Welcome To Advanced Topics in WordPress: Beyond the Bootcamp

Transcription

1 Welcome To : Beyond the Bootcamp To access class slides, go to Advanced-topics-class-documents Password = expert April 2012 Class 2 Presented by: Jonathan W. May

2 Agenda for Class 2 Review of Class 1 Plugins 101 Securing Your Site Page 2

3 Review of Class 1 Course Overview Introductions Housekeeping Items Round Table Discussion Setting Up Your Privately Hosted Site Page 3

4 Plugins, Plugins, Plugins Plugins can extend WordPress to do almost anything you can imagine. - wordpress.org Over 19,000 free plugins available at Many more premium plugins available from various software vendors Install and manage plugins from the Plugins dashboard menu View Active, Inactive and Updates Available Add New plugin Search/browse/install plugins from wordpress.org/extend/plugins, OR... Upload a plugin.zip file download from another site On activation, the plugin may create various new elements, e.g., widgets, dashboard menus, Settings or Tools submenus, new attributes/icons on the page/post editing window Learn how to use the plugin from the notes on wordpress.org and the plugin site, the plugin settings menu (if one exists), and just playing with it Page 4

5 Plugins, Plugins, Plugins Most Downloaded Plugins at WordPress.org 1) Akismet divert potential spam comments (10+ million downloads) 2) Google XML Sitemaps enable search engines to quickly recognize changes to the site 3) Contact Form 7 create custom forms 4) Jetpack by WordPress.com a dozen miscellaneous useful features, e.g., custom contact forms, subscriptions, site statistics, spelling & grammar checking, sharing to social network sites 5) All-in-One SEO Pack improve site visibiilty in search engine results. (Will discuss in future class.) 6) WordPress Importer import content from a WP export file Page 5

6 Plugins, Plugins, Plugins Other Recommended Plugins: Content Creation and Rendering Ultimate TinyMCE enhance WP Visual Editor's capabilities Easy Columns create columns within an article Special Text Boxes display content within colored boxes NextGEN Gallery and SmoothGallery display photo galleries in articles Featured Item Slider display featured posts/pages in a slideshow Polldaddy Polls & Ratings similar to Polls and Ratings features in WordPress.com WordPress PayPal Donation display a PayPal donation button Really Simple Captcha captcha feature designed for Contact Form 7 Mingle Forum members-only discussion forum Theme My Login render the login page in the active theme WP-Print display a printer-friendly version of an article Subscribe2 enable subscription to notifications of new posts Widget Logic (not Widget Context) selectively show widgets on certain pages Page 6

7 Plugins, Plugins, Plugins Other Recommended Plugins: Site Administration W3 Total Cache maximize site performance (Will discuss in future class.) Ultimate Google Analytics enable Google Analytics for all articles (Will discuss in future class.) Postie enhanced post-by- capability Online Backup for Wordpress create site backups WP-DBManager perform a variety of database maintenance tasks WP-Members Restrict selected articles to logged in users Maintenance Mode Make the site inaccessible to anyone other than the administrator Page 7

8 Securing Your Site Site security is a boring but essential topic! WordPress sites, like any other software, are vulnerable to hijacking. But if you take some simple measures, you can minimize the vulnerabilities, and most hijackers will move on to other, more vulnerable sites. Q: Would you leave your uninsured car intimes Square with the door open and the engine running? A: Probably not, unless you are hoping someone will hijack it. Q: If you turned the car off, removed the keys and locked the doors, could your car still be hijacked? A: Yes, but much less likely than if you didn't! And buy some theft insurance (i.e., site backups). It's cheap! Page 8

9 Securing Your Site Top 9 Commandments Thou shalt: #1: Cast out thine admin account #2: Backup thy file system and database #3: Keep thy software updated #4: Secure thy surrounding ecosystem #5: Use trusted sources #6: Test in a separate test environment #7: Minimize loopholes and peepholes #8: Keep thy site lean and mean #9: Be vigilant If you do NOTHING ELSE this week, do these! (At least you will have removed the keys from the ignition and bought some insurance.) Page 9

10 Securing Your Site Commandment #1 Eliminate the Admin Account You make life too easy for a hacker if you have a WP administrator account named admin. All they need to do is repeatedly guess at the password. So... Don't create an account with the name admin in the first place when you install WordPress OR If you already do have an admin account, create another account with administrator privileges, then delete the admin account. During the account deletion process, request that all content owned by the admin account be transferred the new account Page 10

11 Securing Your Site Commandment #2 Take Backups Here's your theft insurance : recent, concurrent backups of both the WP file system and the MySQL database. Take backups regularly, and prior to any major upgrade. The more often you update your site, the more often you should take backups Keep copies of the backups in at least two places (e.g., on Web server, on your laptop/desktop, on an external drive, on a cloud drive, like Dropbox or Google Cloud Servics) Keep the last three revisions, just in case the most recent one is corrupted Page 11

12 Securing Your Site Commandment #2 Take Backups There are many right ways to take backups. Pick one and do it consistently. Manual method using the Control Panel (varies by hosting vendor) Method 1 (see examples in the next two slides) Use the File Manager to create and download a compressed file of the entire file system. Use phpmyadmin to export the database. Method 2: Use the hosting vendor's proprietary backup tools, e.g., Backup Wizard Free plugins See Try Online Backup for WordPress Premium plugins Backup Buddy from ithemes/plugin Buddy (the gold standard ), or Vaultpress from Automattic (software is included in Jetpack) plugin) Page 12

13 Securing Your Site Commandment #2 Take Backups Manual Backups Using cpanel 1) Backup the WordPress files 1. From File Manager, navigate to the WordPress root directory (normally, in the public_html folder) 2. Select and compress all files/folders 3. Copy.zip file to local hard drive 4. Delete.zip file from server 2) Backup the MySQL database 1. From phpmyadmin, select the database and all tables 2. Export the tables in SQL format and save to local hard drive Page 13

14 Securing Your Site Commandment #2 Take Backups Restoring from a Manual Backup Using cpanel 1. Restore the WordPress files 1. From File Manager, navigate to WordPress root directory 2. Select and delete all files/folders 3. Upload backup.zip file from local hard drive 4. Select all files and move them up one level to the WordPress root directory 2. Restore the MySQL database 1. From phpmyadmin, select the database and all tables 2. Drop (delete) all the tables 3. Import the datbase backup file from the local hard drive Page 14

15 Securing Your Site Commandment #3 Keep Software Updated Why update your software? New features Bug fixes MOST IMPORTANT: Security patches What to update? Themes Plugins WordPress core software When will you know an update is available? WordPress will tell you: Dashboard => Updates Page 15

16 Securing Your Site Commandment #3 Keep Software Updated When should you perform an update? Generally speaking, as soon as update is available However, updates can occasionally introduce new bugs, unexpected changes to feature, or incompatibilities with the other software. Proceed with caution. Recommendations Research theme and core softare updates before you install them Determine if a theme or core software update is major or minor Minor update example: v3.3.1 to v3.3.2 Major update example: v3.3 to 3.4 If a major update, check out the buzz by looking at the theme site or Facebook page, run Google searches, etc. For major updates to WP core software, wait to update at least three or four weeks until the release settles down. Page 16

17 Securing Your Site Commandment #3 Keep Software Updated How to perform an update Minor updates: Just do it! Major updates: 0)Before you start: Take a complete backup! 1)Perform any minor outstanding updates to themes/plugins 2)Deativate any non-essential plugins 3)Perform the update 4)Test the site to see if any problems 5)One at a time, re-activate each non-essential plugin that you deactivated, testing after activating each one. Repeat until all required plugins are active again. 6)Open a new browser session using incognito mode (e.g.,use Google Chrome, click on the wrench icon and select New Incognito Window ). Attempt to login to the site. If successful logging in, you are done! Page 17

18 Securing Your Site Commandment #3 Keep Software Updated If there is a problem with your update, normally the theme or one of the plugins is the culprit. Is it your theme? Go to theme's support site, contact the developer directly, or use Google to see if others are having similar issues and, if so, what they are doing about them? Is it one of your plugins? Try to isolate the problem by deactivating all your plugins, then reactivating them one by one, checking to make sure the site is working before activating the next. If the site breaks after activating a plugin, either deactivate the plugin and do without it, or replace it with a similar plugin. At last resort...if you can't isolate and resolve the problem quickly, restore the site from your last backup. Use your test environment (see Commandment #6) to conduct further research and testing. Page 18

19 Securing Your Site Commandment #4 Secure the Ecosystem Every WordPress site is a component in an entire software ecosystem. Any point of failure in the system could affect the integrity of the site. Secure Server Use a trusted Web hosting vendor Secure Network Connection Use Secure HTTP (https) for any application where data transfer should be private, especially when you're on a public network Use Secure FTP (sftp) to upload/download files between your local system and your site Secure Client (the laptop/desktop/mobile device you use to administer the site) Too much to talk about here beyond the scope of this course. Page 19

20 Securing Your Site Commandment #5 Use Trusted Sources for Software Research themes and plugins before deploying them. Look at the Changelog to see what has changed, how regularly the developer is updating the thing. Best source for free themes: wordpress.org/extend/themes Other trusted soruces for free themes: woothemes.com/themes/free themeshaper.com graphpaperpress.com/themes Generally speaking, do not download free themes found at other sites using a search engine Trusted sources for free plugins: Examine user ratings, It Works/It's Broken votes, quality of documentation, availability of and activity on support forum Page 20

21 Securing Your Site Commandment #6 Test in a Separate Test Environment As with any software, it's always best to introduce major changes and research problems in a controlled, non-production environment. Option #1: Install a second instance of WP on your Web hosting vendor's server Advantages: Easy to do just install WP in a subdirectory. Server-side infrastructure is exactly the same as production. Disadvantage: Clutters up your server environment. Option #2: Install a locally hosted WP instance on your desktop/laptop Advantages: No unwanted clutter on the server. You don't need Internet access to run the site. Disadvantages: A little more technically challenging need to download and install the software stack, per the AMPPS Installation Instructions document. Will not be able to test certain features locally, e.g., anything dependent on a mailserver process. Page 21

22 Securing Your Site Commandment #7 Minimize Loopholes and Peepholes Restrict # of failed login attempts, e.g, using the Login Lockdown plugin Change the default database prefix from wp_ to something unique, e.g., using the Better WP Security plugin. (NOTE: Be sure to take a DB backup beforehand!) NOTE: The Better WP Security plugin also recommends and addresses several other vulnerabilities, including automated backups Don't use the one-step automated installation of WP (e.g., using Fantastico), which leaves clues about your site that hackers can use to their advantage. Move/modify the wp-config.php file Move this file one level up in the directory structure on the server Enforce SSL (https) access on login and on all admin pages See: Insert Secret Keys How to: Key generator: Page 22

23 Securing Your Site Commandment #7 Minimize Loopholes and Peepholes Example Warning Messages from Better WP Security Plugin Page 23

24 Securing Your Site Commandment #8 Maintain a Lean and Mean Site Delete unused themes and plugins Limit the number of post revisions stored by WP Use a plugin (e.g., Better Delete Revision) to clean up, OR Avoid the mess entirely: Page 24

25 Securing Your Site Commandment #9 Be Vigilant Pay attention. Monitor your own site, inside and out. If something looks off, check it out. Periodically scan the site for: Malware (e.g., using or Outdated versions of the TimThumb image thumbnail creation library using the TimThumb Vulnerability Scanner plugin Scan for and fix/remove broken links, e.g., using the Broken Link Checker plugin,or external tool (This isn't a security issue so much as a generally good maintenace practice.) Page 25

26 Securing Your Site For further reading: Page 26