Security Update: WordPress and Google Both Launch Improvements

Tweet

It’s been a busy week for security buffs as both WordPress and Google Accounts are both receiving major security improvements that their users should definitely scoop up as quickly as possible.

For WordPress users, they need to see about upgrading their installation to version 3.0.5, which fixes several security bugs that are most dangerous to those who have authors with limited permissions on their blog. Google, on the other hand, is slowly rolling out a new two-factor authentication system that may help keep your email and other information more secure.

If you use either or both of these tools, you may want to look at making the needed changes so you can get the full benefit of their security improvements. Otherwise, you’ll likely find that your blog, your email and your other personal information are at greater risk.

WordPress Launches 3.0.5

WordPress users who have a standalone installation of WordPress on their server, will likely want to upgrade to 3.0.5 as soon as possible.

The upgrade addresses several severe security issues including:

1. Two security issues that would have allowed a author or contributor-level user to gain greater access to the site.
2. Another security issue that would have allowed an author-level user to read information they weren’t supposed to access, such as drafts or private posts.
3. Two additional security issues that help secure plugins, especially those that don’t use WordPress’ built-in security API.

Obviously, if you don’t have author or contributor-level users or don’t use many plugins, there is less urgency in this upgrade but, considering it is a free update and takes only minutes to install automatically, it’s well worth going ahead and upgrading.

At the same time as WordPress 3.0.5′s release, Automattic also announced the release of the fourth release candidate for the WordPress 3.1 branch. This release deals mostly mostly small bugs that were found in the third release candidate and marks a clear sign that the 3.1 branch is very near completion and should be sent out to the masses very shortly.

Google Introduces Two Factor Authentication

For users of Blogger, or even just Gmail or other Google tools, Google is rolling out two-factor authentication to help make your Google account more secure.

The basic principle is that, instead of merely having your email address and password to log into your Google account, you also have to enter a second, numerical passcode. This code is always changing and is sent to the user every login via either text message or the “Google Authenticator” app that is available for the iPhone, Android and BlackBerry.

Since this number changes regularly, it makes it much more difficult for someone to phish your password and anyone who wishes to enter your acount without authorization has to have access to your email address, password and your phone, making the process significantly more difficult.

Two-factor authentication is hardly new, PayPal has been using a security key system for years and many corporations and government agencies have required other kinds of security tokens for even longer.

But despite their history, security tokens have not gained widespread usage due to the perceived hassle (both in setting them up and using them) and the fact many don’t wish to either use text messages or to purchase keychains or cards to keep around. This has limited the application to high-risk targets such as banks, corporations and so forth.

Fortunately, Google’s system is free for anyone with a smartphone or with an unlimited text messaging plan and, as such, may mark the beginning of widespread usage for more personal targets.

As incidents like the Gawker leak have shown us, passwords are very vulnerable to being leaked, guessed or stolen, making a second layer of authentication very important for critical data.

Right now, systems such as Google’s are the best available and will likely become more common over the next few years.

Bottom Line

If you value your data, your privacy and your site, then you need to take security seriously. Fortunately, both Google and the WordPress development team are both working to help make security easier and better.

If you use either of these products, take a moment and upgrade your sites and your password security. You’ll be glad that you did.

While these steps may not secure you completely, that’s because nothing really can. They will, however, make you a much more difficult target and motivate attackers to move on to other, easier targets.

Related Articles

• 20 Free WordPress Themes from 2010
• The Ultimate Blogging Theme 3.0
• How to Stop Procrastinating and Get Your eBook Written
• “Make Money Online” with the Ultimate Blogging Theme 3.0
• How to Make Your Blog Pay the Bills [Bootcamp for Bloggers Starts Soon]

How to Troubleshoot WordPress

This guest post was written by Neil Matthews, a WordPress consultant at WPDude.

Over the years, I’ve developed a troubleshooting methodology while working with my WordPress technical support clients.  My methodology helps  to solve the majority of WordPress crashed sites I’ve come across, and I wanted to share it with you, the good readers of ProBlogger.

I cannot claim that I invented the process, but I have brought together a number of useful tips from the WP community and combined them to create a repeatable and verifiable way to isolate and troubleshoot WordPress problems.

The process

This methodology isolates the various layers of a WordPress site one at a time, tests a layer by removing its component parts, and then, if the problem still exists, moves down to test the next layer.

Once you have isolated the problematic component, you can remove it from your site and troubleshoot the problem itself.

I recommend doing this in a slow and ordered manner, incrementally testing each layer as you go. Look at a layer, disable all of the components, and slowly restart them to find out where the problem lies.

The layers

I like to divide WordPress into four layers:

• plugins
• theme
• WordPress core
• database.

This methodology looks at the first three layers only.

What can this process fix?

This methodology can be used to fix a variety of WordPress issues including, bit not limited to:

• the dreaded “white screen of death” where all you can see is a white screen and nothing else
• “Header Already Sent” errors
• “Fatal Plugin” errors
• “Out of Memory” errors
• …many other WordPress problems, too.

Back up first

Even if your site has crashed, it’s important to stop, take a moment, and back up your site as it is now.  You are about to embark on a journey which will make a lot of changes to your site.  Taking a backup of the site as it stands means you can fall back to your starting position if you need to, without making the situation any worse.

Troubleshooting plugins

I always start at the plugin layer when I’m troubleshooting a WordPress problem. In my experience, about 80-90% of system crashes are caused by plugin issues. This is because there are so many plugins (sometimes of questionable coding quality) available to WordPress site owners.  Combining these plugins with other plugins, themes, and WordPress itself creates an untested mix that can very easily crash your site.

This is how I troubleshoot plugins:

1. Disable all plugins.
2. Has the problem gone? If it has, you have an issue at the plugin layer, if not, move down to next layer the theme.
3. Re-activate plugins one at a time.
4. Test your site after each reactivation. Has the problem returned? If so, you have now found the suspect plugin: go to point 5. If not, rinse and repeat from point 3.
5. Disable that plugin.
6. Re-activate the other plugins to ensure you don’t have multiple plugin problems.
7. If the problem is still cleared, you have isolated and remove the problem. Go to the Getting Support section below.

Sometimes plugins cause such a problem that when you try to log into the dashboard to disable them, all you get is the same error message. If you cannot log into the dashboard, all is not lost: I have a work-around for you.

What you need to do is connect to your site via FTP and navigate to the wp-content folder.  If you rename the plugins directory, to plugins_temp for example, WordPress no longer knows where the plugin files are, and stops running them.  Now if you try to log in to the site, you’ll find that the issue has probably gone.

If you then proceed to the Plugins section in your Dashboard, you will see an error message that the plugin files cannot be found and have been disabled. Rename plugins_temp and you plugin files will be available again. Now, incrementally start from point 2 above to see which one caused the problem.

Troubleshooting themes

Once you have tested the plugins to rule them out, you need to move down a layer to the theme. This is how I troubleshoot themes:

1. Disable the current theme.
2. Activate a default theme such as Twenty ten.
3. Test. If the problem has gone, you know the theme is causing issues. If not, move down to the WordPress core layer.
4. Re-activate all of the plugins individually to make sure there is not a composite problem. If the problem doesn’t recur, you’ve isolated the theme as the problem area.

Next, I’d try to rule out any changes I’d made to the theme by removing any code I had recently added. If I have updated the theme, I’d roll back to a previous version. If I have just added a new widget, I’d try to back this out.  As you can see, the process is all about back-tracking methodically so you can repair the issue.

Again, if you cannot log into the dashboard there is a work-around. Connect to your site via FTP, and navigate to the wp-content/themes directory. If you now rename your currently live theme directory to themdir_temp for example, WordPress won’t know where the theme files are. All you’ll see at the front end is a white screen, but the dashboard will be available. Go to point 2 above and activate a default theme.  Remember to change the name of themedir_temp back to themedir to help troubleshooting.

Troubleshooting WordPress Core Files

The last layer to check are your WordPress core files.  This is the last layer because it is the least problematic, but I have seen incidents where files have become corrupt, stopping WordPress from working correctly.  The easiest way to troubleshoot WordPress core files is to re-install a clean copy.

This is my process for troubleshooting WordPress core files:

1. Download a clean version of WordPress from http://wordpress.org/download/.
2. Connect to your site via FTP.
3. Rename wp-admin and wp-includes to ensure you are uploading clean copies of these directories.
4. Back up wp-config.php just in case. This files holds your database connection details (amongst other things).
5. Upload your clean version of WordPress.
6. Test. Is your issue fixed? If so, you have isolated the problem at WordPress core. If not, it’s time to call in the experts.
7. Re-activate your theme and test it.
8. Re-activate your plugins and test them.

Fixing the component

At this point, you have hopefully isolated the component of your site that was causing issues.  So what do you do now?  Here are your options:

• Visit the plugin or theme developers’ site and check to see if they have a support forum to search or request support from. Any developer worth his or her salt will be only too happy to provide support, and premium plugins and themes should provide top-class support as part of your fee. Remember to be nice to them if it’s a free theme or plugin and they don’t reply in five minutes.
• Find a replacement for the plugin or theme. There is usually more than one implementation of a plugin, so if you can, swap out the problematic plugin with another one.
• Request some support from http://wordpress.org/support/. This is excellent for core WordPress problems, and you will often find forums for individual plugins there, too.
• Set the social media monster to work on your problem. Sometimes it’s as easy as sending out a tweet to your network to find a solution to the problem.
• Get the pros in—hire a WordPress technical support team or consultant to solve your problem.

Wrap up

I use this methodology on a daily basis—it’s proven in the field on crashed sites.  The key is to methodically work through the layers, eliminating as you go, until you find the root cause. Then, fix that issue.  Remember to constantly test, though, because sometimes there are composite problems with multiple plugins, or the theme and a plugin.

Do you have any WordPress bug horror stories you can share? Who solves your site’s bugs and problems—is it you?

Neil provides WordPress technical support services at WPDude.com. He has also created a mini video course on this methodology over at wptroubleshooting.com.

Related Articles

• 20 Free WordPress Themes from 2010
• The Ultimate Blogging Theme 3.0
• “Make Money Online” with the Ultimate Blogging Theme 3.0

How to Ajaxify Your WordPress Site

This guest post is by Jeff Starr, co-author of the book Digging into WordPress.

Injecting a dose of Ajax into your WordPress-powered site is an excellent way to enhance functionality and streamline the user experience. Without touching a line of code, you can harness the power of Ajax to boost performance, improve usability, and fill your site with win.

Ajax enables your web pages to respond very quickly and smoothly to user input by loading only snippets of data instead of the entire page. The WordPress login/registration screen is a perfect example. Without Ajax, logging into the WordPress Admin requires a URL redirection and complete page load. With Ajax, users can log in from anywhere with no redirection or page load required. This translates into a more luxurious, sophisticated experience for you and your users.

Beyond the “coolness” factor, Ajax can also improve the responsiveness and performance of your site. Instead of loading new pages to leave comments, view posts, and share content, Ajax empowers users to interact with your site with greater intimacy and efficiency than ever before. By eliminating page loads, Ajax helps to save valuable server resources and bandwidth, resulting in improved performance for your site. And you can “ajaxify” just about anything: from logins and comments to navigation and updates, Ajax can speed things up, save resources, and make your site better than ever.

WordPress + Ajax = Awesome

Using WordPress, implementing Ajax functionality couldn’t be easier. By installing and configuring a few choice plugins, you can ajaxify your entire site (or any part of it) without touching a single line of code. The trick is choosing only the best plugins for your site, and only what’s needed. There are a zillion Ajax plugins available, but only a handful of them really work as advertised (or at all). Let’s check out some of the best WordPress plugins for adding Ajax to your site from within the comfort of the WordPress Admin.

• Ajax plugins for WordPress comments
• Ajax plugins for user login and registration
• Ajax plugins for the WordPress Admin area
• Ajax plugins for other cool stuff
• Ajax plugins to ajaxify everything
• SEO considerations for ajaxed content

Ajax plugins for WordPress comments

A majority of the Ajax plugins listed in the Plugin Directory are aimed at improving the commenting system. Here are five of the best plug-n-play Ajax plugins for your WordPress comments area:

• WP-Comment-Master: Put simply, WP-Comment-Master ajaxifies the entire commenting system: comment display, comment paging, comment submission, and posting. It features a great Settings page for easy integration and configuration and is definitely one of the best Ajax-comment plugins available.
• iF AJAX Comments For WordPress: Another excellent plugin for ajaxifying the comment-submission process. iF AJAX Comments enables users to preview and post their comments without refreshing the page. It includes a ton of options for fine-tuning required fields, CSS styling, status messages, and more. It also features a host whitelist for tighter security.
• AJAX Comment Page: AJAX Comment Page is a nice little plugin that ajaxifies the display of your comments with a fancy slide-in effect. It works great for paged or unpaged comments and includes a simple Settings page to control the number of comments per page.
• Ajax Comment Preview: So far, this is the best plugin I’ve found for true comment previews. Ajax Comment Preview enables your users to see exactly what their comments will look like when submitted. This plugin uses Ajax to send the preview through WordPress’ “inner voodoo” and then instantly display the results. The plugin features a nice Settings page to control functionality and integrate the comment preview with your design.
• AJAX Report Comments: One of my favorite Ajax plugins, Ajax Report Comments enables your visitors to report inappropriate comments with a single click. The Admin page includes basic settings and an email template. This plugin offers truly tight functionality and amust-have for sites with tons of user comments.

Ajax plugins for user login and registration

Ajax can literally revolutionize the user login/registration/lost-password experience. Instead of requiring multiple clicks and page loads to log into the Admin, here are three plugins that ajaxify the entire process into a single click.

• Login With Ajax: Login With Ajax is a popular, well-ranked plugin (it has over 45K downloads). It enables users to log in, register, and recover lost passwords from the sidebar (via widget) or anywhere in your theme (via the login_with_ajax() template tag). It features a great Settings page with role-specific redirects and custom registration email templates.
• iRedlof Ajax Login: Much more than a login widget, iRedlof Ajax Login adds a complete user dashboard to the top of the screen. The dashboard is pre-styled and includes complete login functionality as well as links to random posts and admin menus personalized to each user according to their role. Downsides: there’s no Settings page, and you need to add updateHeader() to your theme template.
• AJAX Login Widget++: Another good plugin for Ajax-powered login, registration, and password functionality, this one also features login redirect. The login form can be placed in your sidebar with a widget, or anywhere else with add_ajax_login_widget().

Ajax plugins for the WordPress Admin area

On the other side of WordPress, the Admin area is another excellent place to enjoy the smooth and sophisticated comforts of Ajax. Unfortunately there aren’t quite as many Ajax-based Admin plugins to choose from, but here two that are both fun and useful.

• Ajax Plugin Helper: It’s simple: save time while keeping up with WordPress plugin updates. Ajax Plugin Helper lets you activate, deactivate, delete, and upgrade plugins without leaving the Plugins page. Very smooth stuff, and there’s even an “Upgrade All” feature for knocking out multiple upgrades with a single click! Nice.
• Admin Ajax Note: Ever wish you could leave notes and stuff for other admin users? Admin Ajax Note makes it easy with an Ajax-powered notepad in the upper-right corner of the Admin area. Create, edit, and delete as many notes as you want, and share with all users, one user, or none. Good stuff.

These two plugins are great, but it would awesome to add more to the list. If you know of any sweet Ajax Admin plugins, please share them in the comments!

Ajax plugins for other cool stuff

Here are some other keen plugins for ajaxifying different parts of your WordPress site:

• DynamicWP Contact Form: The DynamicWP Contact Form puts a floating Contact button on the upper-left side of the page. Click the button and the dynamic contact form slides into view. Messages are sent via Ajax to keep the user on the same page throughout the process. Snazzy indeed, but the styling is distinct and may need to be tweaked to fit your design.
• AJAX Calendar: An ajaxified version of the classic WordPress calendar, AJAX Calendar enables you to browse the months without reloading the page. It features a link to display all posts for the current month, as well as a caching option to enhance performance. If you’re already using the classic WP calendar, this plugin is highly recommended.
• Ajax Category Posts Dropdown: This plugin is perfect for sites with lots of subcategories. Ajax Category Posts Dropdown lists your categories in a dropdown box. When a user clicks on a category, all posts from that category are displayed via Ajax. Easily display the list in your sidebar via widget, or anywhere in your theme via the acpd_display($acdp_title) template tag.

Ajax plugins to ajaxify everything

One of the coolest things to ajaxify is your WordPress navigation, so that when users click to the next post, it’s loaded instantly and on the same page, without a reload. Here are two awesome plugins that use Ajax to load posts, pages, comments, and archives to basically ajaxify all default functionality on the public side of your WordPress site.

• Ajax For All [Demo]
• AJAXed WordPress [Screenshots]

As with any plugin that greatly modifies WordPress, these plugins involve a lot of options. You’ll need to spend some time to understand and configure them properly. Most of the other plugins mentioned so far are plug-n-play, but Ajax-everything plugins like these require some time to familiarize and customize.

SEO considerations for ajaxed content

As you ajaxify your site, keep in mind that search engines aren’t yet crawling or indexing ajaxed data, so make sure you’re enabling Google et al to find your content. There are numerous solutions to this challenge, the easiest of which involves the use of a well-linked sitemap and actual HTML content delivered via noscript tags.

Also consider SEO when ajaxifying your comments. User comments add content to your web pages, but they won’t be crawled, indexed, or considered in page rank if they’re served with Ajax. For many sites, this shouldn’t be too big a deal, but it is something to think about.

For more information on Ajax and SEO, check out Scott Allen’s article, AJAX, Web 2.0 and SEO.

Wrapping up

These are the Ajax gems that I’ve managed to find, but many other great plugins are available. If you know of any good WordPress Ajax plugins (or themes!), please share them in the comments. Thanks!

Jeff Starr is a web developer, graphic designer and content producer with over 10 years of experience and a passion for quality and detail. Jeff is co-author of the book Digging into WordPress and strives to help people be the best they can be on the Web. Read more from Jeff at Perishable Press or hire him at Monzilla Media.

Related Articles

• 20 Free WordPress Themes from 2010
• How do You “Subscribe” to a Site?
• Why Professional Writers Need a Blog. Or Not.
• “Make Money Online” with the Ultimate Blogging Theme 3.0
• You Need to Make Sacrifices to Make it as a Blogger

Adsense Ready Wordpress Themes

Mention Google Adsense to anyone that is making decent money online, and they will probably have something negative to say about it. It’s true… Adsense doesn’t get the love it deserves. As much as everyone loves to hate on the thought of running Google Adsense on their site and losing site visitors for pennies, Google Adsense did help pave the way to online advertising and affiliate marketing. It’s also safe to say, Google Adsense is the “easiest” way to make money with a web site.

Not only is Google Adsense the easiest way for anyone to make money with an established web site, but it’s also become a huge favorite in the blogging space. The thing about blogging, is so many people are blogging simply to blog, not many people are blogging for money or know how to make money. It’s easy enough for a blogger to copy and paste a code and maybe make a few bucks with Google Adsense.

One the other hand, making blogs that are strictly used for building tight niche sites and monetizing them with Google Adsense is another issue. There are literally billions of different tight niche sites that you could build a mini blog about and make a few dollars a day to a few hundred dollars a day (using Google Adsense) if you get indexed into Google, have decent content and the necessary backlinks.

Whether you are just looking for a new blog theme and would like to try out Google Adsense, or you want to take a stab at the mini blog / Google Adsense game, I’ve compiled a list of the top Adsense Ready Wordpress Themes available around the web. All of the themes I have listed here are free to download, and I’ve also listed a few other useful resource sites at the bottom.

Golod Adsense Ready Theme:
A 3 column AdSense ready theme, which leaves a lot of room for customization and improvement with it’s header, social widgets and right/left columns.

Live Demo | Download | Template Home

Prosense Adsense Ready Theme:
A very simplistic 3 column AdSense ready theme that comes in three different colors. Easy user navigation and not forcing Adsense down the user’s throat, makes this a good choice among other Adsense ready themes.

ProSense | Download Prosense | ProSense Gray | ProSense Blue

Blueiz Adsense Ready Theme:
A simple design with a 2-3 column layout, but the proper ad placement and content, it won’t look like your typical bland Adsense ready theme.

Live Demo | Download

Monetizing the Web Adsense Ready Theme:
A very clean design which blends content and Adsense nicely. Leaderboard, skyscraper, regular banner ads and and content area Adsense spot all availalbe with this theme.

Live Demo | Download | Template Home

SEOMaxAds Adsense Ready Theme:
This theme pack comes with 16 different themes for Google Adsense monetization. From the screen shot below you can clearly see how monetized the site is for Adsense placement as it’s right in the users face.

Live Demo | Download

Other Adsense Ready Wordpress Theme Sources

42 Adsense Ready Wordpress Themes Optimized For Monetization

18 Adsense Optimized Wordpress Themes to Maximize your Contextual Ad Earnings

The Ultimate List Of Adsense Ready WordPress Themes

There is actually a large amount of Adsense Ready wordpress themes out there, but the few I selected have the best layouts and color schemes. If you know how to code a bit, you can easily download any of these themes and throw together a decent looking blog, but keeping the same Google Adsense concept in mind.

Related Articles

• 20 Free WordPress Themes from 2010
• Socrates Theme – The Easiest Way To Create Niche WordPress Blogs
• The Ultimate Blogging Theme 3.0
• Blogosphere Trends + Choosing and Using Images
• What If You Couldn’t Blog?

Highlight Your Blog Content and Increase Comments

One of the biggest factors for the success of a blog, is how many comments you can average per post. It's not all about what you have to say, but how other interact and leave their feedback as well. A new wordpress plugin called "Highligher", allows you to highlight any content and on a blog and leave a comment on it.

You can see the plugin in action on the screenshot below from the Highlighter.com web site. Also, congrats to the UBD team for securing such an awesome domain name... wonder what they paid for it!

The "Highlighter" wordpress plugin is free to download. In addition to leaving comments, you can also share via Facebook, Twitter and through Email. I currently have this plugin enabled on the blog for a few days for everyone to test out and see how it works. Simply highlight any text on this page and the plugin will show what options you have, which are to leave a comment or share with others. It's a pretty cool concept, but I think it would take a lot of training and awareness to get blog readers to catch on to the concept.

Once you download the Highlighter plugin, you have a lot of customization and settings which can easily be accessed through Wordpress. There is also some features for adding to your mailing lists through Aweber and other providers, managing comments and ways to change the highlight colors, look and feel. Unique Blog Designs is also running a promotion where you can win a free Apple iPad if you just blog about their latest plugin.

Download Highlighter Plugin.

Related Articles

• How Cornerstone Content Gets You Traffic and Subscribers
• Blogosphere Trends – What Bloggers Are Writing About This Week
• Best Tools to Promote Your Blog
• My Interview with Six Figure Affiliate Blogging
• Blogosphere Trends + Choosing and Using Images