In order for Akismet to work properly, you'll need to grab an API key from WordPress.com. That's right, from WordPress dot com, even though you have a self-hosted WP blog. Here's where to find it:

• You'll need to sign up for an account with WordPress.com first.
• You'll have the option to get a free WP blog, or just a user name; if you're only signing up to get the API key, then the latter will be fine.
• Once you've got your account, sign in,
• and navigate to My Account > Edit Profile (currently on a drop-down menu from the top left).
• Your API key is at the top of the profile page.
• Add it to your self-hosted WordPress blog under Plugins > Akismet Configuration.

What if you have more than one blog? WP API keys will work on as many blogs as you want them to. And if all this WordPress.com and self-hosted WordPress stuff has you confused, this post should help.

Because if you search PayPal's site for "express checkout", it doesn't find anything, and if you can ever find all the documentation, it *still* doesn't tell you how to get the API username, password and signature you need for most ecommerce apps.

So for the sake of my sanity, here is where to find the information you'll need.

• Sign into your PayPal account.
• Click "Profile" from the top.
• Under the "Account Info" list of links, click "API access"
• Under "Option 2", click "View API Certificate"
• On the next page, select "Request API signature" and click the "Agree and submit" button.
• Your API username, password and signature are on the next page

Why PayPal can't link this from the documentation, I'll never know, but hopefully that's saved a few people a few hours' hunting.

The function we want is get_pages(), which passes the list of pages as an array to PHP to process. You can then test for the existence of children, and mark parent pages accordingly. This snippet of code picks up only top-level parent pages, and marks them with a ">" -

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

<?php
//get our list of pages for PHP to process
$pages = get_pages('sort_column=menu_order'); 
//for each page in our list
  foreach ($pages as $page) {
//if it's not a child itself
        if (!$page->post_parent) {
//link the page
	echo "<li><a href=\"".get_page_link($page->ID)."\">".$page->post_title;
//see if it has children
        $children = wp_list_pages("title_li=&child_of=".$page->ID."&echo=0"); 
//if it does have children, put the arrow in
	if ($children) { echo " &gt; "; }
	echo "</a></li>";
  } 
}
  ?>

I must admit, it's a lot of code just for a couple of arrows, but if you're making - say - a navigation bar and want to indicate when fly-out menus are available, this is your boy.

If you want to exclude any particular page from the list, change line 8 to skip the page ID number you don't want:

1

if ((!$page->post_parent) && ($page->ID <> 999)) {

* I feel I want to add that people do call me about other stuff than WordPress. Sometimes

Which is why I loved the idea of a plugin which Donncha reviewed earlier today. Upgrade Notification by Email checks with WordPress.org once a day, and emails you if the version you're using isn't the latest one. It's perfect for people who don't check their Dashboard often, or who have several dozen WP installs to look after.

Photo credit: Freschje

This is a pretty sensible piece of advice. On most WP installs, "admin" is the default user name; if you want to hack a blog, it's a good place to start guessing. Which halves the security of the username/password combo, because only the password has to be guessed.

So when you're setting up a new WordPress blog, pick something other than "admin" for your user name. But what do you do if your existing blog is has "admin" for a username? Unfortunately, WP doesn't have an easy way to change a user name. You can do it through PHPMyAdmin, but a couple of people I know have managed to lock themselves out of WordPress altogether trying that.

The easiest way is to create a whole new administrator through WP's admin:

• From Users > Add New, create a new account. Pick a strong password. You'll need to use an email address that hasn't been used for any other user of your blog. Assign the new user the role of Administrator.
• Sign in as the new Administrator.
• Assign all of admin's posts to the new user: from Posts, choose Bulk Actions > Edit from the dropdown menu at the top. If you have a lot (pages and pages) of posts, you can reassign them automatically as part of the user deletion routine, but I always feel much safer moving the posts first!
• Go to Users > Authors & Users, and choose delete for the user "admin".
• If "admin" has any posts left attributed to them, you'll see the message shown below; assign all of admin's posts to your new user ID.

One other note re. comments: reassigning posts to a different author will break some minor features in comments. My gravatar stopped showing up (even though my new ID's email address was also registered with gravatar.com) and CSS that I had to highlight the comment as being by an author no longer highlighted my comments. The only way I found to fix this was through PHPMyAdmin, changing wp_comments table's user_id from my old ID number to my new one.

The above routine will remove "admin" as a user of your blog and help to keep your WordPress a little more secure. It should go without saying that this isn't enough: there are other things you should be doing, primarily keeping your install up to date.

Assuming your hosting provides access to your database through PHPMyAdmin or similar, editing multiple posts is easy. Sign into PHPMyAdmin, and find the table name which holds your blog posts; most likely this is wp_posts, but the wp_ prefix may be something else. Click the SQL button and enter the following:

UPDATE [wp_posts table] SET post_content = replace(post_content, "[old text]", "[replacement text]")

editing the square brackets and what's in them with your table name, old and replacement text strings. Remember, both the old text and the replacement text will need to be in quotes. If you want to get rid of some text but not replace it with anything, then leave the replacement text as just a pair of double quotes marks.

It would be remiss of me not to say that you should back up before you start messing about with PHPMyAdmin. But you're backing up your blog regularly anyway, right?

How to upgrade (from WP 2.7 or higher): it's so quick, you have no excuses.

By default, the_category() creates an unordered list (i.e. a vertical list with bullet points); this looks a bit odd with most themes, so you might want to change it to an inline list separated with spaces, commas or bullets:


<?php the_category(' '); ?>
<?php the_category(', '); ?>
<?php the_category(' &bull; '); ?>


You may also want to exclude a category or two from the list, if there are categories you're using for housekeeping and structure rather than just for classification. Unfortunately, the_category() doesn't have an exclude attribute, so we need to be a little bit more complicated to do that. In the code below, edit the list of categories you want to exclude, and how you want each item in the list separated:

<?php
//edit below for categories you want excluded
$exclude = array("Featured", "Uncategorized");
//how do you want the list separated? just a space is okay
$separator = " | ";
//don't edit below here!
$new_the_category = '';
foreach((get_the_category()) as $category) {
if (!in_array($category->cat_name, $exclude)) {
$new_the_category .= '<a href="'.get_bloginfo(url).'/'.get_option('category_base').'/'.$category->slug.'">'.$category->name.'</a>'.$separator;
}
}
echo substr($new_the_category, 0, strrpos($new_the_category, $separator));
?>

By default, WP renders category permalinks as http://domain/category/category-slug. Settings > Permalinks gives you the option to change this. However, if you're using the default, you'll need to explicitly state "category" in Permalinks' settings for the above code to work.

1. odd additions to permalinks - "eval" and "base64_decode". Your blog's permalinks will no longer work.
2. a new administrator account, perhaps named Administrator (2), created but not by you. This can happen even if registration is turned off on your blog.

If you haven't upgraded, DO IT NOW. As of today, you should be running version 2.8.4: check your dashboard. If it has any number lower than that, you need to upgrade. If you're using a version of WP higher than 2.7, it's as simple as clicking that nagging link on your dashboard; it takes less than a minute. So just do it. And if you need more detailed instructions for upgrading from pre-2.7, here they are.

If you've been hit with this already, then copying your posts and comments into a completely clean installation of WordPress seems to be the best way to deal with it. Simply upgrading now will most likely not deal with this (hackers know how WordPress upgrades work, and make the compromised files ones which are not over-written in an upgrade). Smackdown has more advice.

I'm going to say too, I'm pretty shocked by the attitude of some people: Weblog Tools Collection's comments have some who are saying they won't upgrade. If you take that line, frankly, you deserve what you get.

Update: one of the tricks this worm apparently uses is to use javascript to hide the existence of the extra administrator account within WP admin. If this is happening, you can look directly in the database (e.g. via PHPMyAdmin). Check wp_users (your blog may have a different prefix): if you normally only have one user, you'll easily see if anything's been added. If, however, you have a lot of registered users, you'll want to list out administrators and make sure they're all legit. Dougal Campbell has more details on this.