I got an unexpected email this morning.

<img class="aligncenter size-full wp-image-8105" title="Screen shot 2011-04-15 at 08.00.49" src="http://davidhewson.com/wp-content/uploads/2011/04/Screen-shot-2011-04-15-at-08.00.49.png" alt="" width="624" height="414" />Yesterday Wordpress.com was hacked to the 'root' level, which means the intruders potentially had access to everything there. If you're a Wordpress.com user -- the hosted Wordpress, not the individual accounts on other hosts -- you should be changing your passwords now because they are no longer secure.

But Vaultpress? This is a new service for Wordpress.org users on other hosts. I put it on my site a couple of months ago. It costs $15 a month and backs up your WP install during the day. I've got mixed feelings about it to be honest. If you could restore a WP install with a single click that would be fine. But you can't. If things go wrong you just get the latest database backup and have to go through a painful manual reinstall process. To be honest you can do pretty much the same thing yourself through a free WP plugin.

But I like WP and I thought taking out a Vaultpress subscription was one way of paying something for important software I currently get for free.

For Vaultpress to work it needs access to the back end of your site system. In my case that means FTP and SSH access. <em>The hack of Wordpress also hacked Vaultpress since it sits on the same system.</em>

What that means is they didn't just hack Wordpress. In theory they hacked the sites of everyone using Vaultpress too. With that ftp and SSH login the hackers could read, upload and delete files anywhere on your system. If you gave Vaultpress your database login too they could do other damage. In the worst instance if you used your site admin account to set up Vaultpress's access the hackers could now have complete control of your C Panel and do anything you like.

So you need to change the passwords on your site and then update them in Vaultpress too. Which is a royal pain.

In my case there's going to be a third action too: cancel Vaultpress. It didn't seem great value at $15 a month, which will buy you premium hosting itself. With the best will in the world --  and I feel a lot of goodwill towards the Wordpress people -- what's the point in paying for a 'protection' service that not only gets hacked but provides a back door into its customers' external sites too?

The really odd thing is for $25 a month Vaultpress offers a 'premium' product which <a href="http://blog.vaultpress.com/2010/11/26/new-vaultpress-security-scanning/" target="_blank">promises advanced security checks</a> to make sure if anyone is tampering with your Wordpress site. Sorry folks. But if you want to look after my security you need to prove you can look after your own first.