InetDaemon.Com started seeing an increase in fake registrations at the site, around 10-20 daily up from around 1-2 per week.  Periodically, I go back and clean out old unused accounts.  This is just part of routine maintenance and security any site using a dynamic web application like WordPress should be doing.  More than 99% of these bogus accounts were never used, so this means that the people (or bots) didn’t sign up to use the site, but registered for another purpose.   Since we don’t sell anything here or take credit card numbers, I can only assume they want to harvest the local logins and email addresses, which are the only thing we have stored here. I have shut down the membership registration functions temporarily until I can figure out a solution that is so unpalatable to the spammers and other criminals that it’s not worth their time.

Since I’m an IT professional with more than 10 years experience with WordPress, I know the right things to do to protect a WordPress instance.  More on WordPress Security later.