Maintenance

Regular database backups & optimizations

1. Download and install WP-DBManager (http://wordpress.org/extend/plugins/wp-dbmanager/)
2. Move /wp-content/plugins/wp-dbmanager/htaccess.txt to /wp-content/backup-db/.htaccess  (be sure to change file name)
3. Navigate to Database -> DB Options, scroll to the Automatic Scheduling section at the bottom of the page
4. Configure frequency and email address for database backups (select Gzip “Yes” option)
5. Configure frequency of database optimization
6. Click “Save Changes”

How to backup your site before upgrading

1. Download your wp-content directory (usually via FTP)
2. Export your database to a local file using WP-DBManager

Upgrading to 3.0

1. Download & unzip the latest stable release of WordPress (http://wordpress.org/download/)
2. Make a backup (refer to previous step
3. Install/Activate & enable the Maintenance Mode plugin (http://wordpress.org/extend/plugins/maintenance-mode/)
4. Delete the wp-admin & wp-includes folders
5. Upload everything EXCEPT the wp-content folder to your website
6. Upload the new TwentyTen theme to wp-content/themes/
7. When all files are done uploading, visit your WordPress admin (http://example.com/wp-admin/)
8. Click on the “Upgrade WordPress Database” button, then the subsequent “Continue” button.

Security

.htaccess stuff

• Don’t allow directory indexes put Options All -Indexes in your .htaccess file

Using .htaccess to protect wp-admin – wp-admin level .htaccess

Method 1 – IP Blocking: put the following in the .htaccess file in your wp-admin folder


order deny,allow
allow from 0.0.0.0 # This is your static IP (must be static IP, if dynamic, you may have to change this often)
allow from 12.345.678.90 (for multiple users or IPs)
deny from all

note: find your ip by going to http://whatismyip.com

Method 2 – Password Protection

Step 1: Create your .htpasswd file  (set FTP to “show invisible files”) (http://www.htaccesstools.com/htpasswd-generator/)
Step 2: Upload your .htpasswd files to your FTP
Step 3: Open your .htaccess file or create a new one if it doesn’t exist in /wp-admin and paste in the following:

<Files ~ "\.(php)$">
AuthUserFile /path/to/.htpasswd # must be absolute path from root (check your host for this info)
AuthType Basic
AuthName "restricted"
Order Deny,Allow
Deny from all
Require valid-user
Satisfy any
</Files>


No search engines for WP folders:

In robots.txt: Disallow: /wp-* (create a robots.txt at the root level if one does not exist)

Protect against brute force attacks: (http://wordpress.org/extend/plugins/login-lockdown/)

Change username from “admin”

1. Option 1 – Fresh 3.0 install: set username during install process
2. Option 2 – Database Query: update tableprefix_users set user_login=’newuser’ where user_login=’admin’; (usually via phpMyAdmin)

Tip: Only use editor and below user roles for publishing

Change your table prefix from default “wp_”

1. Option 1 – Fresh install: change the table prefix during the install process
2. Option 2 – Current install: change table prefix variable in the config file and update the database table names (usually via phpMyAdmin; requires that database user have ALTER permissions)

Tip: Correct file permissions (Security Scan Plugin)

Protect against Spam Comments/Email Obfuscation

1. Akismet
2. Cookies for Comments (plugin)
3. SpamShiv! (plugin)

Tip: Don’t host with GoDaddy or Network Solutions =)

Possibly Related Information

• No Related Information

This plugin allows you to prompt your readers to comment by asking them to answer a question specific to that post. A simple box with text that you define when writing your post is added above the comment form. The box can be styled to match your site by adjusting some predefined options.

Here are some screenshots of the plugin’s interface:

Meta box to set up the question on the post edit screen

Settings for the visual display of the box on the front end

On our recent trip to WordCamp NYC, we entered a plugin development contest. Out of all the entries we won! This plugin was built as a group effort with some other developers. I am very happy to announce that the plugin has been posted to the official WordPress plugin directory.

So, as part of the contest, one of the requirements was to work within a team environment. This was definitely a change for us. While Jeff and I used to working with each other, we rarely lean on others for any kind of insight. For this contest, we reached out to two others: a long-time WordPress user (Andrew C.) and a trusted WordPress developer (John Hawkins).

At first I saw this as a way to fulfill requirements of the competition, but looking back on it now, having those additional resources at hand is more powerful than I originally imagined. John, Andrew, and eventually Blair and Drew, offered a lot of additional insight into not only the how the code was written and user experience, but ideas for future releases of this plugin. With all of our previous releases, we put 99% of the features we had planned into the initial release. This meant that future releases were done primarily to update things that had broken with WordPress core updates.

I definitely see the value to both our work and the community, in developing plugins with a greater motive (and I think that was the intention of this competition at WordCamp NYC…point well taken). John and I spoke about the idea of canonical plugins several times at WordCamp NYC, and he even presented about it in his ignite session. The basic idea, that seems like a really good one, is that one plugin would cover the foundation of basic functionality, but could be extended by other plugins to allow for more customized functionality. Currently in the WordPress plugin directory, there are a lot of plugins with duplicated functionality. Imagine if all of those individual developers came together and wrote a super plugin that covered 90% of the core features of all of those plugins and could be extended by other smaller, more precise plugins for individual use. I think this would be a huge step forward from how things are currently being developed.

The last thing I took from this competition came from being judged by Mark, Matt and Brian. I think I got through Brian and Matt so quickly because we used a lot of the built-in WordPress features, looks and script libraries. Mark, being security minded (that’s a good thing), had another thing in mind. As he showed off the plugin, he began exploiting it using a lot of fairly common tactics. To be totally honest, we hadn’t spent a lot of time on security when we built this because it was a late entry into the contest. Security is an often overlooked, but crucial part of any plugin. What’s the point in having a super secure software like WordPress, when you run 75 plugins that can easily be exploited to give hackers instant access to your admin? Plugin developers, take a moment ot look over the plugins you have made. Do you escape results from the database? Do you use nonces? If not, you really should. Mark has a great article about the new escaping functions and another one about using nonces properly.

Future: I will be adding a screencast for this plugin shortly, so stay tuned for that.

Possibly Related Information

• Speed Up WordPress by Deactivating Unused Plugins
• Skype Headset Giveaway
• (PLUGIN) Favicon Generator
• (Plugin) SpamShiv Lite
• (PLUGIN) Spam Protection by SpamShiv

As always you can get the newest version of WordPress from the WordPress.org download page. We recommend always upgrading WordPress to the latest stable version available. If you don’t have the time or don’t know how, you can always hire us to make the upgrade for you. Just fill out the form on our “need help?” page and we’ll be in touch.

2.8.6 fixes two security problems that can be exploited by registered, logged in users who have posting privileges.  If you have untrusted authors on your blog, upgrading to 2.8.6 is recommended.

The first problem is an XSS vulnerability in Press This discovered by Benjamin Flesch.  The second problem, discovered by Dawid Golunski, is an issue with sanitizing uploaded file names that can be exploited in certain Apache configurations. Thanks to Benjamin and Dawid for finding and reporting these.

Possibly Related Information

• No Related Information

Sency is a real-time search engine. While the service is still in its infancy, I think it has the potential to become a big player in the search industry. My initial reactions to the service were of the “so what” nature, but after talking through the goal of the service with the founder, Evan Britton, I’ve changed my tune a little bit. This service differs from Google in that it’s not really a web search engine. It’s more of a conversation search engine. The interface mimics a “dressed up Google”, but the functionality couldn’t be more different.

Sency searches the web (predominately Twitter at this point) for conversations related to your keyword search. Not only does it filter out a lot of the junk that comes through Twitter, it actually separates the most popular links for that search term throughout the day so you can see what’s most popular at any given time.

Pretty cool, eh?

Well, we think it’s going to catch on, so we built a plugin that lets you put Sency search results in your WordPress sidebar.

Download Sency (137.86 kB) Update: This plugin is now hosted at the WordPress.org Plugin Directory

Possibly Related Information

• Forthcoming update to the Favicon Generator WordPress Plugin
• (Widget) RSS Icon Widget
• (Widget) XBOX Live Gamer Card

8 Meaningful Takeaways

1. Accessibility counts for something. Glenda Watson Hyatt laid out some ground rules for making your website POUR (Perceivable Operable Understandable Robust). I’m not going to give it all away, but you can download the ebook from her site: http://blogaccessibility.com/
2. John P says that using URL shortening services like bit.ly, su.pr and TinyUrl is a detriment to your search engine reach. Instead of putting links to your website out in the wild to build some authority, you send out these other services’ links and boost up their popularity in the search engines. Pretty Link Pro by Blair Williams will likely replace two or three of your existing WordPress plugins and solve this exact problem for you. It will allow you to create short links for twitter and other sharing right on your own domain. This will help you keep all the Google juice that you deserve. I could probably have gotten Blair to give me a copy of the plugin after palling around all weekend, but as soon as I got home, I turned on my computer and bought the sucker. Check out the feature video for details: http://prettylinkpro.com/
3. Go meet people in person at conferences. It’s nice to have a billion friends/followers online, but I bet having just five of those billion friends be actual real-life friends is more motivating, profitable and fun. Just make sure there’s no overlap, otherwise you’ll never have anything to talk about…hehe. Oh, and one more thing. Go to conferences alone. It will force you to interact with people that you wouldn’t otherwise approach.
4. Go where the people are. Chris Pirillo is an Internet giant, yet he comes to where the people hang out online instead of forcing them to come to him. This means that getting your content syndicated in as many places as possible is super important.
5. Care. Don’t care so much about the money you’re hoping to make, just care about why you’re doing it. If you put your heart into it, the money will come.
6. It’s not good enough to just install the All-In-One SEO Pack plugin. You have to use it. When you’re posting to your website, scroll all the way down and fill in the meta box. You’ll be pleasantly surprised with your results.
7. Never say no to a free show ticket. That’s kind of obvious, I know.
8. Take your laptop with you.

If you want the short version, stop reading here. Otherwise, block out a good twenty minutes and read the rest of my ramblings about the weekend.

Day 1 (Friday)

I woke up at 3am in Orange County so that I could get some client work finished before heading to Vegas. I backed out of my driveway at 5:32 am and by 9:15 I had arrived in Vegas and checked into my hotel room. I walked around the back only to see a sliding glass door on the first floor with a shattered window (I later read about poor Eduardo’s story).

I popped in to the convention and watched a bit of the opening keynote before coming back to the exhibit floor. I wandered the booths for a little while before WordCamp Las Vegas started and talked with some of the exhibitors, but nothing really jumped out at me. I met up with Drew and Jen of Jestro and took a seat at the packed house that was WordCamp Las Vegas…or, not.

Because of the way the venue was laid out, WordCamp didn’t get a lot of foot traffic and as a result it sorely lacked in the attendee department. However, what it lacked in attendees, it made up for with amazing networking opportunities. During the first day, here’s a rundown of all of the awesome people I mingled with:

1. The Dudes from Headway Themes (http://headwaythemes.com) – I didn’t catch their names, but I won one of their themes from WPCoder.com last month. If you use the code hwBWE09 before Oct. 24th you can get 20% off Headway, an amazingly configurable WordPress theme.
2. John Hawkins (http://johnhawkinsunrated.com) – John is the long time organizer of WordCamp Las Vegas and WordPress plugin developer. John is not only a great developer, but an amazing personality. I’ve met him on a couple of occasions and was always impressed with his willingness to offer guidance and support.
3. Scott Porad (http://icanhascheezburger.com) – CTO of the Cheezburger network. I Can Has Cheezburger is kind of a staple at WordCamps. I’ve seen Bun Huh and Scott Pora (twice) present about their business model and I still can’t believe how simple it is. "Make people laugh for 5 minutes a day". That’s it. The first time I saw Scott present was at WordCamp San Francisco back in May. I think the presentation was lost on me due to the sheer number of people that were at that conference. In Las Vegas, we literally sat down in a semi-circle and introduced ourselves to him. It was a very intimate setting and I got a lot out of it.
4. Angelo Mandato (http://pluginspodcast.com) – Lead developer of the Blubrry Podcasting plugin and host of The WordPress Plugins Podcast. Angelo’s presentation covered how to set up WordPress with Blubrry to make a Podcast. I had a brief opportunity to talk with him before the presentation about the plugin podcast and potentially speaking at our WordCamp.
5. John Pozadzidas (http://woopra.com) – CEO of Woopra, statistics for the real-time web. I love John’s personality. He’s funny and brutally honest. He started off his presentation “Win or Die” by reminding us all that he is our competition. It’s true and we all have to remember that while being social is fine and dandy, the business of becoming an authority on the web is a fierce battle. John’s presentation was my favorite of day one.
6. Blair Williams (http://blairwilliams.com) – creator of the outstanding Pretty Link Pro WordPress plugin (http://www.prettylinkpro.com). Blair was sitting next to me during John P’s talk. The only reason I even met him was because John P mentioned Pretty Link Pro in his presentation. If I didn’t meet blair, I probably would have had a boring and uneventful weekend (more on that in a bit).
7. Darin Hardy (http://inmotionhosting.com) – Marketing Manager for InMotion hosting, sponsor of WordCamp Los Angeles (and hopefully for WordCamp Orange County). I recognized Darin from a previous WordCamp that I had been to. I knew that InMotion had sponsored WordCamp Los Angeles, so when we talked it was all business. I’m hoping ot bring them on as a sponsor for Orange County WordCamp.
8. Cali Lewis (http://geekbrief.tv) – Host of Geek Brief TV. Cali is a big personality in the geek universe. I saw her present in San Francisco, and I was hoping to talk her in to speaking at OC WordCamp about video. I dropped the seed, let’s see if it grows into a better opportunity.
9. Austin Passy (http://austinpassy.com) – organizer of WordCamp LA, WordPress designer/developer. I originall met Austin at WordCamp LA. He’s been another great resource for us in our own planning of OC WordCamp, and he’s a hellofa nice guy too.

As I said before, my weekend probably would have been pretty lazy (due to my lack of sleep) if it wasn’t for Blair. Blair scored some tickets to the Blue Man Group at the Venetian and asked Drew, Jen and I if we wanted to join him. He asked if I knew anyone else who wanted to go, so I called up my buddy Jason Van Orden (http://www.jasonvanorden.com) and the four of us tagged along to the show. I met up with Blair, Austin, Ben and Scott at The Jet nightclub (which I basically had to weasel my way into) for the official Blogworld after party. Blair and I took off to see the Blue Man Group with a few new friends, Ronjini and some other random guy from the club. The show was awesome. I’ve never seen it before so it was all new to me, but I gotta say that it kept me entertained (and awake) all the way until the end of the show at midnight even though I was running on three hours of sleep. I highly recommend the show to anyone who’s planning a trip to Vegas. Updated: Jason sent me a sneaky cam video of me playing the pipe’s in the gift shop. Won’t you ave a little fun at my expense. =)

Click here to view the embedded video.

Day 2 (Saturday)

Phew. Day one was exhausting. I had planned on starting out the day having breakfast with Jason and some of his friends, but I got up too early and ended up with 30 minutes to kill before breakfast at Paradise Cafe in the Las Vegas Hilton. I sat down at a slot machine and proceeded to lose $100. Not a good start to the day. At least Jay paid for breakfast (thanks Jay)! I met some cool people at breakfast, including Emile Bourquin (CTO of Ideas For Download – http://ideasfordownload.com), Chris Christensen (Host of the Amateur Traveler podcast – http://amateurtraveler.com), David Jacobs (http://connectedworldmedia.com), and Karin Hoegh (Podcasting consultant from Denmark – http://podconsult.dk). This informal setting turned out to be a great little mini-session on social media and membership sites.

After breakfast I made my way back to the conference where I stood guard at the WordPress Genius booth. There I met Dana and Karen, from Content Robot (http://contentrobot.com). When my shift was over, I made my way to the WordCamp session already in progress. On the way I ran into Aaron Kronis, Rockstar SEO Consultant from WPromote. He showed off a really interesting SEO tool that WPromote is releasing in the coming weeks. I’m hoping we can get Aaron to speak on an SEO panel at OC WordCamp.

I think the most valuable information came from Glenda Watson Hyatt (http://doitmyselfblog.com). She gave a talk on website accessibility. I think a lot of people take web accessibility for granted, but according to Glenda, 18% of the U.S. population is living with a disability. That’s 18% of a market just in the U.S. that is being neglected. That’s a lot of money (for those of you who are trying to monetize your websites) to leave on the table.

Blair and I took a walk to get some free ice cream in the exhibit hall when we ran into Tracy and Stu from WPWishlist (http://member.wishlistproducts.com/). For those of you who don’t know, WPWishlist makes a membership plugin for WordPress. We’ve just finished building a membership site using it, and it’s fantastic. I’ll be writing an article on it here soon. I talked to them about some pretty exciting business opportunities (more on that another time).

After that, I knew the conference couldn’t get any better, so I decided to jump in the car and head back to Orange County. I was feeling so lucky because of all the chance meetings I had that day that I stopped in at Prim to test my luck. I sat down at a slot machine and within 20 minutes, I had won my $100 back from the morning. On the way to cash it in, I stopped at another machine that caught my eye. I sat down once more and within another 15 minutes I was walking away with another $200. I was very happy with my winnings, so I got in the car and drove home, a perfect end to the already fantastic weekend.

Possibly Related Information

• No Related Information