The recent WordPress worm doing the rounds on the internet has really surprised me. Not because WordPress has yet again become vulnerable to attack via some hack or workaround, but because of various user reactions. Reading tweets and blog posts over the weekend I’ve been pretty stunned at what some people have been saying… you have the usual “WordPress Sucks” etc, but some go beyond that, and frankly – it’s a little ridiculous.

WordPress makes me feel unsafe

First off, there’s Robert Scoble. His recent blog post entitled “I Don’t feel safe with WordPress..” is pretty amazing in itself. He identifies a number of common user errors which frankly you cannot blame on any piece of software. They are:

“I didn’t have a backup” – What? You didn’t have a wha…? Come on! Who in their right mind runs a successful online enterprise and does not back up data? I’ve been backing this blog up since day 1 on a daily basis, not because I’m anal, but because it’s common sense.

“…my admin account has been deleted and a new one doesn’t use the name ‘admin’” – Yupp – this one is also top of the crazy stupid list. Again I ask myself how people (and I say people as in a group of people that apparently run scobelizer.com), how people think that having an Administrator account with the username of “admin” or “administrator” is a good idea. You’ve done half the hackers job for them.

Anyway, Robert goes on to say that he no longer “feels safe” anymore using his WordPress blog because he has been taken advantage of (ie hacked) because of these errors. He then goes onto question how we as WordPress users can feel safe again after such a horrible experience? Granted – the day I get hacked I am going to be one pissed off bunny – but I seriously do not understand how WordPress is getting the blame on this one.

WordPress Sucks

Next up we have Arnold Kim (of MacRumors fame) digging up a blog post via tweet this evening from 2 years ago, where he discussed how “WordPress sucks”. What Arnold says in this piece is basically he doesn’t have the inclination to keep up with security updates for open source software, therefore it sucks. Ummm yeah. Sorry my man (and a man I respect for what he’s done elsewhere) but if you want a pain free life – don’t use free open source technologies (edit – or any technology for that matter!)

It’s got nothing to do with lack of responsibility on the developers part.

The Problem

The problem with open source is, its open source. It’s the age old problem, and not tied down to any one product (as Arnold states at the top of his article). PHPBB is another old favourite that also gets spanked by spammers on a regular basis via loopholes, hacks etc etc. But yeah, the problem is that the fact that the code is open source allows hackers (and anyone else for that matter) the luxury to drill down to the very core of the code that all of these successful blogs and forums are running on. Joe Bloggs can download the latest WordPress build in 30 seconds, and if inclined finger through every line of code looking for ways to break it.

Once found, that hack likely makes every WordPress blog vulnerable instantly. This is not the fault of WordPress.

The Options

For me, you have three options if you cannot “deal with the pains” of open source:

1. Use open source but pay someone else to maintain it, and allow you the flexibility to work outside of the box.
2. Use a closed source service – and be restricted.
3. Build it yourself.

You cannot ever get away from the fact that open source is inherently vulnerable to hacks, worms blah blah blah. It is simply impossible. As soon as the code is exposed to all and sundry – people will try to break it. What better prize than to break some code that’s used by hundreds of thousands of blogs? Sounds like a fun project.

I would have hoped that people now days would understand this.

An update to this post to make my feelings VERY clear:

(taken from a recently posted comment…)

What I am trying to say is that the fact that open source is open, security vulnerabilities can be found easier (for better or for worse), so if you as a user are concerned with security you should:

1) Act securely yourself (see my points re Robert Scoble)

2) Accept that open source is open to vulnerabilities just as much as anything else, and inevitably patching will be more frequent and security audited more often.

It is not the fault of open source.

It’s the users of open source I am trying to expose in this article, not open source itself.

WordPress has posted a blog article regarding a worm going around the internet actively looking for a security vulnerability in all WordPress blogs before version 2.8.3. The worm itself exposes itself in a couple of ways:

1. Strange additions to permalinks, such as example.com/category/post-title/%&(%7B$%7Beval(base64_decode($_SERVER%5BHTTP_REFERER%5D))%7 D%7D|.+)&%/. The keywords are “eval” and “base64_decode.”
2. A “back door” was created by a “hidden” Administrator. Check your site users for “Administrator (2)” or a name you do not recognize.

The damage that’s done can obviously be pretty horrendous. Permalinks all die, making your blog useless, and alas – tons of spam being inserted into old articles etc.

Protection

How do you protect yourself? Get upgrading! If you haven’t already done so, upgrading to version 2.8.4 is now a must. Follow this simple guide from WordPress – the important parts being

1. Backup Your Files
2. Backup Your Database

Then upgrade! I have to say though, upgrading brings the fear into me, and also takes some effort. I can understand why people don’t do it (the WordPress auto upgrade sometimes fails, and b0rks installs) – I guess you need to think security more than features!

I’ve been hit!

Numerous times yesterday I noticed via my web analytics spy that your beloved ReynoldsFTW category pages were being hit by this so-called worm via the strange URL above in (1). Which goes to show it’s pretty prevalent out there! This is not a drill!

Luckily though, I lucked out by upgrading to 2.84 some weeks back when it was released.

Help Others!

If you love your fellow man – hit the retweet button at the top and bottom of this article – let’s hug!

Today I’ve been messing around with my blog, creating a social button WordPress Plugin. Determined to make better use of the sites I’m working with, and filtering out the noise that I’m not interested in.

So, as you will see at the top and bottom of this post, I’ve now got buttons for the following:

• RSS
• Delicious
• Twitter
• Reddit
• StumbleUpon
• Technorati
• Dzone

For most people the lack of Digg button will probably ring alarm bells in many heads… I can understand that, but when I look at my stats for the past 2 months, you’d understand why. A mere 0.8% of all traffic to this site comes from Digg, despite posting the same articles there that I post everywhere else – particularly in their “Programming” section. I also received an email from the DZone owners last Friday which stated:

“Digg’s programming-related topics have been dead for more than a year”

This made me think, and looking at the stats – they were right! DZone is roughly 19% of my overall referral traffic to this site, and I had no social buttons here for them, focussing on Digg as my key social button of choice.

Therefore, times are a changing round here, Digg buttons gone, DZone interactive buttons appearing in their place. I’m also paying close attention to my Reddit stats, currently at around 10% of referral traffic, however it so hit and miss there its difficult to tell if it’s worthy of a full on interactive button.

I’ll continue to submit my articles there, in the vague hope that I might attract an eye or two, but that’s as far as it’ll go…

Whilst I think Digg still does show some useful content, it’s extremely difficult for a site like mine to get coverage on the content I am serving. Digg is too maintream tech these days, the launch of jQuery 1.3 being the most popular programming article I can remember recently. I think a Digg button will still have its merits on certain blogs, but for techie/programming blogs, it’s time is up. I can only assume that this will be the case for many categories on Digg in the near future, as it slowly becomes the The National Enquirer of the internet.

Tools to help you learn…

Pro Blogger	Amazon Kindle 2	Learning jQuery 1.3

Today the super, smashing, brilliant WordPress plugin WPtouch has been updated to version 1.7.5. So what’s new?

New Options

So a few new options have cropped up as part of this release. For speed, we’ve got the new gzip compression option which allows the site pages to load up faster, however WPtouch note that this may interfere with other plugins, so use wisely!

You can also choose which version of the site is seen by iPhone users by default, so either the normal web version, or the iPhone version.

A new clock icon has been included for use with your home screen bookmark icon options, or others.

WPtouch also now gives you the option to sort by Alphabetical or Page Order on your dropdown menus which is handy!

Enhancements

WPtouch now includes support adsense ads in line within your posts. Just sign up for Ads for Mobile Content in your Adsense control panel and copy over your newly created account ID for mobile content.

Image resizing is now really great in this latest version. The plugin auto resizes your blog images to fit snugly within the iPhone template without issue – very good!

Conclusion

Some great updates in 1.7.5 – WPtouch truly gets better with every release – for a free plugin – this is one of the best, easiest to use, no brainers out there! for a full list of bugs and enhancements, click here.

Some Resources to help you learn…

WordPress For Dummies	WordPress Complete	WordPress Plugin Development

If you’ve been living under a shell for the past, I dunno 5 years – WordPress is an open source blog posting application. With the advent of version 2.7, the admin section got a great makeover with functionality plus usability enhancements by the bucket load. In this article I will describe where WordPress is using jQuery and the plugins involved.

Thickbox

The first plugin I would like to talk about is Thickbox. Thickbox is a modal window plugin bringing focus to a seemingly popped up window or photo within a page, and removing focus from the page behind it. The most obvious example of this is the “Add Media” functionality within the Add/Edit posts section. What’s great about this implementation is the fact that all your uploading, attribute setting and inserting functionality is handled in one thickbox modal window, no page refreshes. Once complete, the window closes and your blog post has been updated with the new media inserted, again without a page refresh. Thank you ajax!

Thickbox can also be seen in use within WordPress when previewing plugin information, or previewing a new theme before you activate it. Again, ajaxified to the hilt for ultimate usability. Good work guys!

hoverIntent

HoverIntent  is quite a good plugin actually, it simply tries to guess the user’s intent on where they are trying to hover and initiating a callback, rather than the built in javascript hover function which initiates a callback instantly. It does this by waiting for the mouse pointer to slow down and assumes “Right, this is the place I need to run my callback!”.

To see it in action, hover over the “New Post” dropdown at the top of the admin page. A better demo however is on the hoverIntent download page which shows you why it’s powerful.

jQuery.color

Next up, we have the jQuery.color plugin which enables you to animate between colors using jQuery. Think transitioning from red to yellow for example. You can see this in action when you hit the “Approve” button on a comment – you will see the background color transition from yellow to white. Lovely!

Whilst we talk about the comments editing page, functionality such as “Quick Edit” is also powered by jQuery events and load animations, as well as integrating ajax calls for a seamless experience.

jQuery UI

If you don’t know what jQuery UI is, its a library that sits on top of jQuery enabling advanced animations and effects. WordPress is using a number of jQuery UI effects in various places which I’ll show you below:

Resizeable

Resizeable does what it says on the tin – it will resize an element based on interaction from the user. A typical example is expanding the size of a box object like the image above. This is being used within the New/Edit Post page enabling you to resize the edit window for your blog post.

Sortable

Sortable is another effect which easily allows the user to perform drag/drop actions on elements to re-sort them. The most obvious demo of this is on the Admin homepage, where you can move the various “portlets” around the page, rearranging them to a view that you prefer. WordPress obviously have to go one step further though and save the new portlet positions to the database so that they are in the same position every time.

Sidebar

The Admin sidebar is another jQuery controlled element. The minimizing and maximizing control as well as the show/hide menu items is all handled. See the postbox.js file for more on this…

HotKeys

HotKeys is a plugin which enables you to register key combinations like CTRL+B or whatever in order to carry out functionality. The most obvious example of this is CTRL+B or CMD+B for Apple to make highlighted text bold. Dead easy to implement, and great from a usability perspective.

Conclusion

That’s it for this article. I hope you enjoyed it, and feel free to give your comments and feedback below on WordPress’s implementation of jQuery, and where you could see improvements.

Resources to help you learn:

Learning jQuery	JQuery In Action	jQuery Reference Guide

So, about 6 weeks ago I wrote about how this blog was going to be my new social experiment. I wanted to see how far I can get simply using social media tools to promote myself, with a few goals outlined:

• Generate RSS subscribers
• Increase Twitter Followers
• Earn some revenue via ads
• Move from Blogger to WordPress

In short, I’ve actually achieved all of those in the past 6 weeks, some more successfully than others – so here’s my learnings and successes so far.

The Stack

So as I mentioned, I have made various changes to the original stack that I had back at the beginning of the year. I’ve moved from Blogger to WordPress self hosted, changed hosts twice (from Go Daddy to Media Temple), added Clicky web analytics to the mix as well as joining the Amazon Affiliate program.

Hosting

So, I originally moved from Blogger to Go Daddy / WordPress self install back in mid January. I did this for greater flexibility, and greater functionality out of the box. I am also a dab hand at PHP so could knock out plugins where I needed them.

What I found with GoDaddy is, whilst they are cheap, they just cannot support you when your blog gets pounded during busy times. I’d still class my numbers as pretty low, yet GoDaddy really suffered when some of my articles were picked up. Their support was fruitless, and when I had a 15 minute outage during peak time, their response 18 hours later was “We can access your url without any issue”. Enough.

Media Temple was recommended by a couple of fellow tweeters. Looking at the shared hosting package, they have some great features, the main one being their Grid Container technology, which allows your database to get some dedicated resources in times of need. They also have dynamic burstability for when your site gets hit with things like the digg effect. Sold @ $20 per month!

Clicky Web Analytics

I’ve previously discussed my love for Clicky web analytics, so I won’t go too much into the detail, however I will say that their real-time stats and Spy technology has really helped me analyse usage hour to hour, and user journeys which has greatly helped the scheduling around promoting my articles.

Clicky have also added this week the ability to create custom goals for items on your blog you wish to track. For example, I have set up two custom goals to track which of the two Twitter link throughs get used the most. Also tracking how successful my call-to-action elements are. I cannot recommend Clicky highly enough!

Amazon Affiliates

I have also added a second revenue stream with the Amazon Affiliates program. However, I am actually pimping books I have read, or know to be valuable for users to learn the technologies I discuss – so they come with my whole-hearted stamp of approval. Early signs are that it looks like it could overtake Adsense for revenue. In the first 3 days of using it, I earned more than I had done with Adsense in 8 weeks – so it’s looking promising. Sales information is updated daily though, around 11.30AM GMT.

Social Media

As part of this process, I have also expanded the avenues where I am promoting my content. Reddit and DZone.com are now on my hitlist to post links to straight away. I haven’t seen much in the way of great progress with Digg, but I continue to try it. Delicious is okay (more on that later in successes), and Twitter goes well when the retweets come piling in.

More on Twitter

At the time of writing my previous article I had the lofty sum of 19 Twitter followers… Times were hard! In the following 6 weeks I’ve had a 940% increase on that! It’s been quite a steady rise other than on one particular day where I got 45 followers (I think that’s a mistake btw). These numbers are all garnered from me advertising my content on Twitter, as well as helping others out in the jQuery / WordPress realm which resulted in follows.

FeedBurner RSS Stats

Looking at the green line, my RSS subscribers have been slowly rising. Not huge numbers yet, Twitter Followers beat it 3:1, but I am making progress with this. I need to focus on how users can subscribe and increase the visibility with better calls-to-action.

Other successes

I’ve had 2 or 3 successful articles over the past 6 weeks. Notably, one hit the number 1 spot on the Delicious Popular links page, which is quite a grand feat. My weekly Alexa rank has hovered around the 80K mark – I am told sub 100K levels are very good? 

Web analytics-wise, the stats are looking pretty nice. Not really in a position to divulge those just yet.

From an Adsense perspective, it’s a bit hit and miss, and actually has no relation to the number of visits you have on your site. I sometimes get the most click throughs and earnings on my quieter days – so don’t get too hung up on it!

Tips for bloggers

Don’t think I really have enough experience for a wealth of tips right now, but new bloggers should really focus on what you’re posting, and how you post it. Market it to the right ears/eyes – don’t focus your flower making blog on ASP.Net developers.

There is also no easy guarenteed win on gaining hits/click throughs. You really need to give quality content to your readers, and market it well. It’s that simple.

Also look to WHEN you market it. Think about your audience, and when they’re likely to want to read your article. I won’t say more than that right now, but you really do need to think about this!

Resources to help you:

Pro Blogger

Complete Guide to Blogging

Blogging For Dummies

WordPress has built in support for Permalinks, so it’s really easy to turn on. Permalinks (for the uninitiated), are links to your articles, however with a more user (and search engine) friendly format. For example, instead of http://www.domain.com/article.php?id=135, you would get http://www.domain.com/2009/02/my-cool-article/.

However, as easy as it is to turn on Permalinks within WordPress, alot of users complain that nothing happened after enabling the feature. Their blog either breaks, or continues to use the horrible id=135 format, which doesn’t help anyone.

Permalinks are actually enabled in something called a .htaccess file. This is an invisible file that sits at the root of your blog domain, where you can put specific configuration information, PHP settings for example or HTTP stuff. Anyway, in this case, WordPress will create a new .htaccess file or edit an existing one and add the following data:

# BEGIN WordPress

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress

We don’t really care what it says there, let’s just assume it does what it’s meant to do. So, WordPress gallantly updates or creates this new file, yet nothing happens. Here’s probably the reason why:

Your hosting provider has a TTL (Time to Live) associated with .htaccess file changes.

What this means is, when your .htaccess file is changed, there is a period of time (could be 60 mins, could be more or less) when those changes are ignored, your old settings or previous .htaccess remains in the cache and is reused. Once the TTL has elapsed, the server will then pick up the changes to your .htaccess file, and everything should be good!

I hope this helps people out who find Permalinks just don’t work. Give it time, they should appear. Also – you may be able to shorten the TTL temporarily with your hosting provider, so this is also an option.

Learn more…

WordPress For Dummies	WordPress Complete	WordPress Plugin Development

Subscribers are solid gold. You need them, and the only way you will get them is if you offer them good content, with a means to subscribe. Enter RSS feeds. RSS is probably one of the most important commodities for any blog. It drives “free” visitors to your content, and allows you to know your messages will be heard at least by some – so it’s all about building up a good base. Maximize the potential and optimize the effectiveness in 6 easy steps…

1) Feed it up!

Don’t just have 1 RSS feed, have many! Have an RSS feed for your comments, your categories, your tags, and even a feed per article. Blogging systems like WordPress just do this, so it’s actually not that hard, but the theory is the more you offer, the more likely you will see subscribers – so do it!

2) Replace your basic RSS feed with Feedburner

FeedBurner is an RSS feed management system with lots of added extras, but mainly RSS subscriber stats. Without it, you’ll find it pretty darn hard to get any useable numbers out of your RSS feeds. Feedburner is also now owned by Google so some sweet integration with Adsense is already in place, however we should hopefully see more integration with Google Analytics this year!

Simply signup over at FeedBurner.com and start “burning” feeds. Instructions on implementation into your blogging system can be found on their site. Once you’ve built up a good subscriber number, you can then start showing off the stats on your site. People are drawn to big numbers… The mentality is, if it’s good enough for them, it’s good enough for me!

3) Use ads to monetize feeds

The jury is still out on this one as to whether or not this is actually effective – from personal experience I haven’t seen any interest via RSS ads, but that hasn’t stopped me from including them! Feedburner has an easy to use feature for ad integration, so again – another good reason to use it.

4) Add social media links

Another no brainer – give the ability to your readers to share your useful article that they have just read and enjoyed at the bottom of each RSS entry. Again, another easy to use FeedBurner feature!

5) Pimp your RSS

Place prominent links to your feeds on your blog on all pages, as well as at the bottom of each post. Give your users every opportunity to subscribe, and keep reminding them to! I’m actually currently breaking this rule – I need to fix that!

6) Send out updates

Some blogs (WordPress for example) include the ability to send out updates to RPC services (You can find this under Tools -> Writing in WordPress admin). This is really helpful because it tells the likes of Google that you have just updated your blog and therefore your RSS, so services like Google Reader should re-index sooner rather than later. Otherwise, your readers are at the mercy of the re-index service so could be waiting hours before they see your content in their RSS reader applications.

Further Reading on this topic…

Developing RSS & Atom	RSS For Dummies	Beginning RSS & Atom

I talk alot to people (mostly via Twitter) about many setup issues in WordPress. People seem to install it, and go “now what?”. Judging from this strange behavior, I am assuming people need a little help, so I’ve put together 10 quick tips on what to do next after you’ve installed WordPress. The rest my friends, is down to your creativity.

1) Remove the admin user account

A complete no brainer for me, but you need to do it immediately. Go ahead and create a duplicate administrator user account with your own username and password. Then remove the admin account. Whilst your at it, go ahead and follow these 10 steps to secure your admin section. 

2) Install a Database Backup Plugin

Austin Matzko’s WordPress Database Backup plugin really needs to get installed. This allows you to setup (under the tools menu) regular emailed database backups, or you can go ahead and run ad-hoc ones there and then. A must for any serious blogger!

3) Turn on Permalinks

Permalinks are really good for search engines and users alike. If you don’t know what they are, here’s what they look like:

All they do is simply take away nasty page names and query string like article.php?ID=3434 which mean nothing to the user, and nothing to search engines. If your host allows it (should do), turn them on under Settings -> Permalinks.

4) Add the latest list of Update Services

Under the Settings -> Writing menu there is an “Update Services” section. This allows you to enter a number of services that you would like to auto notify when you publish an article (like Technorati, or Google Reader for example). You can get an up to date list of suggested ones here.

5) Install Web Analytics

If you want to be able to track the huge numbers of visitors that you’re just about to get, then you need some kind of web analytics software. Two I’ll mention here (although there are many!) are Clicky, and Google Analytics. Briefly, Clicky is great if you’re looking for near realtime stats, as well as Feedburner and Twitter integration. Clicky also has an API if you’re interested in that stuff. Google Analytics is also very good, very user friendly, but stats only refresh every 4-5 hours. A better review of the two is here.

6) Setup Feedburner

If you also want to get stats purely on your RSS feeds (as well as many other cool features), you should setup Feedburner to manage your feeds. I won’t go into it here, but integration wise there is a great Feedburner Plugin which makes implementation into WordPress a doddle.

7) Don’t download 100′s of plugins

You know when you goto a myspace page, and it looks like the circus came to town – lots of flashy banners, videos playing all over the place, music too… That is a person who has no control – and you quickly leave! You are also in danger of doing the same by clogging up your blog with tons of useless widgets that add little to no value. Try and restrain yourself from installing the world of plugins available to you!

Add socialise icons to your posts

If you’re serious about promoting your content, and want to make it as easy as possible for your users to do the same, then you need to add social network links to your blog posts. There are many ways you can do this, but a handly little plugin called Sociable can do this for you in a flash! So do it!

9) Write about something worthwhile

This may come as a surprise to some, but actually writing about something interesting and relevant does actually help! Telling readers that your dog did a poop isn’t exactly gonna make them come back, however telling users how you trained your bullterrier on how to poop in the toilet and then flush is probably gonna get you some readership! Try and use your posts to help others.

10) Don’t expect cash

This was a great question I came across on Twitter last week:

Which is better to make money from, Blogger or WordPress?

Yes, I know – pretty good, but a lot of noobies out there actually think this matters. It doesn’t. It’s not about the quality of the technology that displays your content. It’s all about the quality of the content. If you write about nothing interesting, people won’t read it, and you won’t monetise. It doesn’t matter if you’re on Blogger, WordPress or whatever blogging application!

I hope you found these useful, and please feel free to add your own tips below. I love the feedback!

Further Reading…

WordPress For Dummies	WordPress Complete	WordPress Plugin Development