WP Blog Host's Blog » Tutorials

WordPress 3.0: Security Upgrades Overview & How To Install It

John Hoff — Sat, 19 Jun 2010 23:34:29 +0000

WordPress 3.0 “Thelonious” came out this week and like usual, everyone is encouraged to upgrade. Down below I’ll show you a video on how to manually install WordPress 3.0, but before we get to that, I just want to address a question I’ve been asked a few times already in regards to WordPress 3.0 security.

An online buddy of mine, Keith Davis, asked me a great question in regards to WordPress 3.0 security. He asked:

Hi John

I notice that WordPress 3.0 has now been released and we are all urged to upgrade.
I would have to make changes to my theme to make it compatible with WP 3.0 and since I’m not looking for additional functionality, the only reason I would upgrade is for added security.

The only reference I can find to increased security in version 3 is the ability to change the default username from admin – but most of us will have done that anyway as per your advice.

Would you say that an upgrade to version 3 is essential on security grounds?

Great question… and here’s my response.

It seems the security enhancements in WordPress 3.0 really only apply to those end-users who are installing WordPress for the first time (manual install).

For better WordPress security and help keep malicious hackers locked out, it’s a good idea to do the following three things:

Choose a different username than the default “admin”
Change the default database table prefix to something other than wp_
Add WordPress security keys

As Keith mentioned, I’ve shown him (and others) how to do those things in my ebook, WordPress Defender. WordPress 3.0 just makes it easier for you to do those things all during the setup process; in fact, the security keys are created automatically for you (see the video below).

So Keith, to answer your question about upgrading, no it’s not necessary in my opinion to upgrade right away; however, realize that although WordPress says they aren’t planning on a 3.1 right away, you never know. Tomorrow we might all discover one major security hole and every one must upgrade immediately.

If I were you or someone else in your position, I’d start planning how I’m going to upgrade real soon. You might contact your theme’s author and see what their plans are.

How To Install WordPress 3.0 Manually

Don’t forget, before you do a WordPress upgrade, it’s important to first fully back up your blog.

WordPress Defender: 30 Ways to Secure Your Blog from Attack Anyone Can Do

John Hoff — Mon, 01 Mar 2010 04:20:02 +0000

Last week I told you about how one single hacker broke my wife’s heart.

That hacker set me out on a mission.

Over the last couple of years I’ve soaked up everything I could about WordPress security. I learned many of the tricks those malicious jerks use to hack blogs, I watched as plugin developers developed plugins to fight back, I engaged the WordPress forums and other users in conversations about the topic.

All this time, experience, and knowledge I’ve gained over those last couple of years have culminated into one single resource I’ve been working on.

It’s called WordPress Defender, and it’s mission is to help you to never wake up one morning with the same kind of broken heart my wife had.

It’s a 150 page guide jam packed with things you can do today to start protecting your WordPress blog from malicious attacks. And if you’re worried it might be over your head, don’t. I’ve taken special care to make sure any and everyone can follow it.

You even get over 1.5 hours of video (14 videos in all) where you can watch me in real time set up many of these security features.

3 Day Special Offer

Don’t wait too long, because for 3 days only (March 1st – 3rd 2010) you can get it all for nearly 50% off ($19.99). After that, the price will go up.

Now let me ask you, is your blog worth $20? Is it worth skipping that night at the movies to ensure your blog is protected?

And if you’re the affiliate type… it also comes with an affiliate program which pays out 40%.

So take the time, go check it out and let me know what you think.

And if you ever have a question about anything contained inside the book, you know where to find me.

WordPress Defender: 30 Ways to Secure Your Blog from Attack Anyone Can Do

Introducing The New WP Blog Host Television Channel: wpbloghost.tv

John Hoff — Wed, 19 Aug 2009 17:18:36 +0000

WP Blog Host has a television channel!

It’s my pleasure to introduce our new tutorials Web television channel, WP Blog Host.tv.

As many of you know, I’ve been spending lots of time creating easy to follow WordPress and WP Blog Host product video tutorials for bloggers and customers who host with WP Blog Host. The tutorials can be for anyone blogging and using WordPress, but bloggers who host with our company get the extra advantage of watching how to do everything using our hosting (click-by-click).

Here’s a snapshot of our new television channel:

Ok I know, a nice slick video slider would be nice on the home page. I spent days toying with lots of WordPress video themes and you know, none really clicked with me. Most of those themes are all very dark and hard to read. Some come with various color choices and I did experiment with color changes, but in the end a simple blog style theme worked best for me.

Down the road when I start doing “in the news” related videos, I’ll probably shell out the big bucks and really build a nice customized site.

I do have to give one mention, though, to a guy named Vishal from Fresh Lime Sode. They have a number of WordPress themes and this one in particular I really liked and tried. The best thing about him is when I ran into a few issues, Vishal was quick to reply to my emails and even did a little customization for me.

If you’re looking for nice WordPress Themes and want to know there will be someone available to help you with your support needs, I highly suggest checking out Fresh Lime Sode.

Subscribing To The Videos & Scheduling

The new site, http://wpbloghost.tv (opens in a new tab), has its own RSS subscription so you can keep up to date and notified when new videos are uploaded.

Because this is my project and it is relatively new, there is no set posting schedule at this time; however, that may change in the coming months. I do have a nice running to-do list and will add videos regularly, though.

WpBlogHost -> WP Blog Host

Converting our old tutorials page into its own tutorials Web channel is only the first step in some exciting changes coming to WP Blog Host.

Ah yes, did you catch that? I used WP Blog Host, not WpBlogHost. After months of watching how others reprint our name, WpBlogHost felt it best to go with what everyone usually remembers, WP Blog Host. Why not, right? That change will come to the main site real soon.

Also, released shortly will be a new design of our main site and my blog. I’m really excited about the redesign of my blog because it will be more representative of me, John Hoff the blogger, rather than our “corporation’s blog”.

Feedback

Back to the topic at hand, if you have a few moments, I’d love to hear a little feedback on the new site, WP Blog Host.tv and I hope you find the tutorials useful.

WordPress Management: Cleaning Up Your Root Folder

John Hoff — Tue, 28 Jul 2009 04:00:20 +0000

Most of the time I’m a very organized person. I say most of the time because being that I blog from home and having two little boys, one and three, being organized at home can sometimes be a challenge.

Ketchup might splatter on my keyboard and at times there might be a Thomas The Tank Engine sitting on my desk, but if there’s one thing I know I can keep organized, it’s my WordPress hosting files. When I log into my hosting account, everything is tucked away nicely and files are easy to find.

When you install WordPress, by default it places all its core files in the same directory of your WordPress installation. So for example, if you placed your blog in your root directory (i.e. www.myblog.com), then your web hosting root folder will include all the WordPress system files.

Below and on the left is an example what a typical WordPress directory looks like. Pretty cluttered up with a lot of stuff you don’t need to know about, huh? On the right is an example of what you can do by moving all those core files and folders out of your root directory and into a subdirectory (in the example below, the subdirectory is /root-blog.

So how do you do that?

Well you’re in luck, because have I got a video for you.

As I mentioned in the video, it might be wise to create yourself a maintenance page where you can send your visitors to while you’re moving your files around. The move shouldn’t take long, but just in case you missed how to redirect your visitors to a maintenance page while your site is down, here’s how I showed you how to do it in my post, How To Install WordPress Manually.

How To Create A Simple Maintenance Page

You could always download a WordPress maintenance mode plugin, but in this case it probably won’t work. During the move process you’ll be moving your /wp-content folder, which contains all your plugins. This will cause your site to not load; therefore, it’s best to have your own maintenance page independent of WordPress.

So, here’s how to create a custom maintenance page without a plugin.

Step 1

Create a simple html file and place it in your blog’s root directory. Name it something like, maintenance.html. Inside the maintenance.html file you can put anything you want. “Hi. I’m out to lunch for a few moments while the construction crew is busy at work . . .”

But why stop there? Your site is better than that. Customize the page with your site’s colors and images. Maybe add a video or your latest blog post. CSSgirl wrote some tips and shows some examples on the topic of creating a memorable maintenance page.

Step 2

Ok so now you have your maintenance.html page set up; the next step is to redirect everyone to it while you’re doing your upgrade.

Navigate to your blog’s root directory in your web hosting control panel and open your .htaccess file.

Once opened, you’re going to add this code at the top:

# Use this code to redirect visitors to maintenance.html file while upgrading
Options +FollowSymlinks
RewriteEngine on
RewriteCond %{REMOTE_ADDR} !^618\.124\.259\.25
RewriteCond %{REQUEST_URI} !/maintenance.html$
RewriteRule $ http://your-site.com/maintenance.html [R=302,L]

The yellow parts above are the areas you need to change. Visit What is my IP address? to find your IP address and put those numbers in under the first yellow highlight. Next add the url path to your own maintenance page in the second yellow part.

And that should do it. Your site should now show a maintenance page to everyone except you (your IP address was whitelisted). To see what everyone else sees, add a # sign in front of the IP line:

# RewriteCond %{REMOTE_ADDR} !^618\.124\.259\.25

The # comments lines out.

When you’re finished, leave the code in your .htaccess file for next time. To disable the code, just add a # in front of each line:

# Use this code to redirect visitors to maintenance.html file while upgrading
# Options +FollowSymlinks
# RewriteEngine on
# RewriteCond %{REMOTE_ADDR} !^618\.124\.259\.25
# RewriteCond %{REQUEST_URI} !/maintenance.html$
# RewriteRule $ http://your-site.com/maintenance.html [R=302,L]

Remember, if you need help with upgrades or moving your files around like in this tutorial, visit the blog services page and use the contact form there to get in touch with me. This is a service I can provide.

Questions?

Fire away.

How To Upgrade WordPress Manually Video

John Hoff — Mon, 13 Jul 2009 17:57:55 +0000

Lately I’ve had a few people mention to me that their auto upgrade feature for WordPress (located in the WordPress dashboard under Tools) doesn’t work. In my experience, auto upgrades fail because plugins sometimes cause a conflict with the upgrade process.

If you’re having problems with the auto upgrade feature, make sure to deactivate all your plugins first.

If you’re still having issues, try switching your theme over to the default theme WordPress comes with. Doing these two things reverts WordPress back to its default state and will give your auto upgrade the best chance for compatibility.

If, however, after doing those two things your auto upgrade feature still won’t work, all is not lost. Here’s a video I did on how to manually upgrade WordPress. Because this process will take a few extra minutes longer than the auto upgrade feature, you may want to put your site in maintenance mode to let your customers know you’ll be right back. I show you how to do that in the video and the code needed is shown for your convenience below the video.

If you ever have any issues installing or upgrading, keep in mind I can do this for you. It costs $50 and you also get a full backup of your site.

Update: Keith Davis commented below and mentioned he had an issue watching the video. If you run into any issues, I also have the tutorial on my YouTube channel. Unfortunately, since YouTube only allows 10 minute videos, I had to separate the tutorial into 4 separate videos. The size is a little smaller, but if you enlarge it to full screen it shows pretty well. Here they are:

How To Create A Simple Maintenance Page

You could always download a WordPress maintenance mode plugin, but in this case it probably won’t work. When you follow the upgrade instructions on WordPress.org, you’ll notice it says to deactivate all your plugins.

So, here’s how to create a custom maintenance page without a plugin.

Step 1

Step 2

Ok so now you have your maintenance.html page set up, the next step is to redirect everyone to it while you’re doing your upgrade.

Navigate to your blog’s root directory in your web hosting control panel and open your .htaccess file.

Once opened, you’re going to add this code at the top:

And that should do it. Your site should now show a maintenance page to everyone except you (your IP address was whitelisted). To see what everyone else sees, add a # sign in front of the IP line:

# RewriteCond %{REMOTE_ADDR} !^618\.124\.259\.25

The # comments lines out.

When you’re finished, leave the code in your .htaccess file for next time. To disable the code, just add a # in front of each line:

Remember, if you need help with upgrades or WordPress security, visit the blog services page and use the contact form there to get in touch with me.

Like tutorials like these? Keep up with what we’re doing over here by subscribing to our feed.

How To Install WordPress Manually and Why Beginners Should Do It

John Hoff — Mon, 06 Jul 2009 05:00:35 +0000

Note – This article is split into two parts:

Part 1: Why you should install WordPress manually.
Part 2: Tutorial (video included) on how to install WordPress manually.

If you’re here to simply learn how to install WordPress manually, you may want to skip down to that part. Also, this tutorial is meant for new installs of WordPress only. If you want to learn how to “upgrade” WordPress manually, that video tutorial is coming real soon.

Part 1: Why you should install WordPress manually

To the right (and up) you’ll see the new WP Blog Host 125×125 gladiator banner ad. It’s meant to be a little funny, different, and most of all, let our prospective clients know we can make things easy for you as a new blogger.

I’m sure many of you have heard of the popular application installer, Fantastico. Although WP Blog Host does not use Fantastico, we have something very similar for easy installs of WordPress. Pretty much every blog I read out there advises newbie bloggers to find a web host with easy installs of WordPress.

I’m here to tell you that isn’t always the best way to go if you’re new to WordPress. The best way to go when you’re new is to take a stab at installing WordPress on your own, manually.

“What? Wait. No way, John. Are you trying to make my life more difficult?”

Trying to make your life more difficult, not exactly. What I’m trying to tell you is I’d rather teach you to fish than fish for you . . . or, you know – however that saying goes.

I’m always here for our customers, that’s part of the package deal for hosting with WP Blog Host – I’m right there to help. What new bloggers need to understand is that there is a huge learning curve when it comes to starting a blog. You not only need to learn how to blog and set up a time management system, you need to learn how WordPress works. And the best way to do that is to skip the easy “one-click” installer and install it yourself. It’ll teach you the basic organization of how WordPress is set up and configured.

As an example, I recently rebuilt my wife’s jewelry site. It’s built on a platform called Magento. Now I know a lot about WordPress, but Magento is a whole other beast – and I mean that literally. It was eating me alive!

I must of installed it 3 or 4 times before I got it all to work right. But you know what? I learned all about its foundation and how it works with a database by doing so.

If you use an application to install WordPress for the first time with no effort on your part (and you’re new to all this), you’ll probably have no idea what or why there is a thing called a database. By installing WordPress manually, you’ll understand how all the pieces of the puzzle fit together.

Ok, enough rambling about what I think. Here’s the tutorial for you newbies out there.

Part 2: How to install WordPress manually

The tutorial has been split up into 4 videos do to time constraints put on video length with sites like YouTube and Blip.tv. Also, if you want to see what can happen to me when I drink 2 cups of coffee, click and watch the first 30 seconds of the 4th video.

Video 1

Video 2

Note for Video 2: For WP Blog Host customers, instead of logging into the database to get your Database Host, you could just click the pencil icon as shown below.

Video 3

Video 4

Links shown in the videos:

Download WordPress: http://wordpress.org/download/
WordPress 5-Minute Install: http://codex.wordpress.org/Installing_WordPress

If you have any questions, please don’t hesitate to ask in the comment section below.

How To Fully Backup WordPress Anytime With Just A Few Clicks

John Hoff — Mon, 11 May 2009 16:10:13 +0000

Today I want to show you how to fully backup your WordPress blog using two easy-to-use programs.

Creating a full backup of your blog is a two part process:

Backup your WordPress hosted files and directories
Backup your database

There are many ways to do this and I’ll betcha most of you who have been blogging for awhile already do database backups, but I also bet most of you don’t backup your WordPress files nearly as much.

Why? I bet it has to do with simplicity. Using a database plugin for WordPress makes backing up your database cake. In fact, you can even set it on autopilot and email you copies regularly without even lifting a finger.

But those files and directories sitting there in your hosting account are important as well, especially the wp-content folder. Here’s what the two backups actually backup:

Backing up your WordPress files and folders will ensure your theme, images, .htaccess files, plugins, misc. uploads, CSS settings, and more are all backed up and saved in case your blog ever crashes and you need to do a restore.
Backing up your database will ensure all your posts, comments, login information, etc. are all saved.

Since doing a full backup is *critically important* for your blog, and since we are all lazy and need this entire process to be as simple as possible for us, here are two ways fully backup your WordPress blog which should make the entire process real easy for you.

Note, too, that this my preferred method – I wouldn’t suggest the two following programs if I didn’t use them myself.

How To Easily Backup Your WordPress Files and Folders

There is a really neat program out there which is called SyncBackSE which once installed on your computer can be a very powerful tool in keeping a full backup copy of your hosted WordPress files. You can download a free trial version of the software right here.

After the free trial period the program costs $30. Trust me, that’s a small price to pay when it comes to blogging and feeling confident your blog is fully backed up and everything is safe. Nothing will crush you more than to one day find out something’s wrong with your blog and you don’t know what to do.

This is a huge step many people miss. I frequent the WordPress Support Forums and I see practically on a daily basis someone has a problem with their blog which “has just popped up out of no where”. They always seem to have a database backup, but rarely do they have their hosted files backed up. Many times the problem is their site got hacked and they only noticed it when either Google has stopped sending traffic their way (their site has turned into a spam site in Google’s eyes) or their site spontaneously starts acting up.

Here’s why I like SyncBackSE

It comes spyware, AdWare, and virus free.
Once installed all it takes is a click to backup your blog’s files and directories.
The process can all be automated and set to run at specific times (a perfect compliment to the database backup plugin).
Restoring your files is just as easy as backing them up.
Can even keep a live current backup of your blog on your hard drive.

That last point about keeping a live current backup of your site on your hard drive I think is really cool. That means SyncBackSE will “watch” your site’s hosting files for any changes. When you make a change, it will automatically keep the mirror files on your hard drive current with what’s on your hosting account.

That’s pretty cool in my book.

Download the free trial and let me know if you have any questions. I know the program costs $30 but tell me – is your blog worth $30? Problems happen and don’t think they’ll never happen to you, because they will.

How To Easily Backup Your WordPress Database

Your database represents all your blood, sweat, and tears when it comes to writing articles for your blog. All those long hours and hard work put into those articles reside in your database. Since it also houses all your community responses (comments), it’s also the home base of your blog’s community.

Consider that all important? I’m sure you do.

Il Filosofo has probably one of the most popular WordPress database backup plugins out there. Here’s a snapshot of the settings area.

From the Tools menu in your WordPress Dashboard, click Backup and you can see that some of the options for your database backup include emailing it to yourself, saving the file now, and/or setting up scheduled backups so your database backup will be emailed to you whenever you want.

There are of course many other WordPress database backup plugins out there, but I know this one works very well.

One thing I’d suggest you not to do is to save the database backup file to your server (see the image above). There is no reason to keep a backup copy of your database on the server where someone potentially could find it online, download it, and discover your login information.

Summary

To create a very simple way to fully backup your WordPress blog, you need to do two things: backup your hosting files/folders and backup your database.

By using 2 programs, SyncBackSE (download trial version here) and a WordPress database backup plugin, we can simplify and even automate this process for us.

Have you created a full backup of your blog lately? Do you think $30 for SyncBackSE is out of line since there are ways to backup your blog’s files for free? Or do you think that’s a small price to pay for the simplicity and reassurance it’ll get done regularly?

How To Not Track Your Own Visits In Google Analytics – Setting Up A Filter

John Hoff — Mon, 20 Apr 2009 05:50:38 +0000

Anyone whose been blogging for longer than a couple weeks will of at least heard of Google Analytics.

Problem is, it’s so damn difficult to try and figure out when you’re just starting out because there’s SO much you can do with it. One of my first frustrations with it was the fact that I couldn’t determine which clicks and visits were my own?

Obviously, you’re more interested in who is visiting your site, where they came from, and what they did to find you. You’re not interested in how you found your own website.

So here’s a little video I put together which hopefully you’ll find useful. It will show you how to set up a filter on Google Analytics so you don’t track your own movements and visits to your own website.

If you haven’t already set up Google Analytics to run on your blog, here’s how: How To Install Google Analytics On A WordPress Blog Without Using A Plugin

How To Set Up A Google Analytics Filter

How To Install Google Analytics On A WordPress Blog Without Using A Plugin

John Hoff — Mon, 16 Mar 2009 13:49:14 +0000

If you’ve been blogging for longer than a few months, you’ve probably heard of the ever so popular site analytics program, Google Analytics.

It allows blog owners to do such things as:

Discover how your site visitors found your blog
View how many visitors your blog receives each day
View areas on your blog where people have clicked
. . . and a ton more.

If you blog, it’s inevitable that you are going to try Google Analytics at some point. It really is a great analytics program; however, I must admit that it can seem quite complex at times and if you’re new to the program and you might feel a bit intimidated. In the near future I’ll try to post some examples on how to use the program.

When it comes to plugging Google Analytics into your blog, you have a couple of options available to you.

Download and use a plugin
Copy and paste code into your blog’s footer file

Why I don’t like plugins

Simply put, plugins slow down the load time of your website and also pose security risks which could leave your blog open to intruders. Even if the plugin is secure today, it might not be when a newer version of WordPress is released or if the plugin author abandons the program and stops issuing updates.

In my opinion, the best way (and just as easy) to install this is to simply copy and paste Google’s supplied code into your theme’s footer file. That’s it, no plugin, done and move on.

How To Set Up Google Analytics Without A Plugin

Ok, let’s move on to the tutorial. If you have any questions, feel free to comment below.

Watch The How-To Video

Step 1: Sign up for a new Google Analytics account.

Step 2: Copy the JavaScript code.

During the sign up process you’ll be asked things like your name, email address, etc. At some point, you’ll come to a page that looks like the image seen below. You will will need to copy this code and paste it into your blog.

As a side note, even if you used a plugin to install Google Analytics, you would still need to copy and paste this code at some point; so plugins don’t necessarily make things any easier.

Step 3: Pasting the code into your footer.php file

At this point, log into your WordPress blog and navigate to your theme’s editor by going to Dashboard -> Appearance –> Editor.

Then on the right you should see a list of your theme’s files. Click on the Footer.php file.

Paste the code you copied from Google Analytics just above the ending tag.

Click Update File

And that’s it. No plugins and no worries about updates.

To view your site’s statistics now, log into your Google Analytics account and view your stats. It may take a day or so to start receiving your traffic stats, so if you don’t see it right away, just be patient.

Allowing Readers To Subscribe To Your WordPress Post Without Commenting

John Hoff — Tue, 29 Jul 2008 04:00:03 +0000

Ever go to a blog and read an article that you find interesting and would like to follow what other commentators are saying but you don’t really care to add a comment yourself?

I do sometimes. Especially if it’s a list that I know others will add links to in a comment section.

Like mine, most WordPress blogs you go to have the Subscribe To Comments plugin so those that comment can keep up on the conversation going on in the comment section.

There’s a little tweak I did to my Subscribe To Comments plugin many bloggers may not be aware of that you can do.

By simply adding the following line of code to your comments.php file, you can allow your blog readers to follow a topic without commenting.

As mentioned above, add the code to your comments.php file and just below the tag near the bottom of the file’s code.

This will add a small box under the “Subscribe To Comments” checkbox where your commentators can enter their email address and stay connected. For an example, scroll down and see how mine is displayed below.