Website Tech

Tag: WordPress configuration

  • WordPress Ongoing Maintenance and Security

    WordPress Ongoing Maintenance and Security

    Having web sites run smoothly and safe from hackers, is important to me. It probably is important to you too, if you think about it a little. If you heard of any web site getting hacked, you know that could ruin your business day quickly.

    When you find out your site has been hacked, or your site stopped working so you can’t generate sales, you know you’re not going to be having a good day.

    After all, it’s easier to prevent problems like these, than to fix them…

    You have been told, already, you need to keep your software updated… You need to do regular backups… You know you should be blocking hackers, even if you don’t know how… Are you hoping you can last a little longer, letting maintenance slide?

    Preventing hackers from abusing your site is one very important part of running your web site, yet so many people and businesses just don’t have the time to do all the steps it takes. Even if you know how, or learn how, it’s not a good use of your time. You have better things to do!

    We all know your web site working, the way it should, helps to keep your reputation good. It also increases sales, right?

    Maintenance, done frequently, is important for your site.

    Latest updates to your WordPress software (and all other software) does several things, including fixing bugs that keep your site operating well, adding new features, and also fixing any security problems that have been discovered.

    Hackers know all those security problems. They study every security problem found world-wide, for how to take advantage of them.

    Updates Without Problems

    If an update does make a problem on your site, I know how to identify the problem very quickly, and get your site working again.

    However, I also prevent problems by testing plugin updates on a testing site, before doing the update on your site.

    I can replicate your site setup, plugins, theme, and content, on a testing site that is not accessible from the Internet. I will check the updates don’t introduce errors, whether with PHP or the WordPress database or other plugins.

    How Do You Get Your Site Secure From Hackers?

    Whether hackers want to post ads for their junk, or add links to steal traffic from you, or install malware to get your private information, or use your website hosting account to hack other sites, I hate hackers!

    Most businesses don’t have anyone who knows how to do maintenance and security checks properly. It’s complex. It takes time to learn, time to check everything each month. Most people could learn to do it themselves, if they were interested and had the time; but it’s just not your most fun and exciting thing to do. It’s not what you would best be spending your time on.

    (If that does sound good to you, contact me, I need more people helping have web sites run smoothly and be safe from hackers…)

    There are WordPress plugins that take care of many security steps. These have to be configured, and tested (some website hosting companies have non-standard server configurations, so not all security options will work on all hosting). [Note: If you’re on a Microsoft IIS server, which can’t use the most common WordPress security plugins, I feel for you, and I can help some…]

    You have to host your WordPress site on a company that has very strong security. Most of the best-known hosting companies are negligent about security; they don’t even keep the server software current; they don’t know WordPress security and troubleshooting; and they are not actively looking for ways to improve security. The best hosting companies have staff researching global security discussion boards for the latest hacker vulnerabilities, and put specific security rules in dedicated hardware installed between the Internet and the servers they host your site on.

    Another important security step is using passwords for every login that are difficult for hackers to guess. And the way we’ve been taught to make “secure” passwords, for example substituting punctuation for vowels or adding a digit and punctuation mark at the end, are known by hackers too — and now those passwords are easily and quickly guessed. Long computer-generated passwords are highly secure, but impossible for people to remember and difficult to type. I can teach you how to make secure passwords both easy to remember and easy to type.

    What I Provide

    Whether you want to learn to do it yourself, or you want me to take care of your maintenance and site security, here is what I provide:

    • Set up your WordPress site so it runs well. This includes removing plugins you don’t use, or that are security risks, or haven’t been updated in ages; adding plugins that are essential to the your site running properly; setting up site security so the most common attacks are blocked
    • Keep your site security updated so it is much harder to hack (so you keep out most hackers, but I can’t stop government-level hacking groups).
    • Keep current and past backups so your site can be recovered if something goes wrong. You always need a good backup!
    • If you have more than one site, or know you want more sites, I can set up WordPress Multi-Site for you, easier for most companies than working with many single-site installations of WordPress.
    • Select good plugins and themes. I find well written plugins and themes, that work well, don’t slow your site down, and are unlikely to have security vulnerabilities that hackers could exploit. Tip: with the WordPress block editor, you most likely can use the default TwentyTwenty theme, or a child theme that simply specifies your colors.
    • Migrate your site to an excellent hosting company, if you think you might already be hacked, or if you don’t know your host has excellent security and technical support. A few hosting companies charge comparable amounts per year of hosting, but provide much better quality service and much better protection against hackers, than the normal hosting company. You almost certainly can’t find better hosting on your own, than the Arizona WordPress Meetup has found.
    • Work with your hosting company technical support, to resolve any issues, so you won’t have to. (You’ll be able to use them or me for technical support.)
    • Improve your marketing, including install and configure software for telling Facebook, Twitter, LinkedIn, Pinterest and other social media sites what you want them to display (text and image) when someone references a page on your site.
    • Find what would speed up your site, which your visitors will love and so will search engines.

    Contact me about your site maintenance and security and what you want, and we’ll know if we’re a good match.

    Improve Your WordPress Site

    Consistent monthly amount, low $20 setup charge.

    Most basic sites, the kinds most small businesses need, I charge only $80/month, whether everything is working (that’s my job) or I have to put in many hours fixing something. This includes the first month, when I have to setup or reconfigure and check everything.

    For enhancing your website, we’ll talk about what you need and I’ll let you know if I can include it in your monthly maintenance, or if it will cost extra; we’ll agree before I make the enhancements.

    No contract, and I ask you set up minimum 6 months auto-pay so you don’t have to remember. Cancel any time, simply don’t pay for the next month and please let me know; but I don’t give refunds, since each month I will keep your site working.

  • Protect Yourself from Brute Force Login Attacks

    If you don’t have a secret user name and a very good password, hackers can easily log into your WordPress account as you.

    If you have created a password that you can remember, one that you have a chance of typing correctly, well, hackers already know the tricks people use to make a password, thinking it is “secure”. It is Not. With published lists of the top 10,000 passwords (that’s actually small, there are lists with up to 14 million unique passwords that people really used), and some readily available free software to try variations of those passwords, and enough time (a few hours to a few days), they have over 90% odds they will know your password.

    I’m going to give you some simple yet very effective ways to stop them. Ways to stop the numerous attempts at your login form. Ways to generate passwords the hackers can’t guess, even if they stole a copy of your database and work on it from home. Ways to make passwords you can remember that the hackers can’t guess. (more…)

  • Adding a Second Login to WordPress

    Logging in to WordPress is at the application level. You can also have a server login before getting to WordPress. This 2-step login makes your site much more secure.

    Once you know how, adding this server login is actually quite easy to do.

    Unlike plugins that might change parts of WordPress itself, this doesn’t change anything about WordPress; this uses the server’s security, so only people you say are permitted to execute programs.

    The most important folder to protect is wp-admin/ since it has, obviously, all the administrative programs for WordPress. Or, you can protect the wp-login.php file.

    One essential step is generating an encrypted version of the password you want to use. Then you have to know where to install the encrypted password, and how to tell your server to require the password for the files you want to protect.

    See my .htpassword tool for instructions and an easy way to generate the encrypted password your server would use.

  • PHP Unzip bug makes WordPress Updates hang

    I have been having problems with WordPress Updates for a while. No error messages, just the WordPress Update, or WordPress Plugin Update, hangs.

    Then I found out that the WordPress backup plugin I am using, BackWPUp, failed if I configured it to use any compression.

    Then I found out that the problems I had been having with random-seeming 500 Server Errors was from the WP-Super-Cache plugin configured with, hmm, compression.

    WordPress Updates would create new folders, but no files in them.

    I wrote a PHP program, outside of WordPress, to test if the problem was in WordPress, or in the version of PHP used on my server.

    The problem is in PHP. The PHP unzip routines lock up. No error message on screen, in the PHP log, or in the system log.

    WordPress 3.6.0 and 3.6.1, Multi-Site, Apache, PHP Version 5.2.17, [HTTP_ACCEPT_ENCODING] => gzip, deflate

    PHP itself has a bug in Zip/Unzip in old versions. Hangs without any error message displayed or in logs. Affects WordPress Update, and Plugin/Theme Updates, and any plugins that use compression (e.g. WP-Super-Cache or BackWPup)

    PHP Change Log http://www.php.net/ChangeLog-5.php#5.3.4 says
    PHP Version 5.3.4 released 09-Dec-2010 – Fixed crash in zip extract method

    Note: PHP versions are numbered so version 5.3.10 is higher than 5.3.9 (5.3.1 is lower)

    (more…)

  • PHP Unzip bug makes WordPress Updates hang

    I have been having problems with WordPress Updates for a while. No error messages, just the WordPress Update, or WordPress Plugin Update, hangs.

    Then I found out that the WordPress backup plugin I am using, BackWPUp, failed if I configured it to use any compression.

    Then I found out that the problems I had been having with random-seeming 500 Server Errors was from the WP-Super-Cache plugin configured with, hmm, compression.

    WordPress Updates would create new folders, but no files in them.

    I wrote a PHP program, outside of WordPress, to test if the problem was in WordPress, or in the version of PHP used on my server.

    The problem is in PHP. The PHP unzip routines lock up. No error message on screen, in the PHP log, or in the system log.

    WordPress 3.6.0 and 3.6.1, Multi-Site, Apache, PHP Version 5.2.17, [HTTP_ACCEPT_ENCODING] => gzip, deflate

    PHP itself has a bug in Zip/Unzip in old versions. Hangs without any error message displayed or in logs. Affects WordPress Update, and Plugin/Theme Updates, and any plugins that use compression (e.g. WP-Super-Cache or BackWPup)

    PHP Change Log http://www.php.net/ChangeLog-5.php#5.3.4 says
    PHP Version 5.3.4 released 09-Dec-2010 – Fixed crash in zip extract method

    Note: PHP versions are numbered so version 5.3.10 is higher than 5.3.9 (5.3.1 is lower)

    (more…)

  • WordPress Multi-Site Domain Mapping

    Important: This was written in 2012, when you needed to use a plugin for domain mapping. With version 5.something of WordPress, and with version 6+, domain mapping is built into the WordPress core.

    If you were using the obsolete plugin for domain mapping, you should document the exact domain names you were mapping to, for each site. Then, network disable it and then delete it.

    In new versions of WordPress, you simply put the domain name you want into My Sites, Network Admin, Sites, then hover over the site you want, click Edit, in the Info tab edit the “Site Address (URL)” field. Use the full URL, including https://

    You still have to set the DNS so the domain name points to your WordPress Multi-Site installation.

    With WordPress version 3+ or 4+ in Multi-Site Mode, and the Domain Mapping Plugin, you can map domain names to any of your blogs. I’ll walk you through the steps to install the plugin (you have to move a few files and edit some configuration settings). Then I’ll show how to specify the mappings you want. (There are several blogs with partial instructions, that didn’t explain the configuration settings and didn’t give examples of how to specify the mappings — but you won’t have to figure it out because I did!)

    (more…)
  • WordPress 3 (or 4) Multi-Site Installation, on Shared Hosting, Even with Existing Web Sites

    WordPress 3 (or 4) Multi-Site Installation, on Shared Hosting, Even with Existing Web Sites

    Here’s how to Install WordPress 3 with the New Multi-Site Capabilities — Even if you Already Have a Website in your Hosting Account. [Updated, works on WordPress 4 through at least WP 4.5)

    WordPress multi-site features let you very easily create blogs (now officially called “sites”).

    You can now have multiple blogs in WordPress with much less administration of WordPress updates, plug-in updates and settings, theme updates, etc. Multiple blogs, for each domain you are hosting, can be managed by a single installation of WordPress. (more…)

  • WordPress 3 Allow Posts in Menu (as well as Pages)

    In WordPress 3.3 (and probably earlier versions) you can make custom menus in your blog.

    Go to Appearance, Menus (/wp-admin/nav-menus.php) and you can add Pages or Custom Links to your menu.

    But how do you put specific Posts on your menu?

    Click on Screen Options (top right corner of the screen), and you’ll see check  boxes for all the types of items you can put in a menu, plus some other information such as the link target and CSS classes.

    You will probably want to change the text that gets displayed in the menu (the default is the post title). Click on the drop-down arrow by each menu item, and you can change the Navigation Label (what shows in the menu) and the Description (displayed in some themes).

  • WordPress: Image Too Big? Resize It

    A client blog site had an image that was too big for the theme, so it stuck out over text.

    You could use a dedicated image editing program to change the size of the image, using algorithms that keep the quality of the image as good as possible. One great program is Irfanview (free, I used it to add the red boxes on the images on this page).

    WordPress however has built-in tools to crop (change what portion of an image gets displayed) or scale (proportionally adjust the display size of the image) . No having to FTP the image to your computer, edit it, upload the changes, and change the size  in your HTML. Here’s how to do it:

    New Image:

    You can resize an image when you add it to your post, just use the settings on the Add an Image screen:

    WordPress Add Image screen
    (This image was too large to fit in the post, at 612 x 512 pixels, so I picked Medium (300 x 166). Click on it to see it full size.)

    In the Size section, pick “Full Size” if the image is below about 500 pixels wide, depending on the Theme you are using. (The size is shown in the bottom right of the section, as Full Size. The image being imported when I grabbed the screen image was 448 wide by 249 tall.)

    Existing Image:

    Click on the Media button. You’ll see the Media Library. Find the image you want to edit.

    Hover over the image, and you’ll see a link to Edit it. Click that link.

    On the Edit Media screen, click the Edit Image button.

    This screen lets you crop the image (only display a portion of it). Drag the mouse over the picture, adjust the edges of the white crop area by dragging the square handles (click the Image Crop “Help” link to see keyboard hints), click the Crop icon (the left-most icon). [Note: Some Themes and some Plug-Ins will interfere with the Crop feature, you may have to disable plug-ins or crop outside of WordPress.]

    Click the Scale button to show the detail fields. You’ll get fields to adjust the size. As you change the width or height the other gets automatically adjusted to keep the proportions correct. Many Themes have room for about 500 pixels wide.

    You will need the new URL for the picture (the old URL will have the original size). This is at the bottom of the Edit Media screen, in File URL.

    After you’ve saved your changes, go back to your post, and put in the URL of the new image. (If you don’t, the post will keep showing the original image…)

     

  • Wildcard DNS on a Shared Hosting Account

    I needed Wildcard DNS for WordPress 3.0, for the new Multi-Site features. I have WP3.0 Multi-Site (Subdomains) working on a shared hosting account (the $4.95/month kind). It might work on a lot of hosts, I’m using LunarPages.

    I set up wildcard DNS from CPanel, simply putting * (asterisk) in the subdomain name, for each domain I want blogs for (mydomain.com, myotherdomain.com, mythirddomain.info, etc). (more…)

  • WordPress stores domain name, here's how to change it

    I had multiple domain names pointing to the same place (www.lernerconsult.com and www.lernerc.com were identical).  Then the DNS for lernerc.com got altered.

    WordPress was translating calls from www.lernerconsult.com/blog/ into www.lernerc.com/blog/ and that didn’t work…

    Here’s how to adjust it:

    You will need to access the MySQL database (I use phpMyAdmin) for the WordPress database (mine is named _wrdp1).

    In phpMyAdmin, in the database used by WordPress, there is a table wp_options.  Click on the table name, click on Browse and update the values for siteurl and mailserver_url. Save your changes.

    That is enough to be able to browse to the WordPress Admin page (http://yourdomain.com/blog/wp-admin/ ) and click on Options and change the Blog address field — the required field for fixing the problem.