Flickr User Peregrino Will Reign

Lets face it, site security is one of the most boring subjects in web development. It’s not as sexy as site design and it’s not as geeky as feature development. It’s pretty lame. But all it takes is one site to get hacked for you to realize that it’s not something you can take for granted.  Unfortunately most security posts center around server security and if you’re on a shared hosting environment you don’t have much control over the server. Nevertheless, there are some steps you can take with your next WordPress installation to make it more secure. Before I dive in, I want to thank Terran Birrell and the members of his WordPress User Group in Rochester, New York for many of these tips.

OK, here we go.

1. Stop doing the one-click install at your host

For a brief period I was taking advantage of my host’s “one-click” install for my WordPress sites. My reasoning was simple… why go through all that manual work, when I can just have my host set up the default WordPress site for free? Then all I would have to do is add plugins, themes and content and I had a site. Sounds good, right?

Why this is bad

The problem with anything automatic is that you give up control. In the case of a one-click installation, you give up control of your database name, database user name, database password, and table structure. You also miss out on another WordPress security feature: secret keys. These are all items that should be manually configured to ensure your site is secure.

What to do instead

Keep a folder on your computer that has a pristine copy of the latest WordPress files. In the \wp-content\plugins folder, keep all your favorite plugins and when it comes time to do a new install, create the directory on your host and then FTP all those files up (don’t forget to edit wp-config.php first!) You’re going to need the FTP connection anyway – might as well set it up during the install.

2. Change your table prefixes

In wp-config.php WordPress prefaces all your tables with “WP_” by default. So for example your OPTIONS table is called WP_OPTIONS.

Why this is bad

WordPress (and most other CMS for that matter) generally have safeguards against SQL injection attacks. But it’s still not worth taking a chance. A SQL Injection attack is initiated when a hacker posts a SQL query to your site through a form, a comment, on the URL, etc. During the early days of the Internet when people had “guest books” you could easily deface them by placing an unclosed <BLINK> tag in your comment, redering the rest of the page infuriatingly unreadable. (It also gave some Japanese kids seizures.) Well, the modern day equivalent is dropping into a form a piece of SQL like this:


UPDATE wp_options
SET <evil stuff goes here>


…and watching the site become a zombie attack robot. Like I said, in most cases this will fail, but if you fall behind in WordPress updates you could be exposed.

What to do instead

Change your table prefixes to anything other that “wp_”. To do that, look through wp-config.php for these lines:

/**
* WordPress Database Table prefix.
*
* You can have multiple installations in one database if you give each a unique
* prefix. Only numbers, letters, and underscores please!
*/
$table_prefix = 'wp_';

On that last line change ‘wp_’ to ‘PREFIX_’
Where ‘PREFIX’ is anything you want (letters, numbers and underscores only)

3. Make your DB user name unique

When you’re manually creating your database on your host it’s tempting to use the same database user for multiple databases.

Why this is bad

Duh. Access to one means access to all.

What to do instead

Create a unique user for each database. Give that user rights only to that database. Never use root.

4. Set the secret keys at the bottom of the wp-config file

WordPress allows you to set up encryption keys that keep your users’ cookies safe. It’s a good idea to use them, not just for your site but also to protect your users. As the Codex says, “You don’t have to remember the keys, just make them long, random and complicated — or better yet, use the the online generator.”

How to set the keys

In your wp-config.php file, look for these lines:

define('AUTH_KEY', 'put your unique phrase here'); define('SECURE_AUTH_KEY', 'put your unique phrase here');
define('LOGGED_IN_KEY', 'put your unique phrase here');
define('NONCE_KEY', 'put your unique phrase here');

Then click on this link and get the keys. You can copy the entire text on that page and paste it into the file replacing what’s already there.

5. Delete the “admin” account

At install, WordPress creates an administrator account called “admin” and then lets you create a password for it.

Why is this bad?

Access is controlled by two variables, the user name and the password. If you keep the admin account you’ve just handed over the half your credential to a would-be hacker.

How to fix it

The first thing you should do when you log in with this account is create a new administrator account with a name other than “admin” or “administrator” and give it the administrator right.

Pro tip: Oh, don’t use “webmaster” or “info” either. Those are logical next guesses. Once you’ve created the new administrator account, log in to WordPress and delete the admin account.

6. Don’t use your post author name as your login name

Just as we don’t want to log in with “admin” we don’t want to use the display name for your blog posts as your log in name. So for example if you post as “Rob” don’t have “Rob” as your login name. Instead this should be a user name that you don’t share with anyone.

7. Use a spam blocking plugin

Currently I’m using Spam Free WordPress by Todd Lahman on all my sites. It’s awesome. Zero false positives and I haven’t had to moderate a single comment about Viagra. Nonetheless, something is bound to get through eventually. And when it does I’ll begin my search anew. I don’t know what the best SPAM protection is (except maybe turning off comments altogether) but it’s worth spending the time to find one. Besides not having to deal with crap all day, by having a good SPAM blocker installed you make your site less attractive to would-be hackers.

8. Finally… keep your site up to date with the latest versions of WordPress, themes and plugins

Get in the habit of checking your sites regularly, and set aside time to do your updates.

If you have any other tips for securing your WordPress site, please feel free to add them in the comments below. Thanks!

I’m writing this while waiting for the “Chat Agent” to come online and take care of canceling my account.

Like many people, I had a rare occasion when I needed to fax a document and not having a fax machine I decided to try out a “free” Internet Fax service.

There are a ton out there, but for whatever reason (the whole experience, like sending faxes, was quite forgettable) I chose Fax.com. I provided my credit card info and sent the fax. Fine.

A month or so later, I checked my credit card statement and there was a charge from Fax.com for $9.99. “Oh I better take care of that,” I thought and then immediately forgot about it.

A month after that, I checked my statement and saw the charge again. “I must cancel that,” I thought. This time I went to the site, signed in (thanks LastPass!) and hunted for several minutes for a cancel option. I didn’t find one and something came up and I had to abandon my search.

And then 10 minutes ago I saw the charge AGAIN on my statement. I’ve now spent $30 on this “free” service to send one measly fax!! I logged on and started clicking around. Finally while viewing my bill online, I clicked on the Help icon and saw a FAQ about canceling my account. I clicked on that link and was taken to another page when I had to chat with a support rep to cancel my account. Seriously, Fax.com expects me to chat with an agent to cancel my account?

… Well, apparently not. After waiting for the agent for a couple of minutes, the system has told me that it’s taking too long and had me fill out a form to cancel. (I wonder if there ever was an agent in the first place.)

To me fax.com’s business model is “frustrate the user so he stops trying to cancel.”

Fax.com provides a commodity service that is fundamentally similar to its competition. It sends faxes through the Internet. And it does a fine job of it. The interface is clean and simple to use and it works exactly as promised. But it’s obvious to me after trying to cancel the service, that in my case 2/3 of Fax.com’s revenue is derived from frustrating its users. I only wanted the service for one of the three months I paid for it.

Another online service that derives revenue this way is PayPal. Regardless of my preferences in the past, I still have to force PayPal to complete a purchase using my credit card rather than my checking account. I have to go through that extra step every time. And on those rare occasions when I forget, I’m pissed. It throws my whole accounting system off.

The result is that whenever I’m given the opportunity, I’ll use anything but PayPal to complete a purchase. Yep, that includes Google Checkout.

Both Fax.com and PayPal are guilty of the same practice: they sacrifice good customer interaction for the sake of a few extra bucks.

If you’re a product designer remember this: Your goal is to help your users easily do what they want to do, not what you want them to do. And if they’re not both the same thing, maybe you’re doing it wrong.

Cheeburger Cheeburger has moved up a notch in my book. I ordered my lunch online at Cheeburger.com and in the Special Notes box I added:

Please draw a picture of a monkey using a flamethrower on the wrapper/bag.

Here’s what I got.

"Please draw a picture of a monkey using a flamethrower on the wrapper/bag."

One caveat though – they did call to verify the order because of the unusual request. So I had to tell them that yes indeed I wanted a burger and yes, I wanted a picture of a monkey brandishing a flamethrower on the bag.

Luckily for me Christine picked up lunch, which I guess she’ll be reluctant to do in the future.

Dear Family:
Although I need nothing but your love (and my house and my laptop and my phone and my Jeep), you insist on buying me things for my birthday and Christmas. So here is the list of things that will bring a particularly wide smile to my face Christmas morning:

	Swiss Gear Backpack. Big, black, lot’s of pockets and zippers. (I liked Patrick’s bag at the cottage). Here they are at Amazon. I especially like this one. But I think you can find it cheaper elsewhere.
	I’d like a set of tools to keep in the camper. The tool set would be pretty typical of a home/apartment tool set plus some camping-specific things like duct tape, glue, paracord and the like. This one is hot.
	A charger stand for my phone. I like this one because it can also charge a spare battery.
	I’ll always need these.
	Weight Lifting Gloves, black, size large. Like these.
	A pair of work boots like these. Note: The image only shows one boot, but I will in fact need two.
	This Jeep knife is pretty cool. Jeep JP-4013 Multi-Knife
	Taillight Guard for my Jeep. Needs to fit a 2000 Jeep Wrangler Sport (TJ). Here’s one.
	Moccasin Slippers. Size 11. Target has them as well.

I’m an avid reader of Pat Flynn’s Smart Passive Income blog and refer to it regularly. One post that I keep coming back to is THE Backlinking Strategy That Works. You can spend as much as $2,000 on a back linking course and you won’t get as much information as you will in this single post. (I know this from experience.) It’s not just the original post that is valuable; the comments also contain some great discussion.

Simply put, article marketing continues to be one of the best ways to accumulate inbound links to your web pages. Even after the Panda update.

So yesterday I questioned Pat’s selection of Article Directories as I found some of them to have a low Page Rank and others were either no longer accepting articles with external links or were charging a fee. Joseph Archibald (the original author of the backlinking system) replied and confirmed my suspicions – those Article Directories were the best at the time the original post was written. But as with the fluid nature of the web, some are no longer on top.

Well, the long-and-short of it is I put together a list of Article Directories with a PR of 4 or higher and included their Alexa Rank and whether or not their links are rel=”nofollow”.

Here’s the list:
Top Article Directories By Page Rank

This list is based on the Article Directory list at Directory Critic – but the original list is woefully out of date (even though I dutifully reported many of them).

Obviously rankings will change and I’m sure there are many more Article Directories out there with a PR of 4 or higher. So, let me know in the comments if you’d like to help maintain this list.

A pretty handy guide to bring with you next time you’re out beer tasting. Plus it combines two of my favorite things, beer and infographics (not always in that order).

What awesome times we live in.

Behold…

Source: Pimsleur Approach