WordPress "Must-Use" Tutorials» ideas

Risk management

andrea — Tue, 20 Sep 2011 14:27:11 +0000

Last summer, I had company visiting from England. My cousin Mike works as a risk analyst and security specialist for a large firm in the UK that has some high-profile clients – including government. Naturally, I asked him some relevant questions about web servers, WordPress, hackers and other fun stuff like that. (We refrained from having the conversation over dinner though.) I will say it was nice to talk to a family member who not only know what WordPress is, but is familiar with servers and hardware infrastructures.

So I not only got a quick overview of how analyze the risk and likelihood of different scenarios, I got to spend some quality family time not in front of the computer. Win/win. It also benefits you to, dear reader, because I got to discuss WordPress-specific and server specific security with someone fully versed in calculating the likelihood of hackers wrecking havoc on your site.

The added bonus is a client also emailed me some security questions right around the same time, so I took those two hints to write a post about security and hopefully allay some fears.

There are fairly standard and common procedures for securing WordPress. Our buddy Brad Williams frequently talks about security at various WordCamps. All his tips are excellent.

It also has less vulnerabilites that many other popular softwares on your server.

So, that takes care of WordPress. Many people stop there and think they are covered.

But you’re not.

You still have to secure the server itself. Most times, a good webhost will have this taken care of, but a recent spate of attacks targeting WordPress and other php-based applications exposed a few hosts who got sloppy.

Note that targeting WordPress is not the same as hacking WordPress. In the above cases, the servers themselves were compromised, and the hackers had access to the file system or database. If they can get to your files the same way you do, those files are toast – no matter how secured.

In a couple cases I have heard of, the person’s local home computer had a virus that lifted their ftp passwords and transfered hacked files to the webserver.

Clearly, the risk here isn’t WordPress. Making sure you have correct file & folder permissions is definitely step one, and a step up from that is folder ownership. The other is making sure that any program on the server – phpmyadmin or database management tools, centos and other operating systems, cpanel or other account management tools – is also updated to the latest. Outmoded versions of php are also a larger risk.

Not to put too fine a point on it, if you’re obsessing over WordPress secirty and ignore the server itself, you’ve locked all the windows and left the front door open.

Specifically to running a network, if a user account gets hacked, they can do far less damage (if anything) than if they’d hacked the ftp password. And it’s too easy to crack many of the common ftp programs. Your ftp password is transferred in plain text across the internet. Somene who breaks into your network is already prevented from editing files in the backend. They’d have to be a Super Admin to do that, so they’d need to crack yet another password. If you’re not using the “admin” username, put it on the banned list of names as I’ve seen hackers try and register with that name, or give it a super hard and secure password.

Consider I talked to a site owner recently who was unable to upgrade WordPress or much of anything else because their host hadn’t scheduled updates for php yet – it was troubling. I strongly suggested they find a new host.

Check out WPeBooks.com for multisite plugins & ebooks.

Feed enhanced by Better Feed from Ozh

From the archives – building a better blog host series

andrea — Mon, 14 Feb 2011 14:05:55 +0000

A way back in the days of WordPress mu, I wrote a series of posts helping new users to plan out and really think about their network they were setting up. Almost all of the information is still applicable and still useful, so here’s a recap for your elucidation.

Building a better blog host: Week 1 The first week walks you through the basic understanding of how the whole platform works and encourages you to make your plans. It also talks about install and setup.

Building a better blog host: Week 2 – the front page In the second installment I walked readers through setting up the front page, using the previous version of wordpress.com as my example.

Week #3 Build a better blog site – User themes and pluginsThis week’s installment dealt with explaining how themes and plugins work in a wpmu and multisite environment. The addition of “network activate” hadn’t happened, but the rest applies.

Building a Better Blog host: Week 4, the SEO and stats edition always a hot topic, I covered SEO and how it applies to a network, and I also talked about stats.

Build A Better Blog Host Week 5 – Security And lastly, I covered security in week 5.

So, what do you think? Is it time for an update? Is there a section I missed or one I could add now that we are light years away? Or was most of the past advice still really relevant?

What would you like to see me cover next?

© andrea for WordPress "Must-Use" Tutorials, 2011. | Permalink | 7 comments | Add to del.icio.us
Post tags: advice, build a better blog, how to, set up, wordpressmu, wpmu

Check out WPeBooks.com for multisite plugins & ebooks.

Feed enhanced by Better Feed from Ozh

Should you use WPMU?

andrea — Thu, 07 Jan 2010 19:01:37 +0000

With news of the merge of the WordPress & WordPressMU codebase becoming more widespread, one of the questions I get asked with increasing frequency is should someone start a new site based on MU or should they wait for the merge.

My answer? It depends.

Is it time-critical? Do you need it up and running sooner rather than later? Is it income-generating? I spoke to someone earlier this week who is building out their MU-based site now because as they so succinctly put it, “I’m not leaving 3 months income on the table.”

And that’s how long it ~~will~~ may take to be out in the wild. Can you afford to wait three months? Only you (or your client) can answer that.

Also, if you are planning a project based on Buddypress and were waiting for the merge so you could use it on single WordPress, I mentioned over a week ago that this improvement is already in the trunk of BP. It is tentatively slated for release at the end of January, so if that was what you were waiting for, I would start development on trunk now.

Other people I have spoken to expressed concern over being able to upgrade from WPMU to WP when 3.0 comes out. This is one of the major priorities for the devs, and I have found historically the devs were always quite good in making sure core code (and new changes) were upgradeable. They want your site to upgrade and succeed too.

EDIT: Although I said three months up above, the actual release date has yet to be determined. The length of time is an educated guesstimate, not a firm thing. It was stated for illustrative purposes for how long you may have to wait.

© andrea for WordPress "Must-Use" Tutorials, 2010. | Permalink | 10 comments | Add to del.icio.us
Post tags: client work, development, merge, new sites

Check out WPeBooks.com for multisite plugins & ebooks.

Feed enhanced by Better Feed from Ozh

Mixing mapped domains and sites

andrea — Tue, 03 Nov 2009 18:50:28 +0000

As you may already know, this blog is a domain mapped blog on a WPMU site. So is ronandandrea.com, our consulting site. It’s very handy to login with the same username, and only have one codebase to deal with.

We do have other domains, client sites, & sites under dev on the install, but I’ll leave it at those two for the mentions for now.

One question I get asked is if you can use the domain mapping and multi site plugins together on one install. Sure you can! In fact, some of our time was taken up recently by moving my personal blog which has over three thousand posts, and my mom’s blog, which also had a number of posts and attachments. Both of these were separate WordPress installs in the same server, both in subfolders.

A quick overview:

backups. Lots and lots of backups. I backed up both databases, both wp-content folders from both sites. I also grabbed Export files from the backend using the Advanced Export plugin, because like I said above, there was a LOT of content.
since I was already a user on the new system, I didn’t have to add myself.
made a new Site in WPMU
since the old site was live with traffic, and the new site needed a LOT of work that was going to be done here & there, I added a record to my computer’s hosts file to the IP of the new site. This means that after adding the Site in MU, the only person who could see it, access it, or even know about it was me. Each time I needed to go back to the old site for something, I had to un-do that hosts file edit. I tried to plan accordingly and do things in batches.
I imported the main site domain’s posts first. We had some technical issues with uploads, so we wound up using the database backup. Good thing we’d already done this! While we were in the SQL, we cleaned out post revisions, spam comments and tables from plugins long since deleted. I like to use an interface, so I imported the entire database into a local copy of phpmyadmin. I was able to rename the database tables under the operations tab when browsing each table. Ron ran through the database changing the image upload paths, because we knew they’d change. He also imported these new tables into the new site, replacing the empty ones.
I then checked the blog. Sure it had the default theme, but everything was now there. I moved over the themes and plugins, skipping the ones already in the new install. I did the other blog’s themes & plugins folders at the same time, since I was already logged in to the server via ssh. It was much more efficient to transfer large amounts of data this way, from one server to another.
Once my blog was up and running, we did the same database changes to my mom’s blog. On the new site, I added her blog from the backend so we’d know what the blog ID would be. once again, I double-checked everything.
when all seemed moved over, I went to my domain registrar and changed the DNS records to point to the new site and went to bed. in the morning, after making sure my local hosts file was adjusted to show me the live site, I checked to make sure it really was live on the new site – and it was!

My old blog was installed in a subfolder called ‘blog’ with the index file of the site calling in wp_head. This time, it’s technically the “main” blog, but to maintain links, I changed the setting under Settings -> Reading to show a different page on the front and to use the “Blogs” page to show the posts. The only extra I did was make a blank Page called blog. I still want to make a home.php page for my template to let visitors to the main domain know about other blogs under AtypicaLife.net.

Now I can add new blogs to my second site with a click of a button. The signups are closed to the public, but since some of my family members were already users, or newly added, I’ve allowed them to set up new blogs as well. Since then, we’ve started one for my oldest daughter to relate her tales from her first year at college, a group blog with recipes, and there are plans for a genealogy blog for my uncle and mom. This way, users of one blog don’t interfere with the management of another blog. I could have had a multi-author blog and strict categories, but this saves user from accidentally posting to the wrong area. They also have their own space and can change themes and play with plugins and widgets all they like.

Yes, this was quite a bit of work to get moved over, partly because of the established blogs. But? It has been SO worth it. The amount of time doing this would still be less than maintaining half a dozen separate installs of WordPress.

I’ll be going over this in detail at one of my sessions at WordCamp New York. Will I see you there?

Check out WPeBooks.com for multisite plugins & ebooks.

Feed enhanced by Better Feed from Ozh

Anatomy of a home page: WordPress.com

andrea — Sat, 06 Dec 2008 17:32:11 +0000

Many people have big dreams when planning their WPMU-based site, and want to be the next WordPress.com. I see a lot of requests for how to make a home page like theirs, but I don’t think you should copy anyone’s site outright. You can, however, be inspired by them. A lot of successful wordpressmu-based sites have common features on their homepage, and today I hope to go over the one we all know best.

Let’s look at a recent screenshot of WordPress.com’s home page and see the elements included. I’ll follow-up with an explanation of where the find the various plugins and tools to achieve the same functionality (where possible).
(...)
Read the rest of Anatomy of a home page: WordPress.com (748 words)

Check out WPeBooks.com for multisite plugins & ebooks.

Feed enhanced by Better Feed from Ozh

What’s On Your Front Page?

admin — Fri, 17 Oct 2008 19:27:30 +0000

Yes, I know I’m supposed to be writing more tutorials. Been kind of busy with real life, medical concerns and some other stuff. I’m actually writing today a personal rant and I have to admit that it’s really an opinion piece.

I’m trying to figure out why WordPress MultiUser site admins place adverts on their home pages of their sites. To me, this makes no sense what so ever. The purpose of the front page is to draw the casual visitor into the site, not send them away. There are tons of threads on the mu support forums asking how to list the most recent posts, what blogs have been updated recently and those posts or blogs that admins want to highlight. Those lists are there hoping to draw in the visitor into their site to see what folks are writing about. But yet seems like nearly every mu install I look at, there’s an advert up there hoping to earn a few cents for the admin.

Now I don’t have a problem with adverts. We all know something has to pay the bucks when it comes to servers and bandwidth and your time that you invest into the site. I just personally feel that this isn’t the way to go though. Sure, let’s put adverts on the sitewide tag pages or display them to folks coming in from the search engines. I don’t have a problem with that and considering that those types of views and clicks earn better than the average click, I say go for it. But when I have a random visitor drops onto the front page of my mu install, I want to draw them in, not send them elsewhere.

Take a look at WalMart for example. Sure, there’s a banner currently for Always Infinity across the top of the site and another one embedded within the content. But what happens when you click on the advert? Instead of getting sent to another site, it drops you into a page within the WalMart site.

Home Depot as a rotating image banner highlighting sales on their site. Ditto with Starbucks.

Would you rather have those few extra pennies or a decent blogger who may earn you more down the road?

Just a thought.
-drmike

Check out WPeBooks.com for multisite plugins & ebooks.

Feed enhanced by Better Feed from Ozh

Who’s your MU Buddy?

admin — Thu, 02 Oct 2008 22:20:35 +0000

I was going to write this article later on in the series but as I’m sure you all know, sometimes real life throws you a curve. Sometimes you wind up away from the computer for the entire day. Sometimes you have a doctor’s appointment that winds up taking the entire day. Sometimes one of your kids gets sent home with a high fever. How about a planned vacation with the family for a few days or a week or more. And sometimes you get talked into spending seven hours painting an inner city church for a couple slices of cold pizza and a warm soda.

Let’s be honest. Running a WordPress MultiUser site takes a good amount of your time. For those who put an honest effort into setting theirs up and watching over it, it’s not something that one can throw up and forget about it. There’s checking for updates, answering support questions, testing, reviewing for security problems, looking into new features, and much more. It’s not a 24/7 job but there are those folks out there that pretty much work full time if not more on their sites. There’s even folks that for them, mu is their full time job.

But what to do when real life pulls you away. Sometimes it’s planned well in advanced. Sometimes it gets dropped into your lap with only a few moments notice. And sometimes a well meaning minister walks up to you and says “Hey, how would you like to help paint my church for me?”

On the Internet, you have what’s known as peer agreements. What they are is agreements between two or more companies where if one company has a problem of some sort, the other company fills in. Usually you see these types of agreements with backbone carriers. For example, let’s say that a company like Time Warner is having a problem with one of their backbones. Per their agreement with another company like Covad, they can go to them and request assistance. Covad would share their backbone with Time Warner until the problem was resolved. And if Covad down the road had an issue, Time Warner would return the favor.

Local newspapers have these types of agreements as well. Here in Charlotte, when the Observer has an issue with their presses, the local USAToday distributor helps out. That seems to happen about once a month it seems. The next day, the Observer runs this full page with a picture of the USAToday’s print gang thanking them for their effort and going on about how wonderful those folks are. Never seems to be that flattering of a picture though…

Most of our WordPress MultiUser installs have these types of agreements with each other. They cover for each other in case of need. A lot of the folks running MU installs on the net seem to be one man or woman operations. If something was to happen to the site administrator, without this type of agreement, there would be no one in place to back up the administrator.

Now I’m not saying that this arrangement should be used each and every day. We’ve had folks try that over on my servers. That doesn’t go over too well and folk’s feelings get hurt quite quickly. But in the case of a real emergency, it’s a blessing.

The level of access depends on how well you trust these folks. Best bet would be an agreement in place just to answer an occasional question or watch over the forums would probably be best in case of emergency or if you should happen to disappear for a bit. If you know the other person well, more access such as file level may be considered. Granted they could screw up something important on your site but you would have the same access to do that same to theirs.

What happens if you don’t have this in place if you finally get to take that week long vacation? Would forum threads be answered? What if someone finds a bug in a popular theme that makes it unusable? How about a security problem? A comment spam run or some bot setting up ten thousand splogs within a hour? What kind of mess would you find waiting for you when you got back from your week off?

Just something to think about.
-drmike

Check out WPeBooks.com for multisite plugins & ebooks.

Feed enhanced by Better Feed from Ozh

The Road to Well-Mu

admin — Sun, 28 Sep 2008 18:14:10 +0000

A while back, Andrea put out a call for folks to pitch in and help out with her site, wpmututorials.com, by writing articles and tutorials. She especially nagged, poked, prodded, and bribed (Double chocolate brownies please. No nuts.) those who had put in the time and effort to build successful sites.

During the next few weeks, I’ll be setting up the Cynix blogging site. Right now, it’s just a basic shell with the WordPress Multiuser software uploaded and installed. Not much there, right? With the permission of the site owners, we’ll be walking through each and hopefully every step of the creation of the site. We’ll cover the planning of the site, choosing what plugins to use, how to write documentation, determining what features and/or concepts may work best for your site, and how to build it to the best that you become. As we complete each step, you should be able to see the site grow into a full featured site, ready to fulfill the needs of its end users and hopefully give the admins something to be proud of. (And maybe earn them a buck or two to boot.)

But to make it perfectly clear, this is not a set of tutorials for beginners. I won’t be covering such basic concepts as installing the software, database management, uploading plugins and themes, and the like. Just like WordPress Multiuser requires some basic knowledge of WordPress, blogging, web hosting and the Internet in general, these tutorials will assume that the reader already has some basic knowledge as well. If you’re still lost on how to upload a theme, you may want to consider if this is worth your time or if you need to broaden your skill set a bit first.

Don’t expect a successful site to pop into existence overnight. It takes work. Sometimes quite a lot of it. I have to admit that I still get a chuckle reading the threads in the support forums where folks want a site “just like WordPress.com,” they want it now, can’t understand why they have to pay attention to whatever an error log is, and don’t understand why they got the boot from their $2.95 a month hosting account after a week. I remember one person who gave the time frame of 10 days. That’s not going to happen. The time frame for this one is 30-45 days.

This doesn’t mean that I’m not interesting in answering questions. Please feel free to do so. Just remember at this level of the game, you’re already playing with the pros.

And, yes, there will be homework. In fact, you already have some. What I would like you do it is find 5 blogging sites, sign up for accounts, and give them a try. No, they don’t have to be WordPress sites but Andrea has reviewed a few here. Blogger, Typepad, MSN Spaces and the like are fine. Test them out. Find what you like and dislike about them. What do they do well? What do they do poorly in? Take a look at their features. What are they missing? Are they easy to use? Hard? Make a list of the pros and cons and give them some thought. Don’t think about if what you’re looking at is doable in Mu or not. We’re just worried about a list right now.

Next Step: Planning.
-drmike

Check out WPeBooks.com for multisite plugins & ebooks.

Feed enhanced by Better Feed from Ozh

25 New and different ways to use WordPressMU

andrea — Fri, 07 Mar 2008 00:22:31 +0000

I was reading the list of 48 Unique Ways To Use WordPress earlier today, when it struck me that many of these ideas and more would be even better on an MU platform.

Especially the section where Raj notes getting a domain and setting up a blog on subdomains. Um, Raj? This is exactly what MU does, with the click of a button. For example, look at a site such as about.com. Could be done in MU with not a lot of work, actually.

My own Site of the Week section is a small start in highlighting sites that are already out there making waves using MU.

Now before I get started, I have to say in big bold letters that this will require actual work and probably a whole pile plugins and tweaks. Out of the box, WordPressMU is a blog farm, plain and simple. Then again, WordPress is “just” blog software, right? The other thing I noticed is that I’ve talked to a lot of people lately who are intimately familiar with WordPress enough to recode whole sections of it, but haven’t even looked at MU yet.

If you are one of those people, I think you’re going to be not only pleasantly surprised, but creatively refreshed. And before you think I am giving away great ideas, most of these have been done, I’m just suggesting how they can be done with MU. Ideas are a dime a dozen (or less) and they also fall under the 80/20 rule, meaning 80% of the people reading this will never actually do anything about it. The other 20% might want to start taking notes.

Niche blog networks – niche blogs are hot, networks are hot. Using WPMU combines the two. The added bonus over using a standard install and categories is as follows:
a) the keyword is further to the start of the domain name
b) you can have pages related to each topic
c) did I mention the obvious? One code base to look after.
d) minimal theme tweaks, you can make them look the same (all use one theme) or different (each use a separate theme)
e) can easily aggregate the blog contents, or just headlines onto the main blog.

If I were going to do a site like this, I would close off blog signups and manually create the blogs as needed from the backend. I would let users sign up because it enhances the community feel.

1. Celebrity gossip site – use the main blog to aggregate content from the sub-blogs and have those sub-blogs be celebrity-specific. I’d be all over this if my time wasn’t all used up already. From what I’ve seen, celebrity related sites bring in pretty good ad dollars.
2. Hobby site – again, each sub-blog focuses on a specific hobby. If you are crafty or have some sort of hobby, you know how they are often related. One good niche site and some related blogs all running off the same code base, and you have one awesome resource.
3. An artist collective – set up a few good photoblog themes, maybe streamline the backend, get some artist to signup and showcase their work, and you have an instant online gallery.
4. Movie site – a new movie comes out, a new blog goes up. All under one umbrella. Think of IMDB but different. Possibly better.
5. Music artist site – a combo of 1, 3 and 4. You could use each sub-blog for one particular artist or a genre of music. Pages can then be set up to highlight things like albums and personal stats.
6. Real estate – each blog could be area-specific or even per listing. In the past year, I both bought and sold a house. Many of the Realtor sites we’ve seen and tried to navigate are outdated and horrible to use. Much easier to remember 123mainst.myrealtor.com, isn’t it?
7. Podcast network – One site, many blogs each featuring a particular podcast.

I’m sure your brain is racing with even more niche ideas with great categories suitable for a separate blogs under one site umbrella. To aggregate the posts onto the main mage, either use the sitewide feed plugin and parse it or any one of the most recent posts plugins.

Educational uses – again, people learn all the time, and using MU opens up a whole new world. A lot of sites are out there based on MU, but I feel there’s room for everyone.

8. school site – each grade or class can have its own blog with the teacher reporting what’s going on Parents and family can then see for themselves what is being done in the classroom. Saves a lot of take-home papers.
9. Class site – each student has their own blog, the site is run by the instructor who could even grade their work (the blogs themselves).
10. online courses – each blog is its own online course. The instructor runs one blog, the students can either be subscribed to that blog for follow-up or have their own blogs as well. Your call.
11. Homeschooling or homework site – in one sense, the site I run is already doing this in some places. Students can set up a blog to keep track of the work they did each day, logging results, writing essays, answering questions. it goes on and on. homeschooling parents can also log their days in blog format to keep family up to date on activities.

Health – again, many people are interested in health issues, in being healthy or staying healthy, or in coping with conditions. A bunch of blgos on one site can be a great support network.

12. Diet blogs – either have the blogs concentrate on particular diets, or dieters can sign up, document their diet and interact with other site networks.
13. Disease-specific blog – Cancer can be deadly, and diabetes is an ongoing daily thing. Both topics can be set up with sufferers using their blog to get support, keep people updated, and document progress.
14. Fitness blogs – either to track progress, or highlight specific ways to get fit, this can be done easily.

Family
15. New moms love to show off their babies. Give ‘em a place to blog it all. Don’t forget a gallery plugin and loads of upload space.
16. Geneology – under a family surname domain or ancestor’s name, have each branch of the family use their blog to keep the cousins up to date.
17. Got a family that loves to blog? Get a surname domain and have each family member use their name as the sub-blog. Safer for your kids than Myspace.

E-commerce – this section blows my mind, and apparently others too, as I see people asking all the time.There’s just one problem: any of the e-commerce plugins out there don’t quite work with MU. Yet. This is one of the ideas that requires the most work and/or money to implement.

18. Set up shops for users – one site, and each blog is owned by whomever, selling whatever they want. Feel free to niche that, though.
19. One store, many departments – selling a load of stuff? Have each blog be a separate department.

Miscellaneous – sometimes my mind wanders all over into unrelated territory.

20. Churches under one diocese or main church – sub-blogs are individual churches in different areas.
21. video blogs – each blog is someone’s own personal video stream or collection of v-logs. Like your profile page at Youtube, but with blog functionality.
22. Corporate intranet site – getting running on work servers, and each department can have its own blog, with team members as authors. managers and even other departments can stop in and check on project progress.
23. Support sites of any kid – people need support and want to interact with other people, usually based on some sort of interest or need. Find that need and fill it. Got a hobby, and interest, a fandom perhaps? Ever wish related blogs were all in one spot? WPMU will do it.
24. Election blogs – I hear my neighbours to the south have some sort of big election coming up. Candidates or the reporting thereof can be on a seperate blog on one site. Or have one site and each blog have different party news. Although that might work better in a country with more than two political parties…
25. The biggest and final one – SOCIAL NETWORK. Hey, development is headed that way already.

Basically any site you can think of, especially ones with related (or not) subdomains or subdirectories, can be run off one WPMU installation. Not out of the box, and not necessarily easily, depending on the idea, but the fact remains it can be done.

How much work are you willing to put into it?

Check out WPeBooks.com for multisite plugins & ebooks.

Feed enhanced by Better Feed from Ozh