An online buddy of mine, Keith Davis, asked me a great question in regards to WordPress 3.0 security. He asked:

Hi John

I notice that WordPress 3.0 has now been released and we are all urged to upgrade.
I would have to make changes to my theme to make it compatible with WP 3.0 and since I’m not looking for additional functionality, the only reason I would upgrade is for added security.

The only reference I can find to increased security in version 3 is the ability to change the default username from admin – but most of us will have done that anyway as per your advice.

Would you say that an upgrade to version 3 is essential on security grounds?

Great question… and here’s my response.

It seems the security enhancements in WordPress 3.0 really only apply to those end-users who are installing WordPress for the first time (manual install).

For better WordPress security and help keep malicious hackers locked out, it’s a good idea to do the following three things:

• Choose a different username than the default “admin”
• Change the default database table prefix to something other than wp_
• Add WordPress security keys

As Keith mentioned, I’ve shown him (and others) how to do those things in my ebook, WordPress Defender. WordPress 3.0 just makes it easier for you to do those things all during the setup process; in fact, the security keys are created automatically for you (see the video below).

So Keith, to answer your question about upgrading, no it’s not necessary in my opinion to upgrade right away; however, realize that although WordPress says they aren’t planning on a 3.1 right away, you never know. Tomorrow we might all discover one major security hole and every one must upgrade immediately.

If I were you or someone else in your position, I’d start planning how I’m going to upgrade real soon. You might contact your theme’s author and see what their plans are.

How To Install WordPress 3.0 Manually

Don’t forget, before you do a WordPress upgrade, it’s important to first fully back up your blog.

Related posts:

1. WordPress 2.8.2 Has Been Released & Provides Security Fixes
2. How To Upgrade WordPress Manually Video
3. How To Install WordPress Manually and Why Beginners Should Do It

But that’s a good thing, right?

However, something (or some group, rather) has pulled me out of my blogging break early and these A-holes have really pissed me off!

It seems there’s been a lot of talk around blogosphere about WordPress blogs getting hacked lately… and it’s been even more than the usual. Whoever is doing this doesn’t seem to be targeting your site specifically, but rather the web hosting companies, and their hacks infect all files on your hosting account ending in the .php extension.

Most of you know I’ve recently written a WordPress security ebook, called WordPress Defender: 30 Ways to Secure Your Blog from Attack Anyone Can Do, and packed it with a ton of things you can do today to better secure your blog from WordPress crackers.

Unfortunately, there’s one problem here.

Lately these assholes have been targeting the web hosting server itself and since you personally don’t have access to that level of your website’s security, it’s kind of out of your hands to thwart your site from being infected.

There’s been a lot of talk lately about Go Daddy being hacked and how they have been denying the problem resides on their side, but to be honest I’m not so sure; in fact, it’s not just Go Daddy lately, it’s also been hosting companies like DreamHost and Network Solutions that *seem* to be getting hit.

What These Hacks Might Look Like

Fortunately, the hacks are easy to spot.

Just log into your web hosting’s File Manager and open any file ending in .php. If the file is infected, you should see code at the very top looking similar to this:

<?php /**/ eval(base64_decode("aWYoZnVuY3Rpb25fZXhpc3R

Those dirty little rats!

What You Need to Do Today

• Make sure WordPress is upgraded
• Make sure your plugins are upgraded
• Back up your database and set up an automated backup process for it
• Back up all the files contained in your web hosting’s File Manager
• Implement the security upgrades I talk about in WordPress Defender

The Good News For WordPress Defender Users

Even though there is little you can do to stop these hacks from happening, all is not lost as long as you follow some of the advice I give you in the WordPress Defender book.

The key to being able to recover from such vicious hacks is being:

• Aware of the problem
• Notified asap that your security has been compromised
• Prepared for a quick recovery

I think I do a pretty good job at showing you how to do these things in the ebook.

If you find that your blog has been infected with a virus or some other malicious code, the quick fix checklist is to:

• Put your blog / website into Maintenance Mode (click here to see how to do that without a plugin)
• Restore a clean backup of your database (see how to do that here)
• Restore a clean backup of all your web hosting files and folders (you have a recent backup, right? Click here to see more on that)
• Change your WordPress, FTP, and web hosting passwords

WordPress security is not an exact science.

Protect yourself the best you can and be prepared for the times you can’t.

It’s not difficult to implement, but at times it seems difficult for me to get through to those of you who are easy targets.

WordPress Defender Review

Not sure what this WordPress Defender ebook is all about?

Clive McGonigal of Blog Briefing has done up a wonderful review of my book. The video below will show parts of my ebook as well as a little of what you get in the video tutorials. Be sure to view the video in full window view.

If you find the video helpful and want to purchase the ebook, please use Clive’s affiliate link to purchase the ebook by clicking here.

Shoot them my way by commenting below.

Related posts:

1. WordPress Defender: 30 Ways to Secure Your Blog from Attack Anyone Can Do
2. How To Fully Backup WordPress Anytime With Just A Few Clicks

That hacker set me out on a mission.

Over the last couple of years I’ve soaked up everything I could about WordPress security. I learned many of the tricks those malicious jerks use to hack blogs, I watched as plugin developers developed plugins to fight back, I engaged the WordPress forums and other users in conversations about the topic.

All this time, experience, and knowledge I’ve gained over those last couple of years have culminated into one single resource I’ve been working on.

It’s called WordPress Defender, and it’s mission is to help you to never wake up one morning with the same kind of broken heart my wife had.

It’s a 150 page guide jam packed with things you can do today to start protecting your WordPress blog from malicious attacks. And if you’re worried it might be over your head, don’t. I’ve taken special care to make sure any and everyone can follow it.

You even get over 1.5 hours of video (14 videos in all) where you can watch me in real time set up many of these security features.

3 Day Special Offer

Don’t wait too long, because for 3 days only (March 1st – 3rd 2010) you can get it all for nearly 50% off ($19.99). After that, the price will go up.

Now let me ask you, is your blog worth $20? Is it worth skipping that night at the movies to ensure your blog is protected?

And if you’re the affiliate type… it also comes with an affiliate program which pays out 40%.

So take the time, go check it out and let me know what you think.

And if you ever have a question about anything contained inside the book, you know where to find me.

Related posts:

1. Something New to Blogosphere is Coming, Thanks to a Broken Heart
2. 2 Easy Ways To Set Up A WordPress Firewall
3. So You Think Your Website is Secure? Am I Scaring You Yet? I Hope So…

Sometimes as bloggers and website owners there comes a need to temporarily redirect all our site visitors to a temporary maintenance page. If you’re a WordPress blogger, there is a maintenance page plugin you can use to accomplish this; however, that plugin is limited, crutched by the fact that you actually have to have your WordPress site in good working order.

But what happens if you one day find your site was hacked and some malicious asshole posts a bunch of spam or porn links on your site and your WordPress Dashboard isn’t working as it should? What if you had no access to your WordPress admin area at all?

What then?

A plugin won’t help.

So if you ever come to a point where you need to redirect everyone but yourself to a temp maintenance page, here’s how you do it through your web hosting control panel (apart from WordPress).

How To Create A Maintenance Page Redirect

Step 1

Create a simple html file and place it in your blog’s root directory. Name it something like, maintenance.html. Inside the maintenance.html file you can put anything you want. “Hi. I’m out to lunch for a few moments while the construction crew is busy at work . . .”

But why stop there? Your site is better than that. Customize the page with your site’s colors and images. Maybe add a video or your latest blog post. CSSgirl wrote some tips and shows some examples on the topic of creating a memorable maintenance page.

Step 2

Ok so now you have your maintenance.html page set up, the next step is to redirect everyone to it while you’re doing whatever it is you need to do.

Navigate to your blog’s root directory in your web hosting control panel and open your .htaccess file.

Once opened, you’re going to add this code at the top:

# Use this code to redirect visitors to maintenance.html file while upgrading
Options +FollowSymlinks
RewriteEngine on
RewriteCond %{REMOTE_ADDR} !^618\.124\.259\.25
RewriteCond %{REQUEST_URI} !/maintenance.html$
RewriteRule $ http://your-site.com/maintenance.html [R=302,L]

The yellow parts above are the areas you need to change. Visit What is my IP address? to find your IP address and put those numbers in under the first yellow highlight. Next add the url path to your own maintenance page in the second yellow part.

And that should do it. Your site should now show a maintenance page to everyone except you (your IP address was whitelisted). To see what everyone else sees, add a # sign in front of the IP line:

# RewriteCond %{REMOTE_ADDR} !^618\.124\.259\.25

The # comments lines out.

When you’re finished, leave the code in your .htaccess file for next time. To disable the code, just add a # in front of each line:

# Use this code to redirect visitors to maintenance.html file while upgrading
# Options +FollowSymlinks
# RewriteEngine on
# RewriteCond %{REMOTE_ADDR} !^618\.124\.259\.25
# RewriteCond %{REQUEST_URI} !/maintenance.html$
# RewriteRule $ http://your-site.com/maintenance.html [R=302,L]

Remember, if you need help with upgrades or WordPress security, visit the blog services page and use the contact form there to get in touch with me.

Like tutorials like these? Keep up with what we’re doing over here by subscribing to our feed.

Related posts:

1. WordPress Management: Cleaning Up Your Root Folder
2. How To Upgrade WordPress Manually Video
3. How To Install Google Analytics On A WordPress Blog Without Using A Plugin

I know, it sucks.

There are a ton of people out there with nothing better to do with their time than snoop around on the Internet watching for people who send login information, such as Usernames and Passwords, unsecured through the webs of the Internet.

Then when they capture someone’s login credentials, they take it upon themselves to easily log into the person’s account and fill it up with spam links and viruses.

Like I said, it sucks.

Unfortunately, it’s true and unless you take steps to protect what you’ve spend so many hours away from your family building, someone some day may take great pleasure in destroying. Even worse, they don’t even care that your website is what helps put food in your children’s mouths or collect donations to help fight cancer.

The worst part is many times they don’t even know who you are.

They use automated scripts/bots/spiders or whatever your choice term is for automated programs designed to sniff you, the unprotected WordPress users, out.

Where They Find Your Username & Password

As a web host, we have to deal with protecting customer Usernames and Passwords when they connect to their web hosting control panel, but when it comes to 3rd party programs like WordPress, it is up to the user to secure their program.

But that’s why I’m here, right?

When it comes to WordPress, there are 3 primary ways your Username and Password will be sent to your web hosting server unprotected:

1. When logging into WordPress
2. When changing passwords and/or adding new users to WordPress
3. Through your FTP connection (independent of WordPress)

In this article, we’ll discuss how to protect your Username and Password through SSL when logging into WordPress and doing things like adding new WordPress users and changing passwords.

In a follow-up article, we’ll discuss our FTP problem.

Encrypting Your WordPress Session

I know, no body wants to spend more money on something that doesn’t immediately get them a return on their investment.

But what does a business owner of a brick and mortar store think when she purchases a security system for their shop? That’s how you should think about your WordPress blog’s security.

The best way to encrypt your WordPress session is through SSL.

SSL stands for Secure Sockets Layer and basically what it does is allow for transfers of information over the Internet, such as your Username and Password, to be done in an encrypted manner.

You can buy one from our company by visiting our SSL Certificate page.

If you’ve ever purchased something online where you had to enter in a credit card number, chances are the web page you were on was encrypted with SSL. You can easily spot if this is so by looking up into the address bar and seeing if the web address starts with https:// as opposed to the standard http://.

The https:// means that when you fill in your name, address, credit card information, etc., it’ll all be transmitted over the Internet encrypted.

We can use this same method e-commerce sites use to encrypt our credit card information to encrypt our WordPress login information.

Setting Up SSL

To set up WordPress to work under SSL, you’ll need the following:

1. Your own domain name
2. Web hosting with WordPress installed
3. A dedicated IP address for your web hosting (purchased through your web hosting provider)
4. An SSL Certificate ($30/yr. if purchased from us)

Assuming you have your own domain name and WordPress blog already set up, the next thing you’ll need to do from the list above is purchase a dedicated IP address for your web hosting. To do that, you’ll need to contact your web hosting provider or visit their products page and purchase one.

Setting this up is easy. For the most part all you need to do is purchase it and tell it which domain name you want it applied to.

Once that is done, you’ll need to purchase an SSL Certificate. Some web hosts sell them while others do not. You can also find other companies that sell them, such as VeriSign; but in my experience, those companies are usually more expensive. Notice how they don’t even advertise the price on their landing page, you have to contact them for a quote.

How to install an SSL Certificate on your web hosting server is beyond what I want to get into in this article, but after you purchase one what happens is you will download the certificate and need to upload and install it on your web hosting account.

The process typically isn’t fun for those of you who think SSL was some kind of Saturday Night Live skit, but your web hosting company should help you get it installed. If not, tell them “Hey . . . thanks, buddy!”

The good news for WP Blog Host hosting customers is that we make this process very easy for you!

What else would you expect from a company whose target customers are newbie bloggers?

If you are a hosting customer of WP Blog Host, we will include free with your SSL Certificate (when purchased from us) a dedicated IP address and best of all, we’ll even install everything for you so your website is SSL ready.

All you’d need to do is wait for an email informing you everything is set up.

From that point, once you have managed to get your website SSL ready, you can move on to the next step and actually apply it to your WordPress admin area.

Setting Up WordPress To Use SSL

Now that you got SSL set up to work on your website (i.e. https:// is available), you can move on to the simple step of telling WordPress it can use SSL to log you into WordPress securely and encrypt the stuff you do from within your Dashboard (write posts, create users, change passwords, etc.).

Log into your web hosting control panel and head over to your File Manager.

From there, locate your wp-config.php file and open it up using your control panel’s file editor.

Once opened, paste this code anywhere inside it:

/* Force Login and Admin SSL */
define(‘FORCE_SSL_LOGIN’, true);
define(‘FORCE_SSL_ADMIN’, true);

Source: WordPress.org SSL

I know adding security to your blog is not fun, but it really is a necessity.

I think $29.99 a year for an SSL Certificate is money well spent. I know it might suck getting it set up (unless you’re a hosting customer of WP Blog Host), but once it’s done, it’s done – and you’ll be logging into your blog over an encrypted channel from now on.

You can see that I’m using SSL for this blog, just go up to the address bar and add a “s” to the http (i.e. https://wpbloghost.com/blog).

I don’t run my frontend encrypted because many of the images I have linked to are not https and would cause Internet Explorer to pop up a warning box to users which I feel might scare some of them away. It just tells them there are some items which are secure and some which aren’t (like pictures).

Questions:

Do you think your blog’s security is worth $30 a year?

How many of your are convinced this is something you really should do but in reality you probably will never get around to it?

UPDATE: I forgot to mention WP Blog Host is running a few promotional codes you can use when purchasing products. If you purchase an SSL Certificate, you can save 5% or more by using the promo codes below. Codes are good through Thanksgiving.

Promo Code Description Start Date End Date 100CN15 15% discount off any order $100 or more 11/2/2009 11/27/2009 50CN10 10% discount off any order $50 or more 11/2/2009 11/27/2009 5NC25 5% discounts on orders $25 and over 11/2/2009 11/27/2009 Visit our Product Catalog to view all our hosting and domain products.

Related posts:

1. WP Blog Host Domain, Blog Security, & Hosting Promotions – Get'em While Their Hot
2. 2 Killer WordPress Security Plugins You Probably Don’t Know About
3. WordPress 3.0: Security Upgrades Overview & How To Install It

People’s blogs get hacked on a daily basis. A simple Google search for my blog was hacked returns 2,620,000 results.

I tend to think of blog security like the progression of driving a car through the years.

At 16 when you’re new to driving a car, you know driving a car safely is good, but you don’t do it. Instead, teens tend to drive more carelessly than older more seasoned drivers. However, the one time one of these teens get in a serious car accident, all of a sudden a light bulb turns on and they realize just how dangerous it is to drive carelessly.

The problem is, the process keeps washing its hands and repeating itself. As that teen ages, new teens begin driving and take to the roads, and can you guess how they drive?

The same holds for blogging. When newbies begin blogging either they don’t know the statistics of blog security or they don’t think it’ll ever happen to them. Then one day if they do get hacked, all of a sudden blog security becomes an issue. If, however, they are lucky enough to not get hacked early on (i.e. as they age), they begin to realize blog security is becoming more and more important since they have a lot more to lose (posts, comments, design, etc.).

2 WordPress Security Plugins You Should Consider

1. Chap Secure Login

In order to log into WordPress, you need to enter in a username and password. The problem is, unless you log in through a SSL connection (tutorial post coming soon), this information is sent through the Internet unprotected and can be seen by snooping eyes.

That’s where the Chap Secure Login plugin comes in.

Chap stands for Challenge Handshake Authentication Protocol and what it does is encrypt your password through the use of the MD5 hashing algorithm in JavaScript so that it is sent to your web host in a secured manner.

Whenever possible, I suggest logging into your WordPress blog through SSL, but if that’s not an option for you, I highly suggest using this plugin; and the best part is, there’s no configuring, just upload and install the plugin and you’re all set.

2. WordPress File Monitor

Securing WordPress is great, but as I’ve mentioned before it’s impossible to completely secure WordPress 100%. Just as important as securing your WordPress from being hacked in the first place is knowing when your blog has been hacked.

Matt Walters developed an excellent file monitoring plugin, called WordPress File Monitor, which will monitor all your files for any alterations made to them.

Many times WordPress crackers will attempt to insert vicious viruses or spam links directly into your WordPress files. These viruses can be designed to do just about anything they want, including downloading viruses to your website’s visitor’s computers.

The WordPress File Monitor plugin monitors each of your files for changes that occur inside them. So, say for example, someone uploads malicious code to your footer.php file, the WordPress File Monitor plugin would capture that change and email you that a change has occurred. There’s also notification in your Dashboard.

Once notified, you can head over to that file and check for anything suspicious.

As a bonus, this plugin can also be configured to monitor and report changes to files outside of your WordPress directory. This is a huge bonus for those of you who run a static HTML website for your home page and have WordPress installed in a separate directory, like /blog.

Here’s a couple screen shots from this plugin:

Have you thought about blog security lately?

How would you feel if one day you found your blog has been cracked into?

Would you be prepared to deal with the problem and make your blog right?

If you’re interested in keeping up to date with the latest in blog security, WordPress, and my own personal blogging tips, you can subscribe to my RSS feed here. Also, if you’re interested in locking down your WordPress blog and add some security features to it, I can do that for you.

Related posts:

1. 50+ WordPress Plugins & Hacks Candy Store
2. WordPress Security: The First Thing You Should Understand
3. Increase Your WordPress Blog’s Security By Running It Through SSL

It’s my pleasure to introduce our new tutorials Web television channel, WP Blog Host.tv.

As many of you know, I’ve been spending lots of time creating easy to follow WordPress and WP Blog Host product video tutorials for bloggers and customers who host with WP Blog Host. The tutorials can be for anyone blogging and using WordPress, but bloggers who host with our company get the extra advantage of watching how to do everything using our hosting (click-by-click).

Here’s a snapshot of our new television channel:

Ok I know, a nice slick video slider would be nice on the home page. I spent days toying with lots of WordPress video themes and you know, none really clicked with me. Most of those themes are all very dark and hard to read. Some come with various color choices and I did experiment with color changes, but in the end a simple blog style theme worked best for me.

Down the road when I start doing “in the news” related videos, I’ll probably shell out the big bucks and really build a nice customized site.

I do have to give one mention, though, to a guy named Vishal from Fresh Lime Sode. They have a number of WordPress themes and this one in particular I really liked and tried. The best thing about him is when I ran into a few issues, Vishal was quick to reply to my emails and even did a little customization for me.

If you’re looking for nice WordPress Themes and want to know there will be someone available to help you with your support needs, I highly suggest checking out Fresh Lime Sode.

Subscribing To The Videos & Scheduling

The new site, http://wpbloghost.tv (opens in a new tab), has its own RSS subscription so you can keep up to date and notified when new videos are uploaded.

Because this is my project and it is relatively new, there is no set posting schedule at this time; however, that may change in the coming months. I do have a nice running to-do list and will add videos regularly, though.

WpBlogHost -> WP Blog Host

Converting our old tutorials page into its own tutorials Web channel is only the first step in some exciting changes coming to WP Blog Host.

Ah yes, did you catch that? I used WP Blog Host, not WpBlogHost. After months of watching how others reprint our name, WpBlogHost felt it best to go with what everyone usually remembers, WP Blog Host. Why not, right? That change will come to the main site real soon.

Also, released shortly will be a new design of our main site and my blog. I’m really excited about the redesign of my blog because it will be more representative of me, John Hoff the blogger, rather than our “corporation’s blog”.

Feedback

Back to the topic at hand, if you have a few moments, I’d love to hear a little feedback on the new site, WP Blog Host.tv and I hope you find the tutorials useful.

Related posts:

1. My 3-Year Old Son’s First Video Blog Article!
2. How To Upgrade WordPress Manually Video
3. Fatten Up Your Wallet by Using Online Videos

Ketchup might splatter on my keyboard and at times there might be a Thomas The Tank Engine sitting on my desk, but if there’s one thing I know I can keep organized, it’s my WordPress hosting files. When I log into my hosting account, everything is tucked away nicely and files are easy to find.

When you install WordPress, by default it places all its core files in the same directory of your WordPress installation. So for example, if you placed your blog in your root directory (i.e. www.myblog.com), then your web hosting root folder will include all the WordPress system files.

Below and on the left is an example what a typical WordPress directory looks like. Pretty cluttered up with a lot of stuff you don’t need to know about, huh? On the right is an example of what you can do by moving all those core files and folders out of your root directory and into a subdirectory (in the example below, the subdirectory is /root-blog.

So how do you do that?

Well you’re in luck, because have I got a video for you.

As I mentioned in the video, it might be wise to create yourself a maintenance page where you can send your visitors to while you’re moving your files around. The move shouldn’t take long, but just in case you missed how to redirect your visitors to a maintenance page while your site is down, here’s how I showed you how to do it in my post, How To Install WordPress Manually.

How To Create A Simple Maintenance Page

You could always download a WordPress maintenance mode plugin, but in this case it probably won’t work. During the move process you’ll be moving your /wp-content folder, which contains all your plugins. This will cause your site to not load; therefore, it’s best to have your own maintenance page independent of WordPress.

So, here’s how to create a custom maintenance page without a plugin.

Step 1

Create a simple html file and place it in your blog’s root directory. Name it something like, maintenance.html. Inside the maintenance.html file you can put anything you want. “Hi. I’m out to lunch for a few moments while the construction crew is busy at work . . .”

But why stop there? Your site is better than that. Customize the page with your site’s colors and images. Maybe add a video or your latest blog post. CSSgirl wrote some tips and shows some examples on the topic of creating a memorable maintenance page.

Step 2

Ok so now you have your maintenance.html page set up; the next step is to redirect everyone to it while you’re doing your upgrade.

Navigate to your blog’s root directory in your web hosting control panel and open your .htaccess file.

Once opened, you’re going to add this code at the top:

# Use this code to redirect visitors to maintenance.html file while upgrading
Options +FollowSymlinks
RewriteEngine on
RewriteCond %{REMOTE_ADDR} !^618\.124\.259\.25
RewriteCond %{REQUEST_URI} !/maintenance.html$
RewriteRule $ http://your-site.com/maintenance.html [R=302,L]

The yellow parts above are the areas you need to change. Visit What is my IP address? to find your IP address and put those numbers in under the first yellow highlight. Next add the url path to your own maintenance page in the second yellow part.

And that should do it. Your site should now show a maintenance page to everyone except you (your IP address was whitelisted). To see what everyone else sees, add a # sign in front of the IP line:

# RewriteCond %{REMOTE_ADDR} !^618\.124\.259\.25

The # comments lines out.

When you’re finished, leave the code in your .htaccess file for next time. To disable the code, just add a # in front of each line:

# Use this code to redirect visitors to maintenance.html file while upgrading
# Options +FollowSymlinks
# RewriteEngine on
# RewriteCond %{REMOTE_ADDR} !^618\.124\.259\.25
# RewriteCond %{REQUEST_URI} !/maintenance.html$
# RewriteRule $ http://your-site.com/maintenance.html [R=302,L]

Remember, if you need help with upgrades or moving your files around like in this tutorial, visit the blog services page and use the contact form there to get in touch with me. This is a service I can provide.

Questions?

Fire away.

Related posts:

1. How To Create A Maintenance Page Redirect When WordPress Is Down
2. How To Upgrade WordPress Manually Video
3. Should I Install My Blog In Root, a Subdirectory, or Subdomain?

Taken from WordPress.org:

WordPress 2.8.2 fixes an XSS vulnerability. Comment author URLs were not fully sanitized when displayed in the admin. This could be exploited to redirect you away from the admin to another site.

You can download the latest version of WordPress here.

If you don’t know how to upgrade, WP Blog Host has the following video tutorials. I also provide this service for $50, by the way.

How To Upgrade WordPress Using The Automatic Upgrade

How To Upgrade WordPress Manually

Related posts:

1. WordPress 3.0: Security Upgrades Overview & How To Install It
2. How To Upgrade WordPress Manually Video
3. WordPress Management: Cleaning Up Your Root Folder

If you’re having problems with the auto upgrade feature, make sure to deactivate all your plugins first.

If you’re still having issues, try switching your theme over to the default theme WordPress comes with. Doing these two things reverts WordPress back to its default state and will give your auto upgrade the best chance for compatibility.

If, however, after doing those two things your auto upgrade feature still won’t work, all is not lost. Here’s a video I did on how to manually upgrade WordPress. Because this process will take a few extra minutes longer than the auto upgrade feature, you may want to put your site in maintenance mode to let your customers know you’ll be right back. I show you how to do that in the video and the code needed is shown for your convenience below the video.

If you ever have any issues installing or upgrading, keep in mind I can do this for you. It costs $50 and you also get a full backup of your site.

Update: Keith Davis commented below and mentioned he had an issue watching the video. If you run into any issues, I also have the tutorial on my YouTube channel. Unfortunately, since YouTube only allows 10 minute videos, I had to separate the tutorial into 4 separate videos. The size is a little smaller, but if you enlarge it to full screen it shows pretty well. Here they are:

1. YouTube version video 1
2. YouTube version video 2
3. YouTube version video 3
4. YouTube version video 4

How To Create A Simple Maintenance Page

You could always download a WordPress maintenance mode plugin, but in this case it probably won’t work. When you follow the upgrade instructions on WordPress.org, you’ll notice it says to deactivate all your plugins.

So, here’s how to create a custom maintenance page without a plugin.

Step 1

Create a simple html file and place it in your blog’s root directory. Name it something like, maintenance.html. Inside the maintenance.html file you can put anything you want. “Hi. I’m out to lunch for a few moments while the construction crew is busy at work . . .”

But why stop there? Your site is better than that. Customize the page with your site’s colors and images. Maybe add a video or your latest blog post. CSSgirl wrote some tips and shows some examples on the topic of creating a memorable maintenance page.

Step 2

Ok so now you have your maintenance.html page set up, the next step is to redirect everyone to it while you’re doing your upgrade.

Navigate to your blog’s root directory in your web hosting control panel and open your .htaccess file.

Once opened, you’re going to add this code at the top:

# Use this code to redirect visitors to maintenance.html file while upgrading
Options +FollowSymlinks
RewriteEngine on
RewriteCond %{REMOTE_ADDR} !^618\.124\.259\.25
RewriteCond %{REQUEST_URI} !/maintenance.html$
RewriteRule $ http://your-site.com/maintenance.html [R=302,L]

The yellow parts above are the areas you need to change. Visit What is my IP address? to find your IP address and put those numbers in under the first yellow highlight. Next add the url path to your own maintenance page in the second yellow part.

And that should do it. Your site should now show a maintenance page to everyone except you (your IP address was whitelisted). To see what everyone else sees, add a # sign in front of the IP line:

# RewriteCond %{REMOTE_ADDR} !^618\.124\.259\.25

The # comments lines out.

When you’re finished, leave the code in your .htaccess file for next time. To disable the code, just add a # in front of each line:

# Use this code to redirect visitors to maintenance.html file while upgrading
# Options +FollowSymlinks
# RewriteEngine on
# RewriteCond %{REMOTE_ADDR} !^618\.124\.259\.25
# RewriteCond %{REQUEST_URI} !/maintenance.html$
# RewriteRule $ http://your-site.com/maintenance.html [R=302,L]

Remember, if you need help with upgrades or WordPress security, visit the blog services page and use the contact form there to get in touch with me.

Like tutorials like these? Keep up with what we’re doing over here by subscribing to our feed.

Related posts:

1. WordPress Management: Cleaning Up Your Root Folder
2. How To Create A Maintenance Page Redirect When WordPress Is Down
3. How To Install WordPress Manually and Why Beginners Should Do It