Barry Welford considers himself lucky. The weekend he decided one of his blogs, Staygolinks.com, needed a cleanup was the same time a hacker chose to splatter the site with a host of unwanted pages.

"I was doing something I don't normally do: changing the theme of the blog. But it turned out that it was just after the hacker had got in," says Welford.

As he went through the software that drives his Wordpress-based blog, he found a block of code he didn't recognise. Its job was to subvert the engine that drives Wordpress and generate page after page of links to sites that purport to sell prescription drugs.

"It really was clever programming," he says. "He or she was creating a web-page factory within my website that probably, within about 24 hours, created a few thousand pages. Every time a search engine came in, it would build a new link."

Bad medicine

As an internet marketing consultant, Welford is one of a growing number who finds that blogging makes a site more visible to the search engines. But that in turn attracts criminals who want to hijack the traffic that comes with having a high page rank with Google and other search sites.

"It was amazing. I had the site fixed within 48 hours. But, even a week or two after that, if you did a search for some of these things, my website came up as number one, two, three."

Hackers do not just redirect surfers to Viagra vendors. They will inject code into blog pages that then try to dump password sniffers and other malware on to visitors' computers. Graham Cluley, senior technology consultant at Sophos, says: "We are seeing more and more websites becoming infected. We count 16,000 new malicious web pages every day. It's one every five seconds. And 90% of them are on legitimate sites that have been hacked."

Richard Archdeacon, one of the members of the Symantec security practice, says automated tools have made it easier than ever to create malware that can capture a user's keystrokes and passwords or help pass control of a user's computer to criminals. The blog has simply become one more way of delivering that malware.

"I would put it down as the emerging market," Archdeacon says. It is a phenomenon that has appeared in the past 18 months, but he insists it is just one type of attack among many - although the number of compromised blogs has risen quickly in that time.

In July, Sophos reported that Google's blogging site Blogspot.com is now the number one domain for delivering malware.

Cluley suggests that 2% of all malware on the web is hosted at Blogspot. He says: "A lot of that will be the bad guys setting up blogs with malicious content, but some of them will also be sites that have been hacked."

Security experts reckon weak passwords let in a lot of hackers. But it's not the only way in. In the past year, the open-source blogging software Wordpress became a popular target among hackers, partly because older versions proved vulnerable to attack.

Blog-tracking site Technorati saw an increasing number of otherwise legitimate blogs hosting malicious files and pages. So, the engineers behind the site decided to stop including those sites in its listings in the hope that this would encourage bloggers to update their software. "As bloggers have updated to the patched version of Wordpress, we have seen the number of hacked blogs drop accordingly," says Dorion Carroll, vice-president of engineering at Technorati.

A big problem for bloggers is working out when their site has been compromised. Hackers do a lot to cover their tracks. "They want to keep it running, so they want to avoid being a blip on the radar," Archdeacon says. The first sign may be when Google removes a blog from its pages or warns that visiting a site may damage your computer.

Security consultant and founder of Blogsecurity.net David Kierznowski said there are tools - such as iWatch and Tripwire - that site owners can use to watch for changes to files. "However, these types of tools are overkill for most blogs. My personal belief is that hosting providers should offer these services."

Site for sore eyes

Some plug-ins for tracking changes to blog pages have appeared recently in response to the growth in attacks. "They are certainly looking in the right direction," Kierznowski says.

To keep his sites running, Welford now has a routine based on the observation that hackers tend to hit blogs at weekends, when many of their users will be doing something else. "On Saturday morning, I do a check of my various blogs. And, on Monday, I do it again," he says. "On the internet, a lot of traffic comes through Google, so you want to be sure you have a good record with them."