WordPress Workshop

Editor's Notes

• #8: Takes about 10-15 minutes sometimes, but more secure and reduced risk of invasion from hackers.If you host offers it, I recommend uploading the zip file & decompressing on the server versus unzipping and FTPing all the files, which takes considerably longer
• #9: For most web hosts, DB_HOST will be ‘localserver’. If your web host requires that you use something different, they usually indicate this in the MySQL database area Authentication Keys & Salts are used to encrypt the information in WP cookies. If you heard Justin Ryan’s presentation at Online Summit, he discussed how hackers can use your cookies to get into your site. Using the salts and keys can help prevent this. This can be done at any time, so even if this wasn’t done when your site was setup (such as if you used one-click install), you can add this layer of security. It will force all users to log in again, but shouldn’t cause any other problems. it is possible to change table prefixes after the initial install, but this can be hairy and should not be attempted without a good backup, some technical experience, some time to kill, and a bottle of wine if there are problems.
• #10: If you already have an admin account, there are 2 ways you can handle this – create a new administrator account (will have to use a different email address) and then log in with that and delete the admin account (or change it to subscriber) or use wp-optimize plugin to help you change the admin account name. This can also be done directly in the DB if you’re savvy with that stuff. Some advocate to remove the account but if it’s been successfully downgraded to Subscriber role, it shouldn’t cause any problems. Can be changed during manual setup, or with plugin (wp-security scan) //remove WP Generator tag -> remove_action('wp_head', 'wp_generator'); Password – according to Justin Ryan, DuckDuckBlue (Online Summit 2010), anything less than 12 characters can be cracked by average computer in less than 1 day, no supercomputer needed. Use a variety of upper- and lower-case letters, numbers and symbolsCan create .htaccess file with FTP program or File Manager. Used to control file access on Apache-based servers. WP requires LAMP plaftorm or compatible to run. File Permissions: Directories 755, Files 644. If on shared- server, wp-config should be 750. wp-config.php can be moved ONE directory up from install directory, which means it can be outside your public folder if WP is in root directory. Make sure you have regular backups of your database (all your content) and your files (theme, plugins, modifications, etc.)
• #11: SemiSecure Login Reimagined – not as good as SSL for logging in but better than nothing.UserLocker - This plugin locks user account after given number of incorrect login attempts.WP Security Scan – looks for common security issues, such as database errors, table prefixes, wp-generator meta tag, etc. This doesn’t have to be running all the time. Most of the time, I have it deactivated, and activate it once a month or so, or after installing new plugins, to make sure I’m still good.WordPress File Monitor –will alert you if any file is changed or added in your WP install directory. Can be a hassle with backup files, but worth it for the peace of mindAkismet comes automatically with WP, but requires a API key, which are free for personal use, and start at $5 month for non-personal sites. Bad Behavior complements other link spam solutions by acting as a gatekeeper, preventing spammers from ever delivering their junk, and in many cases, from ever reading your site in the first place. Spam Karma blocks spammers by known IP addresses, and has good reviews but I’ve never personally used it. Disqus is a comment management plugin but since I installed it, I haven’t had an comment spam, so that works for me. SEO Ultimate is, as its name suggests, an SEO plugin. However, it has a 404 monitor module that I can use to see which files people/bots are trying to access, which can be a clue if someone is trying or has tried to hack my site. BTEV logs events for your site to help identify potential hacking episodes TAC checks for malicious code, links or javascript in your theme files. Great if you use a lot of free themes.
• #12: BackupBuddy is also useful for moving WP install from subfolder to root or to a new server
• #14: Plugins in repository have to pass spam/malicious code check when submitted, but nothing preventing from uploaded bad code on the next go-round, so use with cautionPaid & premium plugins are safer and usually more well maintained.
• #16: Podpress & PowerPress both give you FreeStatsPlayerID3 tagsAudio or VideoSupports many different file typesPodpress has a history of being neglected for a while, but I’ve read some strong reviews for both.Powerpress can also do hosting. It was developed as a replacement/upgrade of Podpress when it was abandoned in 2009. However, since then, development has started back up for PodPress.
• #19: Has limited stats, and does not include the nice checks that many email service providers do, such as Spam flags, and automatically including required information according to CAN-SPAM act.