1. Open your WordPress dashboard and navigate to Settings –> Discussion.
2. Open another tab and go to the splorp comment blacklist.
3. Copy the contents (use the little “copy” icon next to the word “raw” in the top left of the pane containing the blacklist).
4. Go back to your WordPress Discussion settings, and paste the contents of the blacklist.txt file into the field labeled Disallowed Comment Keys. The paste operation may take a moment because the blacklist.txt file has so many entries.
5. Click the blue “Save changes” button at the bottom of the screen (you’ll need to scroll to see it).

That’s it, now WordPress will automatically delete any incoming comment that contains anything in the blacklist.txt file.

You can officially stop reading now, you’re done.

If you’re curious, though, here’s a bit more detail on how the blacklist works:

The Discussion settings in WordPress contain two fields you can use to filter and block spam:

• Comment Moderation: WordPress will put incoming comments in the “pending” category if they contain terms entered in this field, so it’s a good place to test blacklist terms without deleting the comments that contain them.
• Disallowed Comment Keys: WordPress will silently delete any incoming comments containing terms entered in this field.

Because the terms in these two fields are used for simple text-string searches, you need to be careful not to cause false positives (where a legitimate comment could get marked as spam).

For example, the text string “cialis”, which is a common spam term, is contained in perfectly acceptable words like specialist and socialism (more examples can be found on the Wikipedia page for the Scunthorpe problem).

Anyway, the splorp blacklist is a human-created, human-curated list of terms that have shown up in actual WordPress comment spam. It’s updated frequently, and there are several plugins that incorporate it into their spam-blocking functions (so if you want your site to always contain the latest version, you can check out the list of plugins on the splorp blacklist’s home page).

The arms race against WordPress comment spam is a constant struggle: You put one layer of protection in place, then the spammers figure out where the holes are, then you put another layer in place, and so on and so on.

The splorp comment blacklist is an excellent layer, and I recommend it highly.

The post Use a blacklist to block (a lot of) WordPress comment spam appeared first on Wendy Cholbi.

A new Peace of Mind Program client had a WordPress website that was swamped with comment spam. Did you even know that the little red notifications circle can expand to contain a seven-digit number, complete with commas? Now you do!

Even though these comments were all “pending”, meaning they weren’t actually visible on the site in question, they were causing big problems: My client was drowning in notification emails, and the sheer volume of spam comments clogging the database was slowing down the site considerably.

Deleting this many comments at once from within the WordPress dashboard would take eons, and probably crash the site to boot. Fortunately, I was able to obliterate 3,555,219 spam comments in seconds, with one database command.

All of this “AI” garbage was destroyed instantly:

So far, so good. I had cleared the backlog. But what about stopping new spam comments from coming in?

I followed the Swiss cheese method of stopping WordPress spam and applied three layers of protection:

1. Tightening up the built-in WordPress settings to close comments on posts more than two weeks old and automatically block comments containing 1 or more links.
2. Adding the splorp comment blacklist to filter out common spam words, characters, and phrases.
3. Installing an invisible CAPTCHA to silently block automated spammers (bots/scripts) from being able to submit the comment form.

Using this multilayered approach, I was able to reduce the firehose of incoming spam from hundreds per day to a few per week.

Even that low level of spam could be further reduced with more tinkering: Adding a security plugin or a dedicated spam-busting plugin, for instance, or adding custom entries to the comment blacklist based on incoming spam entries.

But getting rid of the backlog and slowing incoming spam to a feeble trickle is something to celebrate, at least until the spammers move on to their next trick.

The post The Case of the 3,555,219 Spam Comments appeared first on Wendy Cholbi.

You probably saw a variant of this swiss-cheese diagram sometime in the past few years, illustrating a layered approach to stopping transmission of airborne viruses.

The same concept can help explain how to reduce spam on WordPress websites. Even though there’s not a one-simple-trick 100% effective solution, layering several solutions can stop the majority of spam emails.

Somewhat counterintuitively, the first question you want to ask is not “How do I reduce spam?” Instead, it’s some variation on “How do I want people to be able to interact with my site?”

For example, a membership site requires a lot of interactions. A static brochure site for an offline business might not need any (your phone number might be the only contact information necessary). A site that sells products or services almost certainly requires at least one contact form, but might not need or allow comments. A blog might have comments as its lifeblood.

So first, let’s distinguish between the types of spam you might be receiving.

Contact form spam

This is the hardest type of spam to deal with because for most websites, you DO want your website visitors to be able to fill out a form to contact you. You want to give your potential customers an easy and friendly way to reach you.

But when bots and spammers find these forms, you start getting tons of obviously spammy messages: Long lists of links, messages in other languages, and various, er, unsavory propositions. These are often mixed in with form submissions that look at first glance to be genuine, causing you to waste time sifting through the muck to pick out the legitimate inquiries.

Comment spam

This type of spam should only be an issue if you are actually running a blog that allows comments. If you’re not, then you can turn off the WordPress commenting system from Settings –> Discussion in your WordPress dashboard.

If you do allow comments, managing and moderating them is going to be a regular part of your website maintenance.

Registration spam

This is much less common, because most sites aren’t membership sites. Unless you are actually running an online community that allows new members to sign up, you’ll want to be sure that the “Anyone can register” checkbox is UNchecked in Settings –> General in your WordPress dashboard.

And if you are running a membership community, your membership plugin, if it’s any good, should have some built-in ways to prevent member registration by bots and spammers.

OK but what can you actually DO?

If you are currently receiving spam emails from your WordPress website, you will likely want to put more than one layer of defense in place:

• Fine-tune the built-in WordPress settings. These apply only to comment and registration spam. You can close comments on blog posts older than a given number of days, and block posts that contain more than a given number of links.
• Use a blacklist. This is a built-in setting (so, again, it only applies to comment spam and not to contact form spam) that deserves its own bullet point. You can manually list anything you want to block in the Discussion settings, or you can paste in a collection of known spam terms.
• Leverage your contact form’s settings. Depending on what plugin you use to handle your contact forms, you may have access to anti-spam tools and integration with third-party solutions such as…
• Add a CAPTCHA. You will need an account with an external service provider for this, like Google’s ReCAPTCHA or CloudFlare’s hCAPTCHA, both of which have free tiers that require some hoop-jumping to set up. This solution can be applied to all types of spam, as well as giving you some protection for your login and registration pages. And not all CAPTCHAs are the annoying “select all traffic lights” challenges; some are invisible.
• Leverage your web host’s settings. Web hosts vary widely, so ask yours whether there are anti-spam settings you can apply from your hosting dashboard (which is distinct from your WordPress dashboard).

What about plugins?

Yes, there are absolutely plugins that can do some or all of these things for you. But “add a plugin” isn’t the actual solution — it’s a way to implement one or more solutions. For example:

• Security plugins can stop some automated attempts to log in or fill out forms, allow you to block IP addresses, and integrate third-party CAPTCHAs into your login and registration pages.
• Contact form plugins usually have some anti-spam features and also may allow CAPTCHA integration into form submission.
• Anti-spam plugins are, of course, dedicated to this specific problem, and can often be integrated with your contact forms.

Conclusion

The conflict between spammers and website owners can be a bit of an arms race: Every time a plugin comes up with a way to block spam, some spammer figures out a new way to get around it.

Don’t despair, though. Adding a few common-sense layers will stem most of the deluge, leaving you free to work on the parts of your business that are more fulfilling.

The post The swiss-cheese approach to stopping WordPress spam appeared first on Wendy Cholbi.

But that’s a premium (meaning: You have to pay for it) plugin, and it requires setting up a backup schedule and connecting to a central dashboard.

So what do you do if you don’t have the wherewithal to fiddle with setting up a Whole System and you just want to make a backup right now?

I suggest the (free) UpdraftPlus plugin.

Although it will try to upsell you on a premium service, the free version works perfectly well for making a backup right now, and can even handle a simple automated schedule if you want to set one up later, when you get more wherewithal.

You do need to install and activate the plugin, but immediately upon activation, you’ll be prompted to make your first backup in only two clicks:

It’s safe to accept the default checkboxes in the popup.

Once the backup finishes running, I suggest downloading a copy to your computer just to be on the safe side. Just click each button under “Backup Data” to copy it to your computer.

Here’s where you can click the blue “Restore” button to restore all or part of your backup if necessary. The plugin will prompt you through the steps.

Now that you have a complete copy of your website in two places (in your WordPress dashboard and downloaded to your computer), you have a safety net in case an update or a change breaks something on your site.

The post The quickest way to make a backup of your WordPress website appeared first on Wendy Cholbi.

If you have already updated to 6.7, your site probably updated to 6.7.1 on its own (and if you’re a member of my Peace of Mind Program, I’ve verified that you are fully up-to-date already). Head to Dashboard –> Updates in your WordPress dashboard and look for the text at the top of the page that tells you whether WordPress is using the latest released version.

If your site didn’t update on its own, take a look at my notes on troubleshooting WordPress automatic updates.

If you still need to update to 6.7, or are multiple versions behind, or are nervous about updating your site, you’re not the only one. It’s OK to take it slow, following best practices for updating. 

Or you can hand the entire update process off to me and not have to worry about a thing.

Here’s hoping your update is smooth sailing!

The post Has your site safely updated to WordPress 6.7.1? appeared first on Wendy Cholbi.

My recommendation: If your site is already running well on the previous version, WordPress 6.6.2, it is probably safe to go ahead and update. I’ve already updated my own site and all my clients’ sites with no problems.

Get help with your WordPress update

If you haven’t updated your WordPress website in awhile, you’ll want to set aside a wee bit of time to get ready to update safely, especially if you’re more than one version behind. 

Download my free 10-step WordPress Update Checklist to learn about the important pre- and post-update maintenance tasks that will keep your site in tip-top condition.

Or join my Peace of Mind Program
to have me take care of it all for you.
You can be fully updated within a week.

What’s new in WordPress 6.7?

Not a whole lot, honestly. 

There are multiple security fixes, plus under-the-hood improvements to make it faster and more accessible, and the Block Editor continues to very slowly roll out design settings like customizable borders and colors to more blocks, but there’s no flagship feature that will revolutionize the experience of writing a new blog post.

Here’s the official WordPress release announcement, and here is a detailed list in tech-speak of all the changes.

Remember, you’re not alone

If you’re nervous about updating your site, you’re not the only one. It’s OK to take it slow, following best practices for updating. 

Or you can hand the entire update process off to me and not have to worry about a thing.

Here’s hoping your update is smooth sailing!

The post WordPress 6.7 is here! Is your site update-ready? appeared first on Wendy Cholbi.

If your only Google-hosted email is an address ending in gmail.com, you can keep using it for free. Free service is only being pulled from longtime users who have registered their own domain names (mydomain.com) and are using Google to host custom email addresses of the form me@mydomain.com.

If you’re one of these users, you signed up back when Google Workspace was called Google Apps for Your Domain (the service was also called G Suite for a few years, so if you don’t remember ever signing up for anything called Google Workspace, that’s why).

Google has already emailed you if you are the admin of an affected accounts. The message has the subject line “[Action required] Upgrade to get started with Google Workspace” and comes from the address workspace-noreply@google.com, a bit of a tipoff that “The Google Workspace Team” that sent the email does not want to actually hear from you, although they will happily accept your cash.

While Google says there will be a waiting list opening up for a “no-cost option”, there are currently no details of what that option would include. And with Google’s history of closing down perfectly good services, I’m not hanging around to find out.

(Not that I’m still holding a grudge because Google killed its RSS reader, not at all! Not that I’m still bitter because that shutdown lit the first torch in a scorched-earth campaign that rendered the blogosphere easy pickings for proprietary services from corporations like Medium and Substack, no, not me! Anyway there’s a great free RSS reader called NetNewsWire that I highly recommend. The open web still exists even if Google doesn’t want you to know about it.)

Your ideal post-Google Workspace setup

One way to avoid paying Google is to set up your email hosting with a new provider. You can also choose to stay with Google Workspace (they’re even offering discounts for the first year of paid Google Workspace service), but for the purposes of this guide, I’m going to stick to the idea that you’re moving away from Google Workspace.

Once you’ve set up your new email hosting, you’ll be able to use the same email addresses you were formerly using within Google Workspace (alice@mydomain.com, bob@mydomain.com, etc.) to send and receive mail. You can even import all your old emails to your new email host (but this is optional, and subject to the storage space allotment of your chosen provider).

You can use a third-party email client, like Apple Mail, Outlook, or Thunderbird (and if you’re already using one of these, you can keep using it — you’ll need to change some settings to access your new email host, though).

You can even continue to access your messages through the gmail website or app, by using a free gmail account to read and send messages that are hosted by your new email host. You first have to set up the actual email hosting separately, and then configure your gmail account to add an address that uses those settings. So, for example, if you have myname@gmail.com as a free address, and you have me@mydomain.com set up with an email host, you would need to go into your gmail settings for myname@gmail.com to add an email address, and use settings provided by your email host to set it up. Then, when you’re logged into gmail, you can receive emails sent to either of the two addresses, and choose which address to send from when you’re composing an outgoing message.

Choosing a new email host

When it comes to choosing a new email host, there are several options:

• Your web host may offer email hosting (either free if you have an associated website, or for an additional cost — hosts vary widely).
• Your domain name registrar (assuming it’s not Google) may offer email hosting, usually for a fee.
• There are paid email hosting services like Fastmail and ProtonMail that also offer services like calendars and shared documents, to take the place of Google Calendar and Google Docs.

Steps to switch your email

Here’s my recommended procedure for moving your email from Google to a new host:

1. Clean up your email. If you’re going to be exporting an archive of your old emails, you don’t want it to be 10 gigabytes of spam and trash. So at least empty the junk/trash folders, and maybe even take a crack at unsubscribing from useless lists and deleting stuff that’s not crucial to keep. Note to my fellow e-hoarders: Don’t let this step stop you from moving on to the next step! You don’t have to fully Marie Kondo your inbox just to escape from Google.
2. Export your email. Google offers a surprisingly straightforward service called Takeout, which lets you export not only your mail, but your calendars, docs, and even stuff like YouTube history, Google Voice messages, and more. Alternatively, if you’re exporting data for multiple usernames in your Google Workspace account, you can use their Data Export Tool.Don’t delete your email accounts yet.
3. Sign up with your new host and follow their instructions to set up new mailboxes or mail users to take the place of your Google Workspace-hosted addresses. If possible*, set these up as placeholders before doing the next step, which is the most important one, which is:
4. Update your domain’s MX records. Your new email host will have exact instructions for doing this, but basically you’re going to log into your domain registrar account, go to wherever the DNS records are maintained, and change all the records of the type “MX” (which stands for Mail eXchange) from “google” and “googlemail” to new records specified by your email host.
   
   Tip: Before you switch these records, look up your MX records using whatsmydns.net or a similar checker. Then, after you make the switch and save your new MX records, do that same lookup again to track the changes going “live” across the internet. Providers and hosts usually say to allow 24-48 hours, but it’s often much quicker, and sometimes within an hour you can see that your new records have replaced the Google ones.
   
   *If it wasn’t possible to create new mailboxes or user accounts at your new host before updating the MX records, create these immediately after you update the MX records. Because you haven’t deleted your Google Workspace user(s) yet, you will receive in your old Google Workspace inbox any email that arrives while the MX records are still pointing to Google. And you will receive in your new inbox any email that arrives after the MX records update.
5. Test sending and receiving. Once you’ve checked that your MX records are updated, test both sending and receiving using your new email host. Make sure the email client of your choice (Apple Mail, or Outlook, for example) works as you expect it to with the new settings.
6. (optional) Import mail archives. Your chosen email host will have specific instructions on how to do this.

Canceling Google Workspace

If you want to avoid being extorted into paying for Google Workspace, you’re going to want to cancel that service.

In addition to email, you may need to export (and import to a new provider) your calendars, documents, and anything else you want to keep.

Here’s how to avoid being billed by Google (or being shut down for not paying): First log into your Google admin console, then cancel your “subscription” to the free Google Workspace plan.

If you’ve safely exported all your user data and documents, you can now delete users from your organizations’s Google admin console. This permanently deletes the user’s email address and data.

To completely shut down everything, you can optionally delete your organization’s Google account, but be very sure you’re not still depending on any Google services before doing this. For instance, if you registered your domain through Google Domains, you will need to keep your Google account open (without any associated paid subscriptions) or transfer the domain to a new registrar.

The post Moving your domain’s email away from Google Workspace appeared first on Wendy Cholbi.

If you already know you’re in the market for a new web host (due to website downtime, surprise high bills, mysterious errors, unresponsive customer service, etc.), here are a few key points to take into account as you search.

I’d also suggest that even if you are happy with your web host (perhaps as evidenced by the fact that you haven’t thought about web hosting in awhile), it can’t hurt to check these points to make sure you’re still getting top-notch technical service and support.

Full disclosure

I have a few favorite web hosts that I recommend: DreamHost, GreenGeeks, and SiteGround. They meet every one of the tests I suggest below. I’ve been a customer of all three for many years, and I belong to all of their affiliate programs, so some of the links I provide here are affiliate links, even though I’d happily recommend each of these companies regardless of affiliate status.

Tech specs

If your web host doesn’t offer these two features, run away:

1. Free SSL certificate. This is what gives your site URL the padlock icon in the browser address bar. Without an SSL certificate, your site may give visitors a security warning. Most good hosts offer free certificates from LetsEncrypt, and some have their own equivalents, but if your web host is charging you money for an SSL certificate, they are profiteering on your ignorance. Also beware hosting plans that include a free SSL only for the first year; this service should be a permanent part of your hosting package.
2. Support for PHP version 8.3 or later. You don’t have to know anything about PHP (which is the programming language that underlies WordPress). If your web host doesn’t have a support document explaining what PHP versions are available, just ask whether they have support for version 8.3.

Those are the most important litmus tests (which are unfortunately necessary because some hosts won’t meet them). A few more nice-to-have features:

• Automated backups of your hosting account and/or your website (backing up your own website is still important, but host-managed backups provide another safety net).
• A built-in staging site lets you have a test version of your website, where you can experiment with new designs and features, and only roll them over to the live site when you’re sure they work, saving your visitors from viewing works-in-progress.
• If you want to work with a web developer, designer, or Peace of Mind Provider, it’s nice to be able to create a user login for them that grants them the necessary access to your website without having to share your account-owner password or expose your personal or billing information.

Pricing

Be warned: Almost every web host flat-out lies about its prices, by displaying what they claim is a “monthly” price for a hosting plan that can only be purchased by buying one or more years of service upfront. You’ll need to search out and read the fine print, as well as do some math, to determine your actual cost before checkout.

(Honorable mention goes to DreamHost for being the only host I know to put monthly plans on nearly equal footing with annual plans, displaying prices in a way that lets prospective customers see the difference between paying monthly and paying annually… although you still have to do some math to get the final cost.)

Also be cognizant of the fact that as a new customer, you can usually get a significantly discounted price at signup, but when it comes time to renew your plan (whether that’s in a month, a year, or multiple years), your bill is going to be much higher. Make a plan for this so you don’t get sticker-shocked into cardiac arrest when your next renewal date arrives.

If you’re signing up for a new hosting package, I always recommend looking for a solid money-back guarantee (all three of my recommended hosts offer a 30-day guarantee, which is long enough to kick the tires).

Customer support

If you needed to report that your website was down, how easy would it be to contact your web host?

If you already have experience with your web host’s customer support, has it been positive? Have they responded quickly enough and treated you with respect?

Does your host offer customer support in your preferred medium, in your time zone?

I, for example, am happiest when I can interact with support in writing, so email support tickets or live chat are my favorite ways to contact support. DreamHost only offers phone support for an extra fee, but my personal preferences are a match for this system.

Someone else might feel more comfortable speaking to a human on the phone, in which case it would be wise to check whether phone support is available (as it is from GreenGeeks 9am-midnight Eastern), and when lines are open. Time zones matter, even for email support, but especially for live chat and phone support.

Moving to a new host

If you know you are going to be switching hosts, it’s a good idea to check out whether your new host candidates offer any kind of website transfer or migration for new customers.

Both DreamHost and SiteGround have created WordPress migration plugins that are specific to their hosting platforms, and GreenGeeks offers a free migration service for new customers.

Web hosts will often have a migration service available as an add-on purchase, or you could hire your friendly Technology-to-English Translator to handle the move for you.

Whatever your chosen hosting solution, I hope you find a host that is the perfect match for your website. Even if you don’t love my recommended companies, there are undoubtedly other good WordPress web hosts out there, and I encourage you to ask questions and do your due diligence in choosing the right one for you.

The post Is it time to look for a new web host? appeared first on Wendy Cholbi.

Exhibit 1: The current pricing grid for one of the most popular hosts (one I would never recommend to anyone), showing prices that start at, supposedly, $5.99 per month. I’ve annotated it to show the actual amount a new customer would pay. See the text highlighted in yellow? It means the supposedly-monthly cost has to be multiplied by 36 to yield the actual initial payment:

Exhibit 2: The current pricing grid at another host I do not recommend, which was also recently in the news for changing its pricing structure with no warning and gutting its free plan. The CEO repeatedly cited the “monthly” cost of its plans as being a good deal for customers, even though there is no way to pay monthly:

Here’s a thought experiment: Imagine a prospective renter, looking at apartments. One of the factors in choosing a place to live, of course, is the cost of the rent. Wouldn’t it be reasonable for this renter to become alarmed if they agreed to rent an apartment for $1,000 per month, and then discovered the fine print on the lease required a first payment of $12,000?

Web hosting is essentially renting space on a web server, so it’s not the craziest of comparisons.

This type of dishonest advertising is, unfortunately, standard in the web hosting industry. Even my second-favorite host, SiteGround, is guilty of this practice. Here’s their current pricing grid:

…and here’s the fine print (there isn’t even an asterisk leading to this):

I still use SiteGround, believe their hosting is reliable, and continue to refer clients to them — but I think they can and should be more honest with their pricing descriptions.

My first-favorite host, DreamHost, comes the closest to honesty. Their pricing grid features a big toggle at the top that lets you choose whether to display the prices as monthly, 1-year plans, and 3-year plans.

However, the price displayed for the 1+ year plans is still not the total; you have to do the multiplication math yourself to figure out your total (and the 3-year plan is selected as the default, but given that something has to be the default, that’s a minor quibble):

…and here’s the pricing grid for their premium hosting service, DreamPress, also featuring a monthly/annual toggle right at the top:

(Related note: I also think web hosts should be generally more transparent about the renewal rates that apply after new-customer special pricing deals expire. My clients routinely experience sticker shock when their annual (or biennial or triennial) hosting packages auto-renew, for instance.)

But if web hosts would just stop lying about their prices being monthly, that would be a big improvement.

The post Web hosts, stop lying about your prices appeared first on Wendy Cholbi.

In the course of managing websites for my Peace of Mind Program clients, I need to be able to log into their WordPress dashboards, as well as their web hosting accounts, domain registrars, and assorted other services.

You probably already know that it isn’t a good idea to send someone a password via email (and the same goes for any sensitive information, like credit card numbers and Social Security numbers).

So what do I recommend to my clients when it comes to safely and securely sharing passwords with me?

Method 1: Create a new user account

The safest way to grant someone access to your WordPress dashboard is to create a new user with their email address. For site maintenance (tasks like running backups, managing plugins and themes, and the like), the new user should have admin-level privileges, but you can create a lower-level user (Editor or Author) for people who need to add or edit content but don’t need access to full site-management capabilities.

This approach avoids the security and logistical issues that can arise when sharing one password between two users, and you can delete the account later (or demote the user to non-admin-level access) if the need for access is temporary.

WordPress will automatically take care of emailing your new user, if you check the “Send the new user an email about their account” box during user creation. The user will be prompted to set up a new password, so you don’t need to create or send a new password for them.

A system like this, where a new user account is created that’s separate from yours, is safer than one where account access is shared between two or more people.

The WordPress Dashboard is a good example, but other systems (such as creating new FTP users to access your website files) may allow multiple users as well.

Method 2: Grant account access

If you can’t create a completely new, separate user account, you may be able to create a sub-account with specific access privileges.

Good web hosts are increasingly offering this capability to website owners, because they understand that sometimes a website owner wants to delegate certain maintenance tasks while keeping full control of their websites.

My recommended hosts both offer this service to website owners: DreamHost lets you grant account privileges to others, and Siteground has a feature called Collaborator Access that does the same thing. You, as the website owner, can grant access to me, your website maintainer and troubleshooter, to take care of all your website needs without exposing your billing details or other sensitive account information.

Check with your web host to see if they offer a similar capability!

Method 3: Send a password with a one-time link

If there’s no way to create a new user or sub-account, and you must resort to sharing a password with someone (sometimes it’s necessary!), make sure that you share the password in a way that’s as safe as possible.

One rule of thumb is to never send the username and password in the same message.

Another is to use a one-time link (a link that will only work the first time it is clicked), or a link that expires after a specific amount of time or after being viewed a specific number of times.

Two recommended free services that provide one-time links:

• QuickForget allows you to attach files as well as send text items like passwords.
• scrt.link offers a free account that lets you get notifications when your secret has been viewed (and destroyed).

Method 4: Use your password manager

Finally, if you use a password manager to save and generate passwords, it may include the ability to send passwords securely to your contacts.

My favorite password manager, 1Password, recently introduced this feature. If you use a password manager (and you should!), it’s worth checking to see if it offers a secure way to send passwords to trusted contacts.

Wrapping it up

Basically, the first step is attempting to avoid sending an already-created password in the first place (by creating a separate login identity as described in Methods 1 and 2), and only then, if that proves impossible, resorting to Method 3 or 4 to minimize the security problems that come with sharing passwords.

The post How to safely share passwords appeared first on Wendy Cholbi.

However, with the release of Genesis 3.2, that checkbox has been integrated into the Genesis Framework itself, making the plugin redundant for most sites.

In keeping with the rule of “use all the plugins you actually need, and none that you don’t need”, I’d advise discontinuing use of this plugin, and switching to the built-in Genesis settings — unless you have a good reason to keep it (read on for details).

Requirements and caveats

There are a few requirements to keep in mind before you deactivate and delete the Genesis Title Toggle plugin.

• You’ll need to be using Genesis 3.2 or later. Here’s how to check what version of Genesis you’re using, and what to do if you can’t update past Genesis 2.10.1.
• Genesis 3.1+ requires at least WordPress 5.0. If you’ve updated to at least WordPress 5.0, you should really update to the latest version.
• You need to be able to use the “block editor”, also known as Gutenberg, for your pages. The Genesis Framework setting does not work in the pre-WordPress 5.0 “classic editor”, so if you are using a protection plugin like Disable Gutenberg or Classic Editor to completely disable the block editor, you won’t see the checkbox. Disable Gutenberg does let you use both editors, though, so you can keep that plugin installed if it’s useful to you, and you will see the Genesis setting whenever you choose the “Block Edit” function to edit a page (I am still using this plugin on multiple sites, and it works very well to help site owners transition to the new editor).
• Are you using Genesis Title Toggle to hide the titles on ALL your pages, and do you have a lot of pages? The plugin contains a sitewide default setting to hide all page titles, but the Genesis Framework setting is only available on individual pages, so you may want to stick with the plugin rather than click a checkbox 300 times.
• Are you willing to go through your pages and make a list of the ones using the Hide Title feature? Unfortunately, the Genesis Framework doesn’t automatically pick up settings from the plugin, so after you deactivate the plugin, you’ll need to manually click the checkbox on each page where you want the title hidden. This is usually worth it, unless you have the above mentioned 300-page issue.

How to use the new “Hide Title” setting

As I mentioned above, you will need to know which pages need their titles hidden. Once you have this list ready, go ahead and deactivate the plugin.

If you’re not 100% metaphysically certain of your list, don’t delete the plugin just yet. If it’s deactivated but not deleted, you can temporarily reactivate it to double-check what setting you had previously chosen for each page. Once you delete the plugin, that information will be lost.

With the plugin deactivated, you can now visit each page whose title you’d like to hide, and enable the Hide Title checkbox:

In the page editing screen, click the Genesis icon near the top right corner of the screen (it looks sort of like a ringed planet with a very tiny G on it). This opens the Genesis-specific page settings.

There should be a setting labeled “Title”. If you don’t see the checkbox below the label, click the tiny carat/triangle on the right side to expand the section.

Once you’ve checked the “Hide Title” box, remember to click the blue “Update” button at the top of the Genesis settings to save your choice.

Once you’ve gone through all your pages and are satisfied with the results, it’s safe to delete the plugin. Thanks, Genesis Title Toggle, you were great while you lasted. In fact, you were so good you got promoted!

The post The Genesis Title Toggle plugin is no longer necessary appeared first on Wendy Cholbi.

• The site footer (commonly used for copyright notices, credits, disclaimers, and contact information, but you can put pretty much anything here)
• The information at the top of a blog post (typically, though not limited to, the author and date, which is why it is sometimes called the post byline; known in WordPress lingo as post info)
• The information at the bottom of a blog post (typically, though not limited to, the category and tags; known in WordPress lingo as post meta)

However, since the release of Genesis 3.1.0 on August 21, 2019, the Genesis Framework itself contains settings to customize these three areas, making the plugin redundant.

In keeping with the rule of “use all the plugins you actually need, and none that you don’t need”, I’d advise discontinuing use of this plugin, and switching to the built-in Genesis settings. Read on for step-by-step instructions for how to do this.

Requirements for using the Genesis Framework settings

You must be using Genesis 3.1 or later to take advantage of these settings. Here’s how to check what version of Genesis you’re using, and what to do if you can’t update past Genesis 2.10.1.

Because Genesis 3.1 requires at least WordPress version 5.0, you should really update to the latest version of WordPress.

How to use the Genesis settings to edit your site footer

Navigate to Genesis –> Theme Settings (you can also get to this same screen by navigating to Appearance –> Customize and clicking “Theme Settings”).

Look for the Footer item near the bottom of the list, and click it. This will open the Footer field.

The Footer field should automatically be filled with the same text you had in the Footer Credits Text field of the Genesis Simple Edits plugin, but you can edit this by typing whatever you want to include in your footer. Plain text and HTML are accepted in this field. There’s also a handy link to some Genesis-specific footer shortcodes. Click the blue “Publish” button to save your changes.

If you don’t see the Footer item between Content Archives and Header/Footer Scripts, you may need to deactivate the Genesis Simple Edits plugin to get it to show up.

If the Footer field is blank instead of containing the footer text that you originally created in Genesis Simple Edits, check which of the plugin’s footer fields you were using (yes, you may need to reactivate the plugin temporarily; this won’t hurt any of the Genesis settings).

Genesis Simple Edits actually contained two footer fields, one called “Footer Credits Text” and one called “Footer Output”. You could choose one or the other but not both.

When you update to Genesis 3.1 or later, the Footer field in the new Genesis theme settings should automatically populate with whatever was in your “Footer Credits Text” field in Genesis Simple Edits. The update will also remove this field completely from the Genesis Simple Edits plugin settings, so you can’t easily go back and forth between the old plugin settings and the new Genesis settings.

The “Footer Output” field in Genesis Simple Edits, however, will be ignored by the new Genesis settings. So if it turns out you were using the “Footer Output” field in Genesis Simple Edits to modify your site footer, just copy the entire contents of that field, go back to Genesis –> Theme Settings –> Footer, and paste everything in the Footer field.

Now you can safely deactivate the Genesis Simple Edits plugin.

How to use the Genesis settings to edit your post byline/post info and post meta

Navigate to Genesis –> Theme Settings (you can also get to this same screen by navigating to Appearance –> Customize and clicking “Theme Settings”).

Look for the Singular Content item near the middle of the list, and click it. This will open two fields labeled “Entry Meta (above content)” and “Entry Meta (below content)”, where you can type whatever you want to include in your footer. Plain text and HTML are accepted in this field. There’s also a handy link to some Genesis-specific post shortcodes. Click the blue “Publish” button to save your changes.

If you don’t see the “Singular Content” item between “Comments and Trackbacks” and “Content Archives”, you may need to deactivate the Genesis Simple Edits plugin to get it to show up.

The two fields in the Singular Content settings should automatically populate with the identically named fields in Genesis Simple Edits. However, unlike the footer settings, these plugin fields aren’t removed when you update to Genesis 3.1, so you can easily switch back and forth between the plugin settings (reactivate the plugin if necessary) and the Genesis theme settings to make sure the new Genesis theme settings match what you previously had set up in the plugin.

Once you are satisfied with the contents of the Footer and Singular Content fields in the Genesis theme settings, you can safely deactivate and delete the Genesis Simple Edits plugin.

The post The Genesis Simple Edits plugin is no longer necessary appeared first on Wendy Cholbi.

For instance, WordPress site owners can now customize several parts of their sites that previously required plugins or code snippets:

• Customize your site footer with Genesis settings instead of using the Genesis Simple Edits plugin
• Customize your post meta and post info (the pre- and post-content items like the byline, number of comments, category and tags) with Genesis settings instead of using the Genesis Simple Edits plugin
• Hide individual page and post titles with a checkbox provided by Genesis instead of using the Genesis Title Toggle plugin

In order to take advantage of all of these new features, you must update Genesis to version 3.2 or later.

How to find out what version of Genesis your site is using

Method 1: Visit your Dashboard. In the very first section, labeled “At a Glance”, there will be a description of what theme you’re using.

Method 2: Visit Appearance –> Themes, hover over the Genesis panel, click Theme Details, and look for the version number in the popup window that appears.

If your Genesis version is lower than 3

If you are using an outdated version of Genesis, but you are not seeing an available update (at the top of your admin screen or in Dashboard –> Updates), first check to see whether you have update notifications turned on.

To do this, visit Appearance –> Customize –> Theme Settings –> Updates. This setting contains one checkbox, which must be checked to allow your WordPress site to look for available Genesis updates. If the box is not checked, check it and click the blue “Publish” button (which doesn’t publish anything new to your site, it’s just a poorly labeled “Save Changes” button).

With this box checked, your site dashboard will display a notification when a new version is available, and Genesis updates will appear in Dashboard –> Updates. If you don’t log into your site very often, you can add your email address to be notified when a new version is released.

Is your child theme compatible with Genesis 3.0?

If you have “Check for Updates” turned on and saved, and you’re still not seeing an available update even though your site is using a pre-3.0 version of Genesis, you may be using an older child theme that is not compatible with newer versions of Genesis.

Child themes that use a coding standard called XHTML will break your site’s formatting if Genesis is updated to version 3.0 or later, so the Genesis Framework is smart enough to not even show you the possibility of an update.

Only child themes that use a newer coding standard called HTML5 are compatible with Genesis 3.0 and later. All of the child themes currently available for sale on the StudioPress website use HTML5, but some child themes that were formerly sold there used the old XHTML standard.

Here’s a list of XHTML Genesis child themes that were formerly available on the StudioPress website, but have been discontinued. If you’re using one of these child themes, you will need to switch to a newer HTML5 child theme in order to update your version of Genesis:

If you’re using a Genesis child theme made by a third-party developer (i.e. not StudioPress), you may need to ask that developer whether the child theme uses HTML5 or if there is a newer HTML5 version available.

Special note if you are using the Dynamik Website Builder by Cobalt Apps

This child theme is fully compatible with the newest version of Genesis, but you might need to check the box labeled “Activate Genesis HTML5 Markup” on the Dynamik –> Settings –> General Settings screen.

This box should be checked by default, but if your website has been using Dynamik for more than a few years, there’s a chance you installed it before that default behavior was established. The Cobalt Apps blog has a detailed description of how to fix HTML5-related issues with Dynamik.

The post Why can’t I update the Genesis Framework? appeared first on Wendy Cholbi.

And just as a car needs frequent fueling, less-frequent oil changes, and occasionally the attention of a mechanic when something actually breaks or wears out, your website needs regular updates that you can do from the dashboard, and occasionally the attention of an expert when something breaks or becomes obsolete.

When a car breaks down, one of the first things your mechanic will do is take a look at what’s going on under the hood.

When your website breaks, one of the first things I’m going to do to troubleshoot is to take a look at the site’s files via FTP.

Using FTP is slightly more complicated than popping the hood of your car (you probably don’t need a password to pop the hood), so there’s nothing wrong with wanting to delegate it to a professional. Just like changing your car’s oil, you can do it yourself or you can pay someone to do it for you.

Okay, but what is FTP exactly?

FTP stands for File Transfer Protocol, and you can use FTP software (often called an “FTP client”) to browse and modify the files in your web hosting account.

For normal day-to-day operation of your website, all you need is access to your WordPress dashboard. But if something goes wrong and you can’t access the dashboard — whether you see an error message when you try to log in or whether you experience the dreaded White Screen of Death — you’ll need direct access to your website files.

For instance, once in a great while, WordPress updates will fail in a way that requires FTP to fix (although this error is much less common than it used to be).

How to use FTP

First, check your web host’s documentation (or help desk or knowledge base or whatever they’re calling it this week) for their instructions on using FTP, particularly for configuring your FTP client. Your web host may have even emailed you FTP instructions when you first signed up for web hosting.

Next, you’ll need a piece of software called an FTP client, which is different from a web browser. You can get a free FTP client called FileZilla here if you don’t have one installed on your computer. Click the button labeled “Download FileZilla client (all platforms)” and the site should auto-detect whether you’re using a Mac, Windows, or Linux.

When you open your FTP client, you’ll need three pieces of information to login to see your website’s files:

1. A hostname. Often this is simply ftp.your-domain.com, but sometimes it’s a server address at your web host. This is why you need to read your web host’s specific instructions.
2. A username. Sometimes your web host assigns you one, sometimes you have to set this up yourself. Some hosts automatically make usernames end in @your-domain, and some don’t.
3. A password. If you don’t know your FTP password, you will need to log into your web hosting account to generate a new one (for security reasons, you won’t be able to see or retrieve an existing password, so just reset it). Resetting the password won’t affect anything on your website.

Two quick notes about resetting and using your FTP password:

• Please take care to create a solid, secure password, because this is a direct doorway to all of your website files. Once you’ve got a working FTP password, you can save it in FileZilla’s Site Manager so you don’t have to remember it or write it down. This is why I use a password manager.
• You may be tempted to use the same password for your web hosting account, your FTP login, and your WordPress dashboard. Please please please do not do this. I know it seems easier to have one password than three passwords for the same site, but it’s a terrible idea, security-wise. Much better to let your password manager generate unique random passwords for everything.

Now that you’re logged in, what can you do?

First, be careful.

Changes to these files can wreck your site, so if you make any changes, back up the originals first. This is very easy with most FTP clients — just copy the file or files in question from the web server to your computer. Then you can simply restore the originals if you ever make a change that breaks something.

That said, here are a few situations when FTP access is useful.

• Backing up: You can create a complete backup of everything in your website (except the database, which is not one of the files you can access via FTP) just by copying everything from your web host to your computer. I wouldn’t recommend this as a sustainable long-term strategy, but it can be handy in a pinch.
• Restoring from a backup: If you know for sure that a specific file (or plugin or theme) is causing a problem on your website, you can replace that file on your web server by uploading a backup copy from your computer. And if you need to do a full-site restore, for example from a BackupBuddy zip file, you will need to upload the zip file to your web server to start that process.
• Restoring access to the dashboard: Sometimes, website problems can be fixed by editing or uploading fresh copies of one or more WordPress configuration files. The .htaccess file and the wp-config.php file are the most common culprits here.
• Troubleshooting plugins: A very common piece of WordPress troubleshooting advice is “disable all of your plugins”. You can do this from your WordPress dashboard, but the process can take awhile. If you want to do it quickly, or you can’t access your dashboard, you can rename your plugins folder using your FTP client, which will make WordPress unable to find and use any of your plugins. Create an empty folder named “plugins” and your site should load without any active plugins. If this step fixes your website problem, you can move plugin files from your renamed folder into the new plugins folder one at a time to see which one caused the original problem.

These are only a few of the basics that can be accomplished by looking under the hood of your WordPress website with the help of an FTP client.

The post What every WordPress website owner needs to know about FTP appeared first on Wendy Cholbi.

Here’s how to check :

1. Look in the “At a Glance” section of the home page of your WordPress dashboard for the version of WordPress your site is currently running. This should be near the top of the page, on the first page you see when you log into the Dashboard.
2. If you’re not running the current version of WordPress, you should see an “update nag” message at the top of this page, telling you which version is the latest one available.

If the only difference between what your site is running and the latest version available is in the third digit (for instance you’re running 6.8.1 and the latest version is 6.8.2, or you’re running 6.8, and the latest version is 6.8.1), you’re probably safe to update with the regular one-click process, although you might want to figure out why your site hasn’t updated itself, because these so-called minor updates are supposed to get installed automatically.

But if your site’s version and the latest version differ by more than one in the second digit (your site is running 6.0 and the latest is 6.3 or your site is running 6.4 and the latest is 6.8), that means you’re more than one major version behind.

The one-click update process will always update WordPress to the latest version available, which means that if you are more than one version behind, you’ll skip several versions to catch up to the latest release.

Is this is a safe thing to do?

Well, it depends.

The official WordPress guide to manual updating says this:

“If you plan on upgrading across more than two major releases, you should consider upgrading incrementally to avoid potential conflicts and minimize the risks of database damage.”

But it also says, in the very next paragraph:

“WordPress 3.7 introduced an easy to use one-button updater which will take you directly to Current Version. This update step is safe, and it is possible to one-click update from 3.7 to any later version.”

Should you, or shouldn’t you?

Well, here’s a quick rundown of three alternatives:

Option 1: The one-click update process will probably work fine, but I would strongly advise you to have a full backup and know how to restore your site from that backup if necessary before clicking it (and leave yourself some extra time for troubleshooting).

Option 2: Alternatively, you can install the Core Rollback plugin, which, despite the “rollback” in its name, allows both upgrading and downgrading to any existing (official and stable) version of WordPress. Once the plugin is installed and activated, use the plugin’s settings to manually specify the version of WordPress you want to end up on (the safest approach is to update one version at a time, making a backup before each update). Then your one-click update screen in your dashboard (Home –> Updates) will display the option to “roll back” to that version, (even though it’s an update and not a roll-back), and you can use that screen to update WordPress. Repeat until you’re at the latest version, and then if everything has gone well, you can safely deactivate and delete the plugin.

Option 3: The alternative to the one-click updater is to update manually and incrementally, which requires accessing your site’s files directly via FTP and replacing certain WordPress files and folders with new ones downloaded from WordPress.org’s release archive. And if the reason you’re doing this is to go one version at a time, you’ll be doing it more than once.

However you choose to update WordPress, you will certainly also need to update plugins, and quite possibly your theme, since new versions will have been released. You’ll also want to follow the post-update steps in my free WordPress Update Checklist to make sure the update went successfully.

Any of the three approaches above is very doable if you’re patient and careful and follow the instructions. Use my free guide How to Upgrade Anything for a helping hand.

But if you’re feeling like all the above options are too daunting, don’t worry, there are plenty of people just like you who don’t have the time or inclination to take on a multi-version WordPress update. With a Website Tune-Up, you can hand all that off to me, and with my ongoing Peace of Mind Program, you’ll never fall behind with your WordPress updates (and plugin and theme updates, and regular scheduled backups) again.

The post Leapfrogging multiple versions of WordPress appeared first on Wendy Cholbi.