WP Blog Host's Blog » John’s WordPress Video Articles

WordPress 3.0: Security Upgrades Overview & How To Install It

John Hoff — Sat, 19 Jun 2010 23:34:29 +0000

WordPress 3.0 “Thelonious” came out this week and like usual, everyone is encouraged to upgrade. Down below I’ll show you a video on how to manually install WordPress 3.0, but before we get to that, I just want to address a question I’ve been asked a few times already in regards to WordPress 3.0 security.

An online buddy of mine, Keith Davis, asked me a great question in regards to WordPress 3.0 security. He asked:

Hi John

I notice that WordPress 3.0 has now been released and we are all urged to upgrade.
I would have to make changes to my theme to make it compatible with WP 3.0 and since I’m not looking for additional functionality, the only reason I would upgrade is for added security.

The only reference I can find to increased security in version 3 is the ability to change the default username from admin – but most of us will have done that anyway as per your advice.

Would you say that an upgrade to version 3 is essential on security grounds?

Great question… and here’s my response.

It seems the security enhancements in WordPress 3.0 really only apply to those end-users who are installing WordPress for the first time (manual install).

For better WordPress security and help keep malicious hackers locked out, it’s a good idea to do the following three things:

Choose a different username than the default “admin”
Change the default database table prefix to something other than wp_
Add WordPress security keys

As Keith mentioned, I’ve shown him (and others) how to do those things in my ebook, WordPress Defender. WordPress 3.0 just makes it easier for you to do those things all during the setup process; in fact, the security keys are created automatically for you (see the video below).

So Keith, to answer your question about upgrading, no it’s not necessary in my opinion to upgrade right away; however, realize that although WordPress says they aren’t planning on a 3.1 right away, you never know. Tomorrow we might all discover one major security hole and every one must upgrade immediately.

If I were you or someone else in your position, I’d start planning how I’m going to upgrade real soon. You might contact your theme’s author and see what their plans are.

How To Install WordPress 3.0 Manually

Don’t forget, before you do a WordPress upgrade, it’s important to first fully back up your blog.

How To Create A Maintenance Page Redirect When WordPress Is Down

John Hoff — Fri, 27 Nov 2009 04:00:53 +0000

This is one of those blog articles you probably don’t need today but may need one day down the road. For that reason, I suggest you bookmark it in case you ever need to know how to do this.

Sometimes as bloggers and website owners there comes a need to temporarily redirect all our site visitors to a temporary maintenance page. If you’re a WordPress blogger, there is a maintenance page plugin you can use to accomplish this; however, that plugin is limited, crutched by the fact that you actually have to have your WordPress site in good working order.

But what happens if you one day find your site was hacked and some malicious asshole posts a bunch of spam or porn links on your site and your WordPress Dashboard isn’t working as it should? What if you had no access to your WordPress admin area at all?

What then?

A plugin won’t help.

So if you ever come to a point where you need to redirect everyone but yourself to a temp maintenance page, here’s how you do it through your web hosting control panel (apart from WordPress).

How To Create A Maintenance Page Redirect

Step 1

Create a simple html file and place it in your blog’s root directory. Name it something like, maintenance.html. Inside the maintenance.html file you can put anything you want. “Hi. I’m out to lunch for a few moments while the construction crew is busy at work . . .”

But why stop there? Your site is better than that. Customize the page with your site’s colors and images. Maybe add a video or your latest blog post. CSSgirl wrote some tips and shows some examples on the topic of creating a memorable maintenance page.

Step 2

Ok so now you have your maintenance.html page set up, the next step is to redirect everyone to it while you’re doing whatever it is you need to do.

Navigate to your blog’s root directory in your web hosting control panel and open your .htaccess file.

Once opened, you’re going to add this code at the top:

# Use this code to redirect visitors to maintenance.html file while upgrading
Options +FollowSymlinks
RewriteEngine on
RewriteCond %{REMOTE_ADDR} !^618\.124\.259\.25
RewriteCond %{REQUEST_URI} !/maintenance.html$
RewriteRule $ http://your-site.com/maintenance.html [R=302,L]

The yellow parts above are the areas you need to change. Visit What is my IP address? to find your IP address and put those numbers in under the first yellow highlight. Next add the url path to your own maintenance page in the second yellow part.

And that should do it. Your site should now show a maintenance page to everyone except you (your IP address was whitelisted). To see what everyone else sees, add a # sign in front of the IP line:

# RewriteCond %{REMOTE_ADDR} !^618\.124\.259\.25

The # comments lines out.

When you’re finished, leave the code in your .htaccess file for next time. To disable the code, just add a # in front of each line:

# Use this code to redirect visitors to maintenance.html file while upgrading
# Options +FollowSymlinks
# RewriteEngine on
# RewriteCond %{REMOTE_ADDR} !^618\.124\.259\.25
# RewriteCond %{REQUEST_URI} !/maintenance.html$
# RewriteRule $ http://your-site.com/maintenance.html [R=302,L]

Remember, if you need help with upgrades or WordPress security, visit the blog services page and use the contact form there to get in touch with me.

Like tutorials like these? Keep up with what we’re doing over here by subscribing to our feed.

WordPress Management: Cleaning Up Your Root Folder

John Hoff — Tue, 28 Jul 2009 04:00:20 +0000

Most of the time I’m a very organized person. I say most of the time because being that I blog from home and having two little boys, one and three, being organized at home can sometimes be a challenge.

Ketchup might splatter on my keyboard and at times there might be a Thomas The Tank Engine sitting on my desk, but if there’s one thing I know I can keep organized, it’s my WordPress hosting files. When I log into my hosting account, everything is tucked away nicely and files are easy to find.

When you install WordPress, by default it places all its core files in the same directory of your WordPress installation. So for example, if you placed your blog in your root directory (i.e. www.myblog.com), then your web hosting root folder will include all the WordPress system files.

Below and on the left is an example what a typical WordPress directory looks like. Pretty cluttered up with a lot of stuff you don’t need to know about, huh? On the right is an example of what you can do by moving all those core files and folders out of your root directory and into a subdirectory (in the example below, the subdirectory is /root-blog.

So how do you do that?

Well you’re in luck, because have I got a video for you.

As I mentioned in the video, it might be wise to create yourself a maintenance page where you can send your visitors to while you’re moving your files around. The move shouldn’t take long, but just in case you missed how to redirect your visitors to a maintenance page while your site is down, here’s how I showed you how to do it in my post, How To Install WordPress Manually.

How To Create A Simple Maintenance Page

You could always download a WordPress maintenance mode plugin, but in this case it probably won’t work. During the move process you’ll be moving your /wp-content folder, which contains all your plugins. This will cause your site to not load; therefore, it’s best to have your own maintenance page independent of WordPress.

So, here’s how to create a custom maintenance page without a plugin.

Step 1

Step 2

Ok so now you have your maintenance.html page set up; the next step is to redirect everyone to it while you’re doing your upgrade.

Navigate to your blog’s root directory in your web hosting control panel and open your .htaccess file.

Once opened, you’re going to add this code at the top:

And that should do it. Your site should now show a maintenance page to everyone except you (your IP address was whitelisted). To see what everyone else sees, add a # sign in front of the IP line:

# RewriteCond %{REMOTE_ADDR} !^618\.124\.259\.25

The # comments lines out.

When you’re finished, leave the code in your .htaccess file for next time. To disable the code, just add a # in front of each line:

Remember, if you need help with upgrades or moving your files around like in this tutorial, visit the blog services page and use the contact form there to get in touch with me. This is a service I can provide.

Questions?

Fire away.

WordPress 2.8.2 Has Been Released & Provides Security Fixes

John Hoff — Mon, 20 Jul 2009 23:26:27 +0000

Just a quick note to my blog readers, WordPress 2.8.2 has been released. The reason for the update was WordPress discovered 2.8.1 had a security leak in it which could allow malicious hackers get into your blog.

Taken from WordPress.org:

WordPress 2.8.2 fixes an XSS vulnerability. Comment author URLs were not fully sanitized when displayed in the admin. This could be exploited to redirect you away from the admin to another site.

You can download the latest version of WordPress here.

If you don’t know how to upgrade, WP Blog Host has the following video tutorials. I also provide this service for $50, by the way.

How To Upgrade WordPress Using The Automatic Upgrade

How To Upgrade WordPress Manually

How To Upgrade WordPress Manually Video

John Hoff — Mon, 13 Jul 2009 17:57:55 +0000

Lately I’ve had a few people mention to me that their auto upgrade feature for WordPress (located in the WordPress dashboard under Tools) doesn’t work. In my experience, auto upgrades fail because plugins sometimes cause a conflict with the upgrade process.

If you’re having problems with the auto upgrade feature, make sure to deactivate all your plugins first.

If you’re still having issues, try switching your theme over to the default theme WordPress comes with. Doing these two things reverts WordPress back to its default state and will give your auto upgrade the best chance for compatibility.

If, however, after doing those two things your auto upgrade feature still won’t work, all is not lost. Here’s a video I did on how to manually upgrade WordPress. Because this process will take a few extra minutes longer than the auto upgrade feature, you may want to put your site in maintenance mode to let your customers know you’ll be right back. I show you how to do that in the video and the code needed is shown for your convenience below the video.

If you ever have any issues installing or upgrading, keep in mind I can do this for you. It costs $50 and you also get a full backup of your site.

Update: Keith Davis commented below and mentioned he had an issue watching the video. If you run into any issues, I also have the tutorial on my YouTube channel. Unfortunately, since YouTube only allows 10 minute videos, I had to separate the tutorial into 4 separate videos. The size is a little smaller, but if you enlarge it to full screen it shows pretty well. Here they are:

How To Create A Simple Maintenance Page

You could always download a WordPress maintenance mode plugin, but in this case it probably won’t work. When you follow the upgrade instructions on WordPress.org, you’ll notice it says to deactivate all your plugins.

So, here’s how to create a custom maintenance page without a plugin.

Step 1

Step 2

Ok so now you have your maintenance.html page set up, the next step is to redirect everyone to it while you’re doing your upgrade.

Navigate to your blog’s root directory in your web hosting control panel and open your .htaccess file.

Once opened, you’re going to add this code at the top:

And that should do it. Your site should now show a maintenance page to everyone except you (your IP address was whitelisted). To see what everyone else sees, add a # sign in front of the IP line:

# RewriteCond %{REMOTE_ADDR} !^618\.124\.259\.25

The # comments lines out.

When you’re finished, leave the code in your .htaccess file for next time. To disable the code, just add a # in front of each line:

Remember, if you need help with upgrades or WordPress security, visit the blog services page and use the contact form there to get in touch with me.

Like tutorials like these? Keep up with what we’re doing over here by subscribing to our feed.

How To Install WordPress Outtakes & Deleted Scenes

John Hoff — Fri, 10 Jul 2009 05:30:36 +0000

Hello everyone, today I have a guest post over on Barbara Swafford’s blog on the topic of blog security, and if you’re visiting here from there, I’d like to personally welcome you over to my blog.

Today I don’t have a particular lesson for anyone, I just wanted to say hello and welcome to new and returning visitors. If you’re curious what I blog about, take a look at my categories listed under Blog Topics in my sidebar.

I’ve been doing a lot of video tutorials lately and this last time I kept a few deleted scenes which didn’t make the cut (like the first scene where my 1 year old wakes up on the monitor while I’m recording).

Why all the distractions? Because I do all my blogging from home. Isn’t that what bloggers do?

Sorry about the video quality. My published tutorials are much better.

So without further ado, here are some funny blogging bloopers.

Installing WordPress Outtakes

How To Install WordPress Manually and Why Beginners Should Do It

John Hoff — Mon, 06 Jul 2009 05:00:35 +0000

Note – This article is split into two parts:

Part 1: Why you should install WordPress manually.
Part 2: Tutorial (video included) on how to install WordPress manually.

If you’re here to simply learn how to install WordPress manually, you may want to skip down to that part. Also, this tutorial is meant for new installs of WordPress only. If you want to learn how to “upgrade” WordPress manually, that video tutorial is coming real soon.

Part 1: Why you should install WordPress manually

To the right (and up) you’ll see the new WP Blog Host 125×125 gladiator banner ad. It’s meant to be a little funny, different, and most of all, let our prospective clients know we can make things easy for you as a new blogger.

I’m sure many of you have heard of the popular application installer, Fantastico. Although WP Blog Host does not use Fantastico, we have something very similar for easy installs of WordPress. Pretty much every blog I read out there advises newbie bloggers to find a web host with easy installs of WordPress.

I’m here to tell you that isn’t always the best way to go if you’re new to WordPress. The best way to go when you’re new is to take a stab at installing WordPress on your own, manually.

“What? Wait. No way, John. Are you trying to make my life more difficult?”

Trying to make your life more difficult, not exactly. What I’m trying to tell you is I’d rather teach you to fish than fish for you . . . or, you know – however that saying goes.

I’m always here for our customers, that’s part of the package deal for hosting with WP Blog Host – I’m right there to help. What new bloggers need to understand is that there is a huge learning curve when it comes to starting a blog. You not only need to learn how to blog and set up a time management system, you need to learn how WordPress works. And the best way to do that is to skip the easy “one-click” installer and install it yourself. It’ll teach you the basic organization of how WordPress is set up and configured.

As an example, I recently rebuilt my wife’s jewelry site. It’s built on a platform called Magento. Now I know a lot about WordPress, but Magento is a whole other beast – and I mean that literally. It was eating me alive!

I must of installed it 3 or 4 times before I got it all to work right. But you know what? I learned all about its foundation and how it works with a database by doing so.

If you use an application to install WordPress for the first time with no effort on your part (and you’re new to all this), you’ll probably have no idea what or why there is a thing called a database. By installing WordPress manually, you’ll understand how all the pieces of the puzzle fit together.

Ok, enough rambling about what I think. Here’s the tutorial for you newbies out there.

Part 2: How to install WordPress manually

The tutorial has been split up into 4 videos do to time constraints put on video length with sites like YouTube and Blip.tv. Also, if you want to see what can happen to me when I drink 2 cups of coffee, click and watch the first 30 seconds of the 4th video.

Video 1

Video 2

Note for Video 2: For WP Blog Host customers, instead of logging into the database to get your Database Host, you could just click the pencil icon as shown below.

Video 3

Video 4

Links shown in the videos:

Download WordPress: http://wordpress.org/download/
WordPress 5-Minute Install: http://codex.wordpress.org/Installing_WordPress

If you have any questions, please don’t hesitate to ask in the comment section below.

How To Install Google Analytics On A WordPress Blog Without Using A Plugin

John Hoff — Mon, 16 Mar 2009 13:49:14 +0000

If you’ve been blogging for longer than a few months, you’ve probably heard of the ever so popular site analytics program, Google Analytics.

It allows blog owners to do such things as:

Discover how your site visitors found your blog
View how many visitors your blog receives each day
View areas on your blog where people have clicked
. . . and a ton more.

If you blog, it’s inevitable that you are going to try Google Analytics at some point. It really is a great analytics program; however, I must admit that it can seem quite complex at times and if you’re new to the program and you might feel a bit intimidated. In the near future I’ll try to post some examples on how to use the program.

When it comes to plugging Google Analytics into your blog, you have a couple of options available to you.

Download and use a plugin
Copy and paste code into your blog’s footer file

Why I don’t like plugins

Simply put, plugins slow down the load time of your website and also pose security risks which could leave your blog open to intruders. Even if the plugin is secure today, it might not be when a newer version of WordPress is released or if the plugin author abandons the program and stops issuing updates.

In my opinion, the best way (and just as easy) to install this is to simply copy and paste Google’s supplied code into your theme’s footer file. That’s it, no plugin, done and move on.

How To Set Up Google Analytics Without A Plugin

Ok, let’s move on to the tutorial. If you have any questions, feel free to comment below.

Watch The How-To Video

Step 1: Sign up for a new Google Analytics account.

Step 2: Copy the JavaScript code.

During the sign up process you’ll be asked things like your name, email address, etc. At some point, you’ll come to a page that looks like the image seen below. You will will need to copy this code and paste it into your blog.

As a side note, even if you used a plugin to install Google Analytics, you would still need to copy and paste this code at some point; so plugins don’t necessarily make things any easier.

Step 3: Pasting the code into your footer.php file

At this point, log into your WordPress blog and navigate to your theme’s editor by going to Dashboard -> Appearance –> Editor.

Then on the right you should see a list of your theme’s files. Click on the Footer.php file.

Paste the code you copied from Google Analytics just above the ending tag.

Click Update File

And that’s it. No plugins and no worries about updates.

To view your site’s statistics now, log into your Google Analytics account and view your stats. It may take a day or so to start receiving your traffic stats, so if you don’t see it right away, just be patient.