knowing my password, a cleverly written PHP script could have compromised the site. Their contention was that blog files just weren’t that secure, and it was a common occurrence. I wasn’t sure how much weight to give that; and to be on the safe side, I changed my password to something much more complex … and it never happened again. Lot’s of variables here, though, especially since I was only at WordPress 2.0.2 at the time. I’m sure I’ll never know exactly how it was done; but at least it hasn’t happened since.

WordPress and security can be a little confusing; what do you think of this, for example:

http://www.deepjiveinterests.com/2008/01/19/hows-your-wp-contentplugins-folder-doing-secure-are-you-sure/

Does it really matter if someone can see the contents of a directory like this? And even if it was “secured” by the method described in this post, anyone who knows the name of a plugin subfolder can still get to the subfolder, unless they’re set up the same way….

Bye for now,

Dale

Dale

I see you’re still waiting on that upgrade - here’s the link:
http://intricateart.com/blog/how-to-upgrade-wordpress/

It includes a link to a newer plugin that auto upgrades in just a few very simple steps.

Bye for now,

Dale

Unfortunately, things like google, intenet explorer, word press, et al are high profile ‘hook’ targets simply because those things are so common.

Might I recommend ~not using googlag ad sense advertising? Amazon is a good start, but there are many other high quality, reliable ad networks. Try here for ten good choices. I chose ‘Chitika’, but it’s your preference. I was simply tired of being ‘evil’.