Communication between agencies and clients is what keeps a project moving forward smoothly and efficiently. However, it can be difficult to juggle the assignments within your agency while staying up to date with your clients. Thankfully, there are a number of collaboration tools available for managing communication with your agency’s clients. This makes your company look more professional, while setting the project up so that it’s more difficult for critical details to fall through the cracks. In this article, we will explore in-depth the benefits of dedicated communication tools for agencies. Then, we will show you two great options (Project Huddle and InVision) that could be ideal for you. Let’s get started! The Benefits of Dedicated Communication Tools Communication tools can enable faster and more direct collaboration on designs. It’s a given that any agency will need to be in constant communication with clients. Whether it’s the discovery, creation, or delivery phase, staying in touch with the client is important to ensure that the final product meets their needs. Email is a powerful tool, and has clearly revolutionized the way we communicate and do business all over the world. However, it does have limitations. Managing email communications between a large team and multiple client contact points could cause a lot of unnecessary back-and-forth. What’s more, if a crucial conversation thread is missed, the whole project can be thrown in disarray. In short, email communication requires tight organization and attention to detail at all times to be effective. This is where dedicated communication tools come in. They take your discussions and turn them into dynamic interactions, enabling many people to participate at every step of the way. There are even dedicated apps to help you manage specific tasks such as website prototyping, mockup approvals, collaborative comments, bug tracking, and much more. By streamlining your agency’s communication channels, you can reduce the time and money spent administering to any given project. You can offload tasks easily, and provide a dedicated, dynamic interface for everyone involved in a project. Here are a few other benefits: Communication is always ongoing and current, with everyone having access to the same information. Project histories are tracked, enabling team members to get up to speed quickly. Collaborative comments mean there’s no chance of missed emails, or private conversations being lost in the fray. Project assets are collated in one location, reducing the time it takes to search for a particular element. In a nutshell, dedicated communication tools enable you to look and act more professionally, while also making your internal processes more efficient. 2 Tools for Collaborating With Your Agency’s Clients Technology is always evolving, with new products and services constantly becoming available. While there are a myriad of collaboration tools to choose from, the two below are industry-proven, and offer the features you’ll need. Let’s take a look! 1. Project Huddle Project Huddle is a self-hosted WordPress plugin for creating mockups and websites. Once installed, you’ll receive a JavaScript snippet that can be added to practically any website. It offers unlimited projects and users, and even supports multisite WordPress installations. Project Huddle is designed for self-hosted WordPress, so you can install it on your own agency website, ultimately enabling you to control and own the data you accrue. It also means the tool is incredibly portable, so can be used wherever you can access your website. There are two considerations you’ll want to make when ascertaining whether Project Huddle is right for you: You’ll be able to quickly integrate it into your existing workflow and immediately speed up feedback and iterations of your projects. On the other hand, if most of your collaborations involving elements such as mood boards and brand research, Project Huddle will not be as useful. It’s more suited to collaborating on mockups and interactive website prototypes closer to final delivery. Project Huddle can be installed like any other WordPress plugin, and when complete, you can easily share both mockups and websites with clients. They’ll be able to click on any given area and leave a comment, which lets everyone quickly understand any pain points the client has. Project Huddle is sold with a single site annual license for $89. However, you can use it to manage as many projects as you want, and there are no restrictions on the number of projects you can run. 2. InVision InVision is a hosted service where you can use prototypes and boards to communicate with your clients. You can sync designs directly with industry standard design programs such as Sketch and Photoshop. You can then turn your designs into interactive prototypes, so your client can get a feel for the desired end results. This is ideal for agencies who don’t want to deal with hosting their own design resources, which can be server intensive. It works particularly well for design-heavy work that may eventually be handed off to another development team. For example, HTML and CSS snippets can be generated to help build the final project, which makes it ideal for development from scratch. One of its more notable features is integration with major sites like Basecamp, Slack, GitHub, and Trello. This means you can quickly pass along important updates to everyone else involved with the project for higher connectivity. Let’s break down the considerations you’ll need to make when looking at InVision: If your agency focuses heavily on design, and less on final development, you’ll like InVision. You’ll be able to organize and collate a cohesive set of resources to pass down the chain accordingly. However, if your agency focuses more on-site development and delivery, InVision may fall a bit short. In this case, we recommend you stick to Project Huddle, which has more developer-friendly features. The good news is that InVision offers a free pricing tier. This way, you can discover whether it’s a good fit for your agency before spending the cash. However, to support teams you’ll need to pay $99 per month for unlimited prototypes and up to five team members. Conclusion Managing client communications can be difficult, particularly for in-depth projects. Tools such as Project Huddle and InVision take much of that away by providing a central place to manage updates, feedback, and other vital communication. In this article, we’ve discussed the importance of ongoing client communication within a project. Then, we looked at some solutions. Let’s quickly recap the two apps: Project Huddle: This premium-only solution is great for development-focused projects. InVision: Given the free tier and focus on project design, InVision will suit smaller teams less focused on research and development. What questions do you have about using software to collaborate with your agency’s clients? Ask us in the comments section below!
Your enterprise WordPress site is a crucial component of your sales strategy. As such, you’ll want to make sure every facet of it is geared towards increasing conversions. Failure to do so could lead to a decrease in sales and hurt your bottom line. Fortunately, WordPress — backed up by reliable enterprise hosting — can make this task much easier. In addition to being speedy and secure, there are plenty of WordPress plugins that can make managing sales and boosting conversions a breeze. In this article, we’ll cover a variety of ways to boost sales with your enterprise WordPress site. We’ll cover methods for analyzing client behavior, managing your site tags effectively, improving your landing page, and more. Let’s dive in! How Enterprise Hosting Can Benefit Your WordPress Site As the term itself suggests, enterprise hosting is specifically tailored towards enterprise sites that require the best when it comes to security, performance, and adaptability. This makes it the most optimal choice for any large-scale business. By using enterprise hosting for your WordPress site, you can be sure of top-notch performance across the board, while always being scalable as your business grows. Using enterprise hosting can also be a huge help when it comes to boosting sales. For example, if you run an e-commerce business, you need to make sure your site has maximum uptime, loads quickly, and keeps your data secure. Failure to do so could see your bounce rates increase, and you’ll likely see a drop in customer trust too if your site is seen as slow or insecure. In a nutshell, it pays to invest in a dedicated enterprise solution for hosting your website — both in the long- and short-term. 5 Ways to Boost Sales With Your Enterprise WordPress Site Now you’ve got an understanding of how enterprise hosting can help your site, it’s time to look closer at how you can use it to boost your sales. We’ll show you five ways you can do so — let’s take a look! 1. Create a Sales-Focused Landing Page Having a strong, sales-focused landing page is an essential tool for any enterprise site. Simply put, this is a single page geared towards marketing a specific product or service. By adding relevant information along with images and other marketing materials, you can use a landing page to massively increase your conversions. They key is understanding how to create a landing page that will drive sales. There are plenty of techniques to consider, but the most important factor is having a strong Call To Action (CTA). This is essentially the message you use to get your visitors to convert, which in the above image, is contacting the sales team. You should also take care to showcase your product at its best, such as including great photos and testimonials of previous customers. It helps to think of your landing page as a visual sales pitch for your product. If you make sure to show off all the benefits for the potential customer, you’ll be able to create a great sales-focused landing page. 2. Use Plugins to Facilitate Sales and Generate Leads Perhaps the greatest asset of the WordPress platform is its extensibility. Thanks to its wealth of easily downloaded and installed plugins you can add pretty much any functionality you desire to your site. This makes it incredibly easy to use WordPress to sell items and generate leads, as you only need to find the best plugins for the job and configure them according to your business’ needs. When it comes to sales, few options can stand up to WooCommerce. This is not only the most popular e-commerce plugin for WordPress, but powers almost half of all e-commerce sites. It’s not hard to see why, as WooCommerce makes it easy to create an online store in a matter of minutes. You can also customize every aspect of the plugin to create a unique sales experience matching your businesses branding. As for lead generation, integrating MailChimp into WordPress enables you to easily create a form that collects subscribers for your MailChimp newsletter. The plugin enables you to create opt-in forms, and can be integrated into existing forms on your site too, such as comment forms and during checkout. 3. Ensure Your Site is Responsive On Smaller Devices The days of desktop internet usage being the default way of browsing the web are long gone. In fact, over half of all online sales are now made using mobile devices. As such, having a responsive site is a very pressing concern, given that you’ll want a smooth browsing experience regardless of the device. Almost all new WordPress themes are responsive by default, but there are also several ways you can optimize your site further for mobile. For instance, one way you can do this is by using Google AMP, which is essentially a way to speed up your mobile pages. Speed is particularly important on mobiles, as 73% of users consider it the most important website attribute. You should also consider creating a mobile app as they account for the vast majority of all mobile usage. 4. Create Unique Title Tags for Products Title tags are the elements in your page’s HTML code that determines the page’s name. This is usually set to the match the title of the article or a product. As such, you should use unique title tags for all of your product pages. This might seem like a relatively small concern, but it’s actually an important way to help improve your site’s search ranking. By using good, unique title tags you will increase exposure and expand your possible audience in the process. Put simply, if you use the same keywords for similar products, they won’t stand out in search results. For instance, instead of using a generic title tag such as Galaxy S9 Smartphone, your tag should contain detailed information with the most important information first. In this example, it could be Samsung Galaxy S9+ 128GB Black (SM-G965F). In short, consider the keywords you use in title tags and make sure they’re still readable to users. You also want to avoid stuffing them full with keywords, as search engines don’t take kindly to it. 5. Gain Insights Into Customer Behavior Via Analytics Understanding how your customers behave is essential for developing your sales strategy. The reason is simply that by knowing your users’ behavior, you can effectively predict their needs and requirements. This makes it much easier to know how to optimize your business strategy to boost sales. It also helps you segment your market in order to advertise to specific subgroups within your existing and potential audience. There are plenty of ways to measure your enterprise WordPress site’s analytics. The most popular is using Google Analytics with WordPress, which enables you to see who has visited your site, how they arrived there, and what they did once they accessed it. This also lets you see how effective your sales funnel is. However, there are also several alternative solutions, such as the free StatCounter, which helps you find unusual navigation paths to help you create more optimized funnels. There is also the premium version of Kissmetrics, which enables you to not only track users, but also monitor different customer segments. Conclusion As we have seen, boosting sales on your WordPress enterprise site involves two broad approaches. The first is making it easy for clients to find the products or services they are looking for and purchase them. The second is ensuring your site is flexible and scalable enough to adapt to customer behavior. In this article, we’ve covered five ways you can boost sales with your enterprise WordPress site, such as: Create a sales-focused landing page. Use plugins to facilitate sales and generate leads. Ensure your site is mobile responsive. Create unique title tags for products. Gain insights into customer behavior via analytics. Do you have any questions about increasing sales on your WordPress enterprise site? Let us know in the comments section below!
There are a number of benefits to translating your site’s text. For instance, it increases your potential audience, can help increase your conversions, and also offers a boost to your site’s accessibility. However, those are far from the only advantages offered by a multilingual site. One often overlooked benefit of making your site available in multiple languages is that it can help improve your Search Engine Optimization (SEO) efforts. This requires you to structure your multilingual site correctly, and make sure you have the right tool for creating the multilingual content in the first place. In this article, we’ll discuss how you could improve your SEO by making your site multilingual. We’ll also show you how a WordPress multilingual plugin such as Weglot can help you make it a reality on your site. Let’s get started! The General Benefits of Translating Your Site If your site uses English as the primary language, it’s part of an enormous majority. In fact, over half of all websites provides its content in English, which makes it by far the most common language online. That’s perhaps not shocking, as English is also the language that most internet users speak. However, those statistics are still somewhat surprising compared to the rest of the world. For example, while nearly a billion internet users speak Chinese, it’s not represented by even 2% of all websites. Similarly, under 5% of websites offer Spanish, even though over 500 million users speak the language. It seems many site owners have simply decided to focus on the most popular language among users, and subsequently skipped over the vast numbers who don’t otherwise speak English. This may not seem important at first glance – after all, half the internet is a large number. However, there are plenty of benefits to stepping outside of this narrow mindset. For example, translating your site can help you: Expand your potential audience This should be obvious, considering the numbers we cited above. There are literally billions of users with a native language other than English, and catering to them will open your site up to a whole – relatively untapped – new audience. Communicate with a diverse group of users. If users can read your site in a language they’re fluent in, this can increase trust, which can give your site an edge over competitors. Increase your conversions. In short, users are actually more likely to convert if the site they’re using is available in their native language. In addition, making your site multilingual could actually also help it rank better in search engines. Let’s take a look at why this is. 3 Reasons Why Making Your Site Multilingual Could Improve Your SEO Search Engine Optimization (SEO) is a crucial process for ensuring your site is visible in Search Engine Results Pages (SERPs). The better your site ranks, the higher your pages will appear for relevant search keywords. As we said, you can actually improve your SEO simply by making your site available in multiple languages. We’re going to look at the main reasons why right now! 1. Translated Versions of Your Site Improve Its Overall SEO Rank The easiest way to understand this is by looking at a real-world example. Imagine example.com was available in English and French, and that each translated version of the site had its own unique URL. For example, you could use a different domain name for each, such as using example.fr for the French version. Alternatively, you could use a subdomain or subdirectory, such as example.com/en/ and example.com/fr/. Either way, search engines will read both versions as parts of the same site. This means any traffic you get from either version will improve the search engine ranking for the whole site. It also helps search engines understand your site, as it’s clear which languages you’re providing the content in. In order for this to work, you naturally need to avoid a translation solution that places all languages on the same page, or uses a # symbol in your address or cookies to determine the language. These methods will negate the SEO boost that a multilingual site can offer, so make sure you structure your translated versions correctly as per Google’s multilingual SEO best practices. 2. You Can Target Specific Regions More Precisely While a multilingual site will enable you to reach an international audience, you should still understand exactly which people you want to target. One important aspect of this is performing keyword research for the languages you intend to use. If you’re using Google Analytics, you could even target high-traffic regions. Once you know which countries and languages to aim for, you can create a translated version of that site, then perform your standard SEO practices. You can also use a process called ‘geo targeting’ to reach them better, as this lets you target specific geographical locations. In order to get the most out of your work, you should also aim to create a multilingual SEO strategy. This will help to ensure users from the locations you want actually find the right version of your site. For example, it’s not much use to translate your site into German if those within the country see the Spanish version instead. 3. More Visitors and Engagement Means Better Ranking This last point may seem obvious, but it’s worth mentioning as ultimately one of the key factors in any successful SEO strategy. Put simply, search engines value quality content and user engagement. If you manage to provide content that drives traffic, Google will notice and rank your site higher as a result. If you provide content in various languages, driving traffic from specific locations all around the world, it will also be noticed. As such, simply ensuring your site provides value to your visitors, regardless of language, will help you see results. Fortunately, Google provides a lot of information on how you should structure your multilingual sites in order to achieve the best results. How to Translate Your WordPress Site While there are plenty of benefits to running a multilingual site, actually creating one can mean a substantial amount of work. Fortunately, if you have a WordPress multilingual plugin to hand, it won’t be nearly as time-consuming or difficult. Weglot Translate is such a plugin, which enables you to automatically generate a translated version of your site into any of over 100 languages. Weglot is a complete translation solution, in that it works with every aspect of WordPress, and is optimized to improve your SEO ranking. This is because Weglot produces new versions of each translated page, and automatically applies Google’s SEO multilingual best practices. It’ll even translate text produced by plugins such as WooCommerce. You can also use the Weglot dashboard to edit your translations, which lets you ensure your content is spot-on, regardless of the language. You can get started with Weglot for free and they offer a 10-day trial. Conclusion Providing your site’s content in multiple languages helps you grow your potential audience and increase your conversions. In fact, if implemented correctly, it can also improve your site’s overall SEO ranking. If you have the right translation tool, you won’t even need to know a second language yourself to do it. In this article, we’ve discussed the following reasons why translating your site using a WordPress multilingual plugin such as Weglot could improve your SEO: Translated versions of your site improve its overall SEO rank. You can target specific regions more precisely. More visitors and engagement means better ranking. Do you have any questions about translating your site, or how it can affect your SEO? Let us know in the comments section below!
Usability testing is one of those unglamorous tasks that are often left for another day. It can be difficult to justify the time and budget required to check every button, link, and function on a website. It’s a luxury that many online businesses feel they can’t afford. However, usability testing can uncover serious security threats to your website, enabling you to address them promptly. For that and other reasons (which we’ll discuss shortly), undertaking such tests is not only useful but essential. Performing this task in advance can save many hours in the long run, and the process isn’t as drawn out as it may initially seem. In this article, we’ll talk in more detail about the importance of usability testing. We’ll also mention a few other ways you can secure your WordPress site. Let’s get going! An Introduction to Usability Put simply, usability is how well your website functions for its visitors. Every feature on the site needs to work exactly as it’s supposed to. This will ensure a coherent user experience. People expect clear, easy-to-use functionality in the websites they use. If their experience is interrupted by confusing navigation, broken links, or deteriorated code, visitors are unlikely to persist with their sessions. Let’s say that you have a “Get in Touch” CTA button at the bottom of a page. A user who clicks on the button may expect to find contact information or a form (or something else relevant to the action they’d like to take). If the CTA links to an unrelated page instead, the confused customer is likely to take their business elsewhere. Accessibility and intuitiveness are also vital considerations here. If your website lacks optimization for mobile devices, for example, many potential customers will dismiss your organization out of hand. Likewise, if your site is badly structured or difficult to navigate, few people will put up with it for long. Keeping clarity, accessibility, and intuitiveness at the forefront of your website’s design is essential to providing an engaging experience for visitors, and transforming views into sales and other conversions. Why Usability Testing Matters on Your WordPress Site Many companies attempt to avoid website usability issues at the design stage through a process called wireframing. This involves creating a map or blueprint of the site, and sketching out its functionality, flow, and structure before it’s developed. Even if this is done, however, code can break and websites can fall into disrepair over time. Therefore, it’s important to carry out periodic usability tests. This will help you ensure that the time and money spent on site design was not wasted, and that your site remains a positive reflection of your business. What’s more, a failure to schedule and run usability tests can also leave your site vulnerable to serious security threats. Broken links, code, and navigation are chinks in the armor of your site, and can make it more susceptible to hacks if they’re not fixed promptly. Poor maintenance of your website and ignorance of its usability are dangers that shouldn’t be underestimated. Searching for these types of errors and rectifying them is a vital task on any site. How to Improve Your WordPress Site’s Usability At this point, we’ve established why usability testing is important. This may leave you wondering how it works, and how you can get started. In short, usability testing is research that can be done either online or in-person (i.e., by asking questions and presenting scenarios to real-life testers), in order to find weak points in your site. Such testing can be undertaken by colleagues, friends, or family members, but it’s best to arrange for a sample of users from your particular target market. To start delving into the topic of usability testing, you’ll want to take a look at the resources section of Usertesting.com. Its archive is sorted by category, enabling you to quickly find materials that are relevant to your business. In addition, WordPress offers a helpful usability testing guide, which provides useful advice for conducting your own tests. Once you’ve carried out a bit of research and familiarized yourself with the key elements of usability, you’ll need to create a clear goal for your testing. This means defining what success will look like, and knowing what you want to achieve with your site. You can use Google Analytics to better understand your audience and what they’re looking for. This will help you to identify achievable goals. After that, you can create a ‘user testing script’, or a detailed plan. This will lay out exactly what your testers will have to check and which actions they’ll need to perform. Fortunately, there are plenty of guides that can help you write clear and useful scripts. Once you’ve planned out and conducted your tests, it’s time to compile your results, consider what you’ve learned, and convert the data into actionable outcomes. You’ll want to quickly address any errors, in order to improve your site’s security and user experience without delay. Additional Ways to Protect Your WordPress Website Usability testing is an excellent way to test your site’s stress points, in order to identify and rectify any issues. As we’ve discussed, conducting these tests will enable you to deal with many potential weak spots in your website’s security. Of course, there are plenty of other ways to tighten up your site’s defenses, and they shouldn’t be ignored. Here are some useful techniques to implement once your usability testing is complete: Secure your login page. A common entry route into a WordPress site is through the login page, which is typically accessed by adding /wp-admin or /wp-admin.php to the end of the site’s URL. In order to make the page harder to find, you can customize its URL. Perform regular updates and backups. Another common WordPress security issue is the use of outdated plugins, themes or WordPress versions. Make sure that everything you use on your site is updated to its most recent version. That way, you’ll benefit from security updates and fixes. Keeping your site backed up can also provide an extra layer of security. Scan for and prevent malware. No matter what steps you take, malware can still find its way into your site. Therefore, you’ll need to find a way to scan for and prevent this security concern. Malcare, for example, is a lightweight and easy-to-use WordPress plugin that keeps an eye out for malware and lets you know about it right away. It works wonders in picking up issues that might be missed by other plugins. Keeping your WordPress site secure should be an ongoing concern, just like usability testing. This is the best way to make sure your site’s data (and that of its users) always remains safe. Conclusion Security breaches can have a severe effect on your WordPress site and your business in general. Usability testing is an excellent way to proactively protect yourself against security threats, and also helps you to improve your website’s user experience. To get started with usability testing, you’ll want to check out a few handy resources, such as the WordPress usability testing guide. Then you’ll want to create a clear plan for your tests, execute them, and analyze the results. In addition, you’re best off complementing your usability tests with other key tools and plugins to help you secure your WordPress site. Do you have any questions about website security or usability testing? Get in touch in the comments section below!
A successful business website should smoothly guide prospective customers through each phase of your conversion funnel. To do this, you’ll need to make sure your site is scalable, fast-loading, secure, and designed for a quality user experience (UX). Of course, striking the right balance is easier said than done. The good news is that WordPress makes it easy to create an effective enterprise website. Apart from being a secure, free and open-source Content Management System (CMS), it offers a variety of plugins to meet your more specific needs. In this article, we’ll cover why WordPress is the ideal platform for your enterprise site. We’ll then cover five tips to ensure optimal enterprise WordPress development. Let’s dive in! The Benefits of Running a WordPress Enterprise Site WordPress is currently the most popular CMS, powering nearly a third of the internet. In addition to being inherently secure, it’s extremely beginner-friendly and easy to master. The style and functionality of WordPress can also be extended through the use of themes and plugins. As we touched on earlier, an enterprise site should address each phase of the conversion funnel: The awareness and interest phase. WordPress makes it easy to maximize the Search Engine Optimization (SEO) of your site with plugins such as Yoast SEO. There’s also a variety of plugins to help give your enterprise site more exposure on social media. The decision and purchase phase. Plugins such as WooCommerce let you develop specific e-commerce functionality, which helps you to manage customer conversions and improve the checkout process on your site. The re-evaluation and repurchase phase. WordPress plugins such as MemberPress let you organize subscriptions efficiently over time. You can also set up targeted email campaigns on WordPress using like MailChimp to help keep your client base up to date with new promotions. In addition to being able to help you ease customers through your sales funnel, WordPress offers a broad scope for flexibility and scalability. We will explore these benefits in more depth further on. 5 Tips for Effective Enterprise WordPress Development Whatever the nature of your enterprise, the following five tips will help you both future-proof your website, and gear it towards maximizing conversions. Let’s take a look! 1. Choose a Reliable Hosting Provider With Pagely’s Enterprise Hosting Plan, you’ll receive the power and security you need to develop your site. Your enterprise site isn’t going to be useful if it suffers from slow loading times or disconnected pages. Worse still, these issues could give the impression that your site is both unreliable and untrustworthy. The right hosting provider helps you avoid these pitfalls. Here, however, one size certainly doesn’t fit all. You’ll want to select a solution offering extensive storage, top-notch security, and good data retention. The latter is particularly important, as you’ll need to ensure your data is retrievable in the event of a disaster. Before settling on an enterprise hosting provider, you’ll also have to assess your team’s capacity to address technical issues. Although it’s a factor, whether you have the required troubleshooting capacity in-house shouldn’t be the sole criteria you use to judge the value of a managed WordPress hosting company. We’d recommend a managed service for a number of reasons, including to give you peace of mind and free up your team’s resources. With Pagely’s enterprise WordPress hosting, you can rest easy knowing your site’s well supported. The plan offers consistent site uptime, geocaching for rapid load times, nightly backups, and more. You’ll also benefit from unparalleled scalability, which brings us to our next tip. 2. Ensure Your Site Is Scalable and High-Performing Load Impact is a great, free tool to help assess how your site loads under pressure from traffic. Scalability should be a major priority for any enterprise WordPress development project. In short, this refers to your site’s capacity to smoothly accommodate spikes in traffic. This is crucial because when your site’s popularity starts to boom, the last thing you want to deal with is a costly overload. As we touched on, a reliable host provider will help to ensure your enterprise site is scalable. However, it’s a good idea to perform additional testing to see if your site will run smoothly under additional strain. A handy free tool to help you do this is Load Impact. Simply enter your URL and begin the test, at which point you’ll begin to see real-time feedback of the results. To ensure your enterprise WordPress development project runs smoothly, you’ll need your team to work in a local development environment. This will let them safely test and troubleshoot your site, before making the changes permanent after the kinks are ironed out. There are various local development environment software platforms to choose from, including XAMPP, and DesktopServer. 3: Keep Your Team ‘WordPress Savvy’ The WordPress 101 course is an excellent resource for getting your staff up to speed with all the important aspects of WordPress rapidly. It’s likely that various departments in your organization will be contributing to your enterprise site. For example, your marketing team might work on product descriptions and pricing, while your graphic design team might uploading images for banners. As such, you’ll have to ensure they are well versed in WordPress’ various features and functionalities. Fortunately, WordPress makes it extremely easy to manage the permissions and capabilities of your users. This means you can restrict access to the various features of your WordPress enterprise site based on role, which simplifies training and optimizes efficiency. Although, you’ll want to remember to ideally only have one user with the Admin role. To get your team up to scratch quickly, there are several quality online resources at your disposal. The WordPress 101 video course, for example, runs through the major features and important plugins of the platform via a series of clear-cut tutorials and comes highly recommended. 4. Hook Users with a ‘Habit-Forming’ Design Amazon is the epitome of a site geared towards ‘habit forming’ design. Your overall development approach should ultimately emphasize style and good UX. By rolling out a design addressing both, you can keep users returning to your site as a habit, and help conversion rates stay high. By including the following elements in your site design, you stand a better chance of ‘hooking’ users: Use prominent Call To Action (CTA) buttons. By adding easily-accessible buttons to let users carry out the action you’d like, customers can transition from decision to action swiftly. Implement bold, well-positioned images. This is particularly useful if your enterprise site is for retail and features promotions on a regular basis. Implement an intuitive checkout. By making it as simple as possible for customers to add items to their cart and make their purchases, they are much more likely to return to your site. Offer site memberships. This presents a great way for you to launch targeted email and newsletter campaigns to your customers. If your site is subscription-based, a membership system will enable clients to manage their plans with ease. Finally, it pays to carefully consider your choice of theme when developing an enterprise site. Although there are plenty of free options to choose from, you will likely need to invest in a powerful premium theme that can be readily branded and customized to your requirements. There are plenty of options available, but ThemeForest is often a go-to resource, so is worth initially checking out. Here’s a guide on how to select the best business theme for your WordPress Website. 5. Implement Top-Notch Security Wordfence Security is one of the leading WordPress security plugins on the market. WordPress is inherently secure, and choosing a host such as Pagely will certainly help you keep would-be intruders at bay. However, because your enterprise site is crucial to the success of your business, it’s worthwhile taking a few extra steps to make its security as iron-clad as possible. There are several useful plugins to help you conduct your enterprise WordPress development securely. A notable example is Wordfence Security — a robust plugin with firewall and malware scanning capabilities, as well as functionality to help prevent brute force attacks. During the development process, it’s also important to ensure any plugins being implemented are secure and reliable. Sticking to the official WordPress plugin directory is useful in this respect, though you should always browse user reviews and see how regularly the plugin is updated before making a decision. Likewise, you should take steps to ensure your chosen theme is as secure as possible. Conclusion As we have seen, enterprise WordPress development can reap major results for your business — if managed efficiently. What’s more, by using quality hosting for your WordPress site, you can help safeguard your site against intruders and unforeseen traffic spikes, as well as other performance-hindering factors. Let’s recap our five tips for effective enterprise WordPress development: Choose a reliable website hosting provider Ensure your site is scalable and high performing. Keep your team WordPress savvy. Hook users with a ‘habit-forming’ design. Implement top-notch security. Do you have any questions about enterprise WordPress development for your site? Let us know in the comments section below!
As web technology rapidly (and constantly) advances, it’s important to learn how to use modern technology to keep up with your rival developers, or risk losing out on much-needed work. While there’s a little bit of a learning curve for every new tool, being an early adopter helps you stay at the top of your game. One good way to know whether technology is worth trying is to give new tools at least six months of industry use, and see which developers are integrating it into their long-term methods. In this article, you’ll learn about nine tools for WordPress plugin development you may not currently be using. However, let’s firstly look at how we’ve chosen these plugins. Let’s get started! How We Chose Our Plugin Development Tools Plugin development is serious business, regardless of whether you’re building an open-source or otherwise. Anyone using your plugin will want your code to run smoothly, quickly, and cohesively with the rest of their WordPress setup. There are a number of WordPress standards, and quite a few tools to help you meet them more easily. If you learn about the possibilities at your disposal, you can focus on solving problems with code rather than in your code. Our criteria for any development tools are: Having a big enough community behind it that you can get help if something goes wrong. There are existing tutorials explaining how to use it. Developers have used it on production-ready work, not just experimental projects. Optionally (but preferably), at least one or two prominent WordPress developers have backed it in some way. Now it’s time to have a look at what tools your should be using in your plugin development. By choosing the right solutions for your workflow, you’ll be able to produce plugins that suit modern code and WordPress standards quickly and efficiently. 9 Tools You Should Be Using In Your Plugin Development We have broken down the nine tools into four sections (writing, running, automating, and testing code) that should be part of your workflow. We recommend giving each tool a spin and seeing what works best for you and your projects. Regardless of what you opt for, all are worth learning about so you can curate your own developer toolbox. In addition, the tools below are completely free to use — much like our previous article on essential web development solutions. Write Code: Open-Source Coding Editors Technically, code can be written in any plain text editor. However, doing so is easier when using a dedicated code editor as they come packed with a myriad of features to help speed up your work. When choosing a coding editor, you’ll want to look for features such as syntax highlighting, language-specific code snippets, and Git syncing. A few years ago, accessing these features meant paying a premium. Of course, you can still find stellar paid editors, but it’s now possible to find competitive editors for zero outlay. 1. Atom Atom is GitHub‘s open-source, hackable editor. It’s designed so users can completely customize it to work to their exact requirements. It’s extensible through community ‘packages’ (think plugins), which enables you to add support for non-standard features. Even so, it’s still an impressive tool out of the box. For starters, there are a myriad of supported Operating Systems (OS) and package formats, and an intuitive file system browser for viewing project files. In addition, there’s a smart autocompletion tool to help you write code faster, and an advanced ‘find and replace’ feature so you can quickly update the same string across your entire project. The extensive and comprehensive documentation outlines the many aspects of using Atom. As for installing packages, we recommend some of the WordPress-specific ones (WordPress API and Autocomplete WordPress Hooks), along with more code-specific packages such as Autocomplete PHP and Autocomplete HTML. 2. Brackets Brackets is another stand-out editor, produced by Adobe. The feature set here is focused on live editing, which enables you to see live changes in a browser while working. The tool offers inline editors (enabling you to jump between related code snippets), and preprocessor support, to help render SCSS and LESS files. In contrast to Atom’s packages, Brackets offers ‘extensions’. In our opinion, WordPress Hint is a must-have add-on for any WordPress developer. Finally, Brackets has a dedicated wiki to help get you up and running, along with helping you when you’re stuck. Run Code: Local Development Programs While it is possible to develop on a live server, it is incredibly inefficient to do so. It is better to set up your local computer to support PHP and MySQL so you can write and test code quickly before trying it out on a live website. Your options are to configure your computer manually, or use a program to automatically manage the server elements. Unless you’re incredibly comfortable with Linux server management, the second of these options is usually the best choice. With that in mind, let’s take a look at a couple of solutions you may be interested in. 3. Homebrew (macOS Only) In a nutshell, package managers help you set up your own local server development without relying on your computer’s defaults. These are run from the terminal, and enable you to quickly download and configure different server packages (such as PHP and MySQL) to work on your computer. Homebrew is the package manager of choice for Mac users. The home page concisely outlines what the package manager does, but in short, it installs over 4,000 files that you’ll need when developing on your computer. The script itself is very user-friendly, and will walk you through the process as it installs. For Windows users, Scoop is that platforms’ answer to Homebrew, and the command line can be used to quickly install the necessary components. 4. XAMPP XAMPP is a perennial server distribution program, enabling you to run an independent server on which to develop locally. There are a few variations (including WAMP, MAMP, and LAMP designed for various platforms), but XAMPP offers the most bang for your buck. You can get a local WordPress environment up and running pretty quickly, and a primary benefit is that XAMPP offers a close experience to a live server, while giving you the flexibility to tweak your installation to your exact requirements. 5. Vagrant For those looking to take their WordPress development to the next level, Vagrant offers higher control over your server environments than other options. It’s a little more complex to set up, but shouldn’t be out of reach for most developers. The primary benefit of Vagrant is to offer you the ability to fine-tune your settings to ensure wide compatibility on a variety of different server setups. Depending on your project, this will be invaluable for getting a solid and stable plugin out of the door. 6. DesktopServer The last tool in this section is DesktopServer. This is a new breed of local development tool, which is essentially a full WordPress installation in one box, that can be deployed within seconds. It’s cross-platform, and the base version is completely free. Compared to XAMPP, there are a number of more advanced features in DesktopServer, including a way to test sending and receiving email. However, it’s still incredibly simple to use. We recommend reading through the detailed documentation to get up to speed with the tool. Automate Code: Terminal Packages If you really want to crank up your development to the next level, you should consider terminal packages. The terminal (or ‘command line’) may seem intimidating at first because it lacks a familiar Graphical User Interface (GUI). However, it can save you hours of time while also improving your code structure through automation. For example, the can help ‘scaffold’ a project (i.e. generate essential plugin files with starter code), and allow for rapid creation of new sites complete with a bespoke default setup. You can also carry out general WordPress management, and test whether your code aligns with WordPress’ own standards. Let’s take a look at some solutions. 7. WP-CLI If you are frequently creating new WordPress sites to test out your plugins, WP-CLI is a must have to speed up your development workflow. Like package managers, WP-CLI is a command line tool enabling you to run scripts in the terminal. The difference is, WP-CLI is specific to WordPress-related tasks. There are quite a number of commands enabling you to install WordPress from scratch without a browser, import and export databases, search and replace database values, and even manage plugins and themes. There are even commands that work with many popular WordPress plugins. What’s more, installation takes just a few minutes. Once you’re up and running with WP-CLI, you can get even more done with it by using WP-CLI Community Packages: These are essentially additional commands for specific tasks. Our favorite related to ‘code linting’ as it checks your code, automatically corrects simple formatting errors to match WordPress’ standards, and lets you know what else is left for you to fix manually. You can check out all available community packages at the WP-CLI Package Index, and each has its own dedicated installation instructions, so be sure to follow them carefully. Test Code: Code Testing Scripts Coding plugins that work as expected with no bugs sounds like a pipe dream, although it’s not as far-fetched as it sounds. While it’s impossible to create a completely perfect software product, it is possible to launch a fairly rock solid one. Writing test-driven code means every feature you include is run through a series of tests and data trials to see how it reacts. If you add a new piece of code and something breaks, you can immediately be notified and rectify the problem during the initial development phase. Of course, there are a few code testing options you can integrate into your WordPress plugins. Let’s look at two. 8. PHPUnit PHPUnit is a testing framework tool for PHP-based code, such as WordPress. To get a handle on how it works in relation to your code and wrap your head around the concept, you may want to write a few simple tests before jumping into the WordPress-specific work. Noted WordPress developer Pippin Williamson wrote an entire guide on how to integrate PHPUnit into your own plugins. You can follow his step-by-step instructions and be well on your way to knowing your plugins will perform well under pressure. From there, you’ll likely want to peruse the wealth of documentation to learn all you’ll need to know about the tool. 9. Travis CI Travis CI is a complementary tool for PHPUnit that automatically runs your tests as you commit changes to GitHub. It’s free for all open-source projects and will help you ensure your code isn’t going to break under various server environments. The tool works on the basis of Continuous Integration (CI), essentially small code merges implemented frequently, rather than irregular sweeping commits. The testing process will clone your GitHub repository in a virtual server, carry out some builds and tests, and if the code passes, will then deploy it to your server. The online documentation will be your friend while getting to grips with the tool, and it’s well worth a read regardless of your level of expertise. Conclusion Keeping your skills up to date with modern development tools allows you to stay competitive, while improving your own work in the meantime. You can significantly improve your plugin development by adopting these tools into your workflow. Between modern open-source editors, local server environments, terminal packages, and code testing, there are quite a number of tools to help you improve the quality of your WordPress plugin code. Some of our favorites include Atom, DesktopServer, WP-CLI, and PHPUnit.
Web servers use configuration files to enable or disable functionality. One of the most important of these files for WordPress users is the .htaccess file. The WordPress .htaccess file enables you to customize aspects of your site’s functionality. For example, you can use it to ban specific IP addresses from accessing your website or password protect specific webpages, and that’s just for starters. Understanding how it works and what you can accomplish with it can be confusing without guidance. In this article, we’re going to talk more about the WordPress .htaccess file, where to find it, and what it can do for you. We’ll cover five ways you can use it to improve your WordPress website. Let’s get started! What the WordPress .htaccess File Is (And Where to Find It) .htaccess is one of WordPress’s core files — the default WordPress installation files that are responsible for the platform’s core functionality. This particular file includes settings that determine how WordPress renders URLs and how it interacts with your server. Modifying the .htaccess file isn’t as scary as you might think. As long as you follow instructions and don’t add or delete code without knowing what it does, you should be fine. However, you should always create a backup of your website before making such changes, just in case. To find and edit the WordPress .htaccess file, you’ll want to use an FTP client, such as FileZilla, or the file manager provided by Cpanel and similar solutions. Connect to your website using the client and then navigate to the root folder (a.k.a. root directory) of your web directory (often the public_html folder) on your server and open it. You’ll see a list of php files. The WordPress .htaccess file will be right inside: If you do not see the .htaccess file, it may be because your file browser has hidden files that start with a period because these important configuration files don’t need to be edited often. To show hidden files, there is a setting you’ll need to check or uncheck. You may need to Google instructions on “how to display hidden files with <name of your FTP client or file browser>.” You can right-click on the file and choose the View/Edit option, which will open it using a text editor. This enables you to make changes to the file and save them. After opening the file, you should see code very similar to this: # BEGIN WordPress RewriteEngine On RewriteBase / RewriteRule ^index\.php$ - [L] RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d RewriteRule . /index.php [L] # END WordPress 5 Ways to Use the WordPress .htaccess File to Improve Your Site If you followed our earlier advice, you should already have a backup in place of your entire WordPress site. However, it can also be a good idea to save a copy of your .htaccess file before you edit it. That way, if something goes wrong, you just need to restore a single file instead of a full backup. Once you’ve done that, you can start editing your file. There’s a lot you can accomplish with .htaccess, so we’re going to show you five examples just to give you an idea of the possibilities this file offers. 1. Redirect Visitors to a Custom Error Page One of .htaccess‘ most useful features is how it enables you to implement redirects in WordPress. This way, you can send users who try to visit specific URLs to other pages. It’s a particularly useful feature in cases where visitors try to access pages that don’t exist, instead of displaying a 404 error message. Redirects also have important SEO benefits. To implement this feature, open your WordPress .htaccess file and add the following code: RewriteEngine On Redirect 301 /original-url/ http://example.com You will, of course, need to replace both placeholders in that code. For example, if you want to redirect people that visit http://yourwebsiteurl.com/test-page to your homepage, here’s what that would look like: RewriteEngine On Redirect 301 /test-page/ http://example.com With this approach, you can redirect users to either a custom error page or to any other section of your website. However, for it to work, you’ll need to monitor the 404 errors your visitors are getting, which you can do either using plugins, like Redirection, or through an analytics tool. 2. Ban Specific IP Addresses In some cases, you’ll want to ban specific people from accessing your website. It could be because they’re trying to steal your content, hijack your site, or they’re acting abusive. If you run into one of those situations you can quickly ban their IP address from your website just with a few lines of code. Here’s the code you need to add to .htaccess to implement this feature: Require all granted Require not ip xxx.xxx.xxx.xxx The IP address you want to block needs to replace the xxx.xxx.xx.x placeholder in that code. Just be sure to use the correct IP address so you don’t block the wrong person. To put this feature in action, you might want to find a way to monitor which IP addresses are accessing your website. You can use a security plugin with activity logging features to keep an eye on suspicious activity. 3. Password Protect Your WordPress Folders One of the coolest things you can do with .htaccess is password protect specific directories. This way, you can ensure only the people you allow have access to them. However, this process requires a little more work than just editing .htaccess. The first thing you need to do is create a txt file called .htpasswds, which will contain your username and the password you want to use. To keep things easy, we recommend you use this online .htapsswds generator and then download the resulting file to your computer: Once you have your .htpasswds file ready to go, access your site via FTP and upload it to the directory you want to password protect. In this example, we put it within the wp-admin folder, to protect access to our dashboard. Now you’re going to create a brand new .htaccess file within the wp-admin directory. To do it, right-click anywhere within the folder and choose the Create new file option, then name that file .htaccess: Go ahead and edit that file now. It will be empty since you just created it, so add the following code: AuthName "Admins Only" AuthUserFile /public_html/wp-admin/.htpasswds AuthGroupFile /dev/null AuthType basic require user yourusername There are two lines you’ll need to edit here. The first one is the path that goes after AuthUserFile, which needs to indicate where you placed your .htpasswds file. Then, type the username you set within your .htpasswds file where the yourusername placeholder goes. Save the changes to your new .htaccess file, and you’re good to go. Next time you try to access your dashboard, you’ll see a password prompt come up! 4. Increase Your WordPress File Upload Size By default, WordPress limits the size of the files you can upload to your website. That way, you won’t get stuck if there are any errors during the upload process. However, you might want to increase this limit to allow for larger files. Note that you should check with your hosting provider before implementing this change. Some managed hosts, like us here at Pagely, manage these server settings for you and adjusting them could cause issues. Once you’ve checked with your host, you just need to add a few lines of code to .htaccess: php_value upload_max_filesize 128M php_value post_max_size 128M php_value max_execution_time 300 php_value max_input_time 300 In this example, we’ve increased the max file size to 128 MB. It also gives your website 300 seconds to process uploads before timing out, so it can handle the increase in size. You can increase both settings even further, although 128 MB should be more than enough for most websites. 5. Disable Image Hotlinking This is relevant for when other people link to your images directly, which puts additional strain on your servers. That practice is called image hotlinking and you can disable it by adding this code to your .htaccess file: RewriteEngine on RewriteCond %{HTTP_REFERER} !^$ RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?example.com [NC] RewriteRule \.(jpg|jpeg|png|gif)$ http://placeholder.png [NC,R,L] This code checks if the website that’s trying to load your images corresponds to the URL on the third line (yoursite.com). If it doesn’t, and they’re trying to load an image file that uses one of the formats listed below, it will load placeholder.png instead. In most cases, website owners come up with an image that says something to the effect of “Stop hotlinking our images!” However, you can replace placeholder.png with any image you want, using whichever name you prefer. Conclusion When it comes to your WordPress core files, few of them are as versatile and powerful as .htaccess. This single file governs a lot of important aspects, such as your permalink structure. In this article, we’ve shown you just a handful of these features. For example, with .htaccess you can: Redirect visitors to a custom error page. Ban specific IP addresses. Password protect your WordPress folders. Increase your WordPress file upload size. Disable image hotlinking. Do you have any questions about how to use the WordPress .htaccess file to improve your website? Let’s talk about them in the comments section below!
Despite the fact that WordPress powers 30% of the Internet, the myth of it being “just a blogging platform” still exists. WordPress is perfectly suited for managing large-scale business enterprise content, delivering secure, robust, and flexible website solutions for virtually any industry. However, these benefits can only be reaped when WordPress is combined with the appropriate hosting platform and plan. The good news is that there is a viable enterprise WordPress hosting solution available to meet your needs. This will ideally deliver outstanding support and security, a broad remit for scalability, dependable data retention, and other crucial features. In this article, we’ll take a closer look at what exactly enterprise managed WordPress hosting is. Then, we’ll examine the crucial advantages of a good enterprise hosting solution, as well as how Pagely delivers each in spades. WHAT ENTERPRISE WORDPRESS HOSTING IS (AND WHY YOUR BUSINESS MAY NEED IT) Pagely’s enterprise WordPress hosting plan can keep your site scalable, secure, and better equipped to increase conversions. Pagely’s WordPress enterprise hosting plan can keep your site scalable, secure, and better equipped to increase conversions. As the name suggests, enterprise WordPress hosting optimizes the platform to better cater to the objectives of a large-scale business. Typically, an enterprise hosting plan will ensure that the WordPress site (or Multisite) installation is: Highly adaptable. This is to ensure there’s capacity to deal with sudden changes such as increases in traffic, company updates, the opening of new branches and subdivisions, and more. Strengthened with heightened security. Security is more paramount for enterprises than smaller businesses, as the wealth of client data will pose a much more alluring target for hackers. Supported by robust and reliable technology. Because an enterprise site will be an integral component in your conversion funnel, and likely garner a large degree of traffic and customer data, your hosting plan will implement technology to maintain uptime, keep loading times down, and recall data in the event of a disaster. By delivering the necessary support and security on the back end, enterprise WordPress hosting makes it much easier for business owners to concentrate on gearing their online presence towards growth. What’s more, administrators will be in a much better position to roll out various enterprise-oriented plugins and set the parameters for improved site development. In short, enterprise hosting will deliver the infrastructure required to ensure consistent and efficient performance where it matters. 5 MAJOR ADVANTAGES OF ENTERPRISE WORDPRESS HOSTING Of course, before you invest in enterprise hosting specifically, it’s worth considering the benefits it brings to your business. Here are five of the key advantages to consider. 1. EXCELLENT SCALABILITY Scalability is a vital component for any enterprise, especially those with online elements. This refers to how a business has to adapt productively to sudden changes (such as a sudden traffic spike due to an announcement or seasonal sale). Often, a change in one area will impact another. For example, an increase in customers may require additional human resources to cater to their enquiries, which can in turn effect staffing numbers. Once your WordPress site gains more traction, additional power will be required to keep things running smoothly, as well as ensure customer data is collected efficiently. A site not equipped to scale fluidly is likely to crash, which could wreak havoc on your business. Choosing the right enterprise hosting plan can help safeguard you against this. Pagely’s enterprise hosting plan, for example, makes it possible to deploy data into any of AWS’s data centers, letting your enterprise cope better with increased strain on a global scale. What’s more, the plan gives you the ability to geo-replicate site data, enabling you to better avoid costly overloads by distributing data more evenly in different locations. As WordPress doesn’t accommodate geo-replication easily by default, dedicated enterprise hosting can prove invaluable for multi-national organizations. With Pagely, you’ll have the high-performance hardware to scale up as much as needed. We specialize in hosting some of the largest WordPress websites in the world. Whether you need a simple VPS set up or a highly-customized multi-node High Availability set up, we can handle it all. 2. MISSION-CRITICAL SECURITY As we touched on earlier, a crucial component of online business (or any other site for that matter) is security. This is particularly the case for enterprises, which often prove to be a more tantalizing target for malicious attacks. Although WordPress does offer a variety of ways to stay protected from brute force and malware attacks, more advanced measures will usually be required in order to set up the proper defenses. The kind of mission-critical security afforded by WordPress enterprise hosting will extend to server hardware and WordPress applications, as well as the hosting network as a whole. Pagely’s enterprise hosting plan, for example, is fortified with PressArmor: This security architecture safeguards against keyloggers, spyware, adware, viruses, DDOS, trojan horses and other malware, and much more. It also sets up a dynamic Web Application Firewall (WAF) that will deliver protection from a wide range of attacks. In the event of a security incident, response time is crucial. Our security team will respond quickly and help your organization resolve the issue and prevent future attacks. Aside from protecting your all-important data from hackers, a good enterprise hosting plan will also let you retain it in the long term, and recover it in the event of a catastrophe (such as a system failure or downed server). This brings us neatly to the next advantage. 3. DATA RETENTION AND RECOVERY CAPABILITIES Maintaining the ability to restore data should be a priority for any business with an online presence. This is especially pertinent, due to General Data Protection Regulation (GDPR) enforcing severe penalties for non-compliance. Choosing enterprise WordPress hosting means you can better ensure your data is backed up — as well as easily recallable and recoverable — through advanced cloud setups. This is due to the robust technology these hosting plans implement to ensure the data is stored correctly. To once again use Pagely’s enterprise hosting plan as an example, clients benefit from nightly data backups, with data sent to a secure Amazon S3 bucket (where it can be recalled as and when required). The plan also gives clients the ability to download data files to a local machine with just one click. In addition to protecting client data, an enterprise-grade WordPress hosting plan should also ensure that the internal system managing the data is equally secure. In the case of Pagely, a redundancy plan is in place to duplicate system critical components, so that a backup can be called in the event of a failure. This has proved enormously valuable to many enterprises in the past. 4. RAPID GLOBAL LOAD TIMES Though your site may be scalable, responsive, and well-backed up, slow loading times can undermine all of this. In order to reduce your bounce rate and keep potential customers coming back to your site, you’ll need to maintain quick site speeds across the board. Although certain caching and speed optimization plugins can help with this, you may need a more reliable solution relevant to your requirements. Enterprise hosting can help maintain consistently fast loading times for your WordPress site or Multisite network. This is often achieved through the implementation of advanced caching mechanisms, which drastically speed up requests sent to databases — our PressCache feature is a good, real-world example: It works by serving content to your site’s visitors via the Point of Presence (POP) closest to them. With our POPs located in Asia, Europe, and the United States, the distance that server requests have to travel is shortened for international users (in contrast to if all requests went to one single POP). This, in turn, makes the process of maintaining optimal loading times for a multinational enterprise (a 243 millisecond average in this case) much simpler. Pagely also makes use of Amazon’s powerful global CDN (CloudFlare), to ensure that website assets are always loaded from the data center nearest the visitor, and is built on NGINX, which is widely regarded as the fastest hosting solution available. 5. EXPERT SUPPORT & DEVOPS Any hosting service worth its salt should come with outstanding support, and this is even more crucial for enterprise hosting. This is naturally because larger-scale operations will bring potentially more frequent and more complex inquiries in need of resolution. To cater to all queries as efficiently and speedily as possible, enterprise hosting plans typically offer priority responses for tickets lodged by those on the plan. This is typical because a technical issue that cannot be addressed internally will need to be addressed immediately by an expert in order to lessen the impact it has. Pagely’s enterprise hosting plan delivers this priority support via a skilled support team of experienced WordPress experts, who are able to deliver ticket-based support all day long: Live chat and phone support options are also offered at designated times to help troubleshoot issues at the optimal speed. In short, whenever you need assistance, we’re ready and available to help. Our DevOps team also often serves as an almost “outsourced DevOps” team for enterprise tech departments. We’ve got the best engineers in the business and each one of them is worth the price of enterprise hosting alone. CONCLUSION In order to run a successful business enterprise, you need to ensure the CMS you roll out is fast, well-supported, and streamlined for easy use across multiple sites. As we have seen, enterprise WordPress hosting from a high-quality hosting provider with experience serving enterprise-level WordPress websites can help you achieve this. Let’s recap the advantages quickly: Excellent scalability. This lets you accommodate surges in traffic and increase conversions. Mission-critical security. A vital component that better protects your valuable company data from hackers. Data retention and recovery capabilities. With this in place, you can back up and retrieve your data easily and helps you with GDPR compliance. Quick, global loading times. This helps you to lower bounce rates, and retain more potential customers. Outstanding customer support. Having a safety net in the form of dedicated experts means more complex issues can be resolved quickly. Do you have any questions about finding the best WordPress hosting for your organization? Contact our sales team now for a no-pressure, needs-based consultation!
WordPress’ default post types are useful for creating blog posts, pages, attachments, and other standard elements of your website. However, if you’re looking to facilitate streamlined and efficient content creation for your business site, you may find the default post types somewhat restrictive. This is where WordPress custom post types come into play. You can use them to generate specific kinds of content that will better suit the needs of your company — such as product descriptions, testimonials, portfolios, and so on. What’s more, they are relatively easy for you or your staff to create and manage. In this article, we’ll take a closer look at exactly what a WordPress custom post type is. After that, we’ll discuss how you can implement this feature on your website for maximum effect. What Custom Post Types Are (And How to Benefit From Them) A WordPress post is an individual piece of content that you create through the dashboard. When you navigate to Posts > Add New, you will be presented with a specific interface for creating a blog post, which includes options for adding text and media, publishing the post, and more. Custom post types might be more accurately called custom content types, as they aren’t just for blogs. Either way, the term refers to any post type that is not included in WordPress by default. This means you can create more specific kinds of content, using the same WordPress editor. For example, if you added a custom post type for products, you could go to Products > Add New in the dashboard and access an editor with custom fields for adding prices, shipping times, and product images: Custom post types can, therefore, make your website more efficient and easier to manage. By assigning your various departments post types with custom fields to fill in, you’ll save them time, eliminate guesswork, and improve task organization. What’s more, custom post types can make the structure of your site more conducive to conversions. For example, you could use them to display testimonials or product profiles on your home page. Since potential customers will often view your home page first, employing custom post types to showcase your latest offerings or most glowing testimonials is a smart way to increase the likelihood of conversions. Now that we’ve established the benefits of WordPress custom post types, let’s talk about how you can add them to your WordPress site. Fortunately, the process is quick, simple, and cost-effective. How to Create a WordPress Custom Post Type Using a Plugin (In 3 Steps) There are two main ways to add custom post types in WordPress. The method you employ will depend on the needs of your organization. If you need to roll out custom post types for your teams to start working on quickly, a plugin is your best bet. However, if you want a solution tailored to the more specific needs of your business, the manual approach may be a better fit. Let’s start by discussing the plugin method. Step 1: Choose a Dedicated Plugin There are lots of WordPress custom post type plugins to choose from. Most present a hassle-free way to configure meta boxes, user-defined fields, and other key components of your post types. Since they are user-friendly and require no coding, these plugins are excellent time savers that can be readily rolled out to your development team. Custom Post Type Maker, for example, is both lightweight and feature-rich: It comes with an intuitive interface you can use to create fields, adjust visibility settings, and more. This plugin is compatible with virtually any WordPress theme, and even lets you add your own dashboard icon for your custom post types. In addition to letting you create new content types, Pods lets you extend existing ones: The latter option is particularly useful if you want to add new functionality to a custom post type added by another plugin (for instance, a WooCommerce product). This plugin also offers migration capabilities, so you can easily transfer over custom post types you’ve already created. Finally, there’s Toolset Types: This well-supported plugin delivers an array of options for creating and styling custom post types. You can customize each post type’s permalink, configure whether or not they appear in searches, and more. Toolset Types also enables you to define the relationships between your custom post types. This lets you enhance the organization and navigability of your site, both of which are integral components of its conversion funnel). Step 2: Install the Plugin and Configure Your Custom Post Type Now that we’ve covered some of the best plugins available for the task, let’s walk through how to actually create a WordPress custom post type. We’ll use the Toolset Types plugin to demonstrate the process, as it is simple to use while offering a lot of handy features. First, navigate to Plugins > Add New in your WordPress dashboard, and search for Toolset Types. When you find the right plugin, you can install and activate it: After that, you should see a new Toolset tab in your dashboard. Navigate to Toolset > Post Types, and then select Add New: Now, you will be directed to a page called Edit Post Type. Here you can enter the post type’s URL slug and name (both for singular and plural usage), assign an icon to it, and configure how it looks on your site: You can also assign attributes to your post type in the Options drop-down menu. These include its permalink and visibility settings: Finally, you can establish hierarchies and connections between the custom posts you have created in the Post Relationships (Parent/Child Panel) menu: If you want to do this, Toolset Types offers a comprehensive guide about how to set parent and child post types for your website. Step 3: Create Custom Fields and Taxonomies When you’re happy with how your custom post type is configured, you can publish it. First, decide where you want it to appear on your dashboard in the Save menu at the top of the page. Then select Save Post Type: We haven’t yet mentioned how to create custom fields or taxonomies (in other words, how to add new fields and organization to your custom post type). To do that, navigate to Toolset > Dashboard. From there, you can create custom fields and taxonomies, by selecting those options for the post type you just created: That’s it! Using the many options offered by Toolset Types, you can give your development team the means to crank out custom content quickly and efficiently. Toolset Types also offers some handy user guides to help you configure post types to meet your exact needs. How to Create WordPress Custom Post Types Manually There’s no question that using plugins is the quickest way to create custom post types. However, if the plugin you’ve used is ever uninstalled (or becomes inactive), all the post types you’ve made will disappear. Plus, the data they contain will become difficult to access from the admin area. By creating your custom post types by hand, you’ll be able to make them more permanent. Plus, you won’t need to add an extra plugin to your site. Therefore, if you’re considering using custom post types extensively, it’s worth taking a look at the manual approach. By having members of your development team manually create post types, you can also style them in ways that plugins often don’t permit. For example, if you want your custom post types to integrate maps, micro interactions, or other features that are not included in plugins, putting your top coders on the task can help you create content types that are much more useful. The manual method of creating custom post types is a more technical process. What’s more, its complexity depends on how many custom fields and other elements you want to include. You’ll need to edit the code in your site’s functions.php file, which will register the new post type and add various ‘arguments’ (the options for what the post type will display). Fortunately, there are numerous online guides detailing the correct way to create custom post types using code. Conclusion As we have seen, custom post types present an excellent way to streamline content production. If used efficiently, they can also play a role in your conversion funnel, as you can use them to better convey important information (such as through testimonials and product descriptions). Let’s recap the two ways you can add a WordPress custom post type to your website: Use a plugin such as Toolset Types. This will enable you and your team to create custom post types rapidly. Create your custom post types manually. This is more challenging, but results in secure and flexible content templates. Do you have any questions about creating and using custom post types? Let us know in the comments section!
Use WordPress logs to fix problems that arise on your WordPress instance — or, more accurately, to figure out why they’ve occurred. This feature tracks errors and records them in one easy-to-locate file, so you can get started on the troubleshooting process. There are three basic steps to enable WordPress error logs: Access your website’s files using FTP. Edit your wp-config.php file. Locate your new WordPress logs. In this article, we’ll talk a little more about why WordPress logs are so useful and go through step-by-step on how to activate and use them on your own site. Why You Might Need to Enable Error Logs in WordPress Using the information from your WordPress logs, you can easily get help in the official forums. No software is perfect, after all, which means there might come a time when you run into problems or bugs with WordPress. Most users extend the platform with a variety of themes and plugins and while beneficial (and essential) for the most part, this can result in compatibility issues and other unforeseen problems. There are many places online to seek help when you run into WordPress bugs or errors, but in order to get assistance, you’ll need to know what the problem actually is. As a result, it’s crucial to know how to perform some basic troubleshooting. To carry out troubleshooting, you’ll often need to enable WordPress logs. This will help you find out what errors are causing the problems you’re experiencing, and track them to their source. Once you’re armed with that knowledge, actually solving the issue will be much simpler. How to Enable WordPress Logs to Track Website Errors (In 3 Steps) While WordPress has error log functionality — also known as the ‘debugging mode’ — it’s turned off by default. Fortunately, changing this is easy. Let’s walk through how to activate and use your WordPress logs. However, before proceeding to the first step, you’ll want to have a recent backup of your website in place. You’ll be making an edit to a core WordPress file, which should be safe if you’re careful. However, there’s always the potential for something to go wrong, and a backup ensures you have a way to restore your site if the worst happens. Finally, it’s also smart to perform troubleshooting on a staging site. Creating a staging site isn’t difficult, and it’s a very useful resource to have, so we recommend doing this before moving on. Step 1: Access Your Website’s Files To activate your WordPress logs, you’ll need direct access to your site’s files. This can be done in a few ways, but we recommend using File Transfer Protocol (FTP). Using an FTP client you can log directly into your site. Then you can add to, edit, or delete files whenever the need arises. If you don’t have a favorite FTP tool already, the FileZilla client is a solid choice. It’s free and simple to use: After downloading and installing FileZilla, you’ll just need to enter your FTP credentials to access your site. These are provided by your web host, and can usually be found in your control panel. Once you have your credentials in hand, you can enter them into FileZilla. You’ll need a Host, Username, and Password (you can leave the Port field empty): Then, click on the Quickconnect button. When the client has connected successfully to your site, you’ll see a success message along with several new folders and files. Step 2: Edit Your wp-config.php File At this point, FileZilla should look something like this: There are four main quadrants here — check out the one in the top right corner. This window should contain a few folders, including the primary (or ‘root’) directory for your WordPress website. This folder might be called root or www, or it may have the same name as your site’s domain. Either way, open it up. In the bottom right quadrant, a long list of folders and files will appear: Scroll down until you find the one called wp-config.php. This is an important file containing key information about your site’s configuration and database. Right-click on it, and select the View/Edit option. Doing this will open the file in your computer’s default text editor: Scroll down the file, looking for a line reading: /* That’s all, stop editing! Happy blogging. */. You’ll need to paste in the following line of code before this: define( 'WP_DEBUG', true ); This snippet tells WordPress to activate the debug mode. It may actually be present in your wp-config.php file already, in which case you’ll simply need to change false to true. Right underneath that line, you should add one more snippet: define( 'WP_DEBUG_LOG', true ); This is what tells WordPress to keep a log of any errors that occur on your site. Together, these two lines are what set up your WordPress logs. At this point, you can save the file and close it. FileZilla will ask if you want to replace the old version of wp-config.php on your server with the new version — you should answer “Yes”. Step 3: Locate Your New WordPress Logs Your WordPress logs are now ready to go. Before we wrap up, however, let’s talk about how to use them. Your new error log isn’t going to track problems that have occurred in the past. Therefore, if you’re trying to troubleshoot a specific issue, you’ll need to trigger it again by interacting with the element or performing the action that caused it in the first place. This should prompt WordPress to log the error. You can find the record of this error by logging into your site again using FTP. In your site’s root folder, navigate to the wp-content folder, and look for a new file called debug.log: If you open it up, you’ll see a list of any errors, warnings, and other issues that have occurred on your site since activating your WordPress logs: At this point, you have a few choices. If you’re reasonably tech-savvy, you can attempt to figure out what the problem is on your own and fix it. In some cases, your WordPress logs might help you understand what’s causing the error, such as by naming the element at fault. However, performing your own troubleshooting can still be challenging if you aren’t a developer (or don’t have one on hand). If you need help, visit the WordPress forums and create a post asking for assistance. Be sure to include the text from your WordPress logs, and you should be able to get the help you need quickly. You can also try doing a Google search on the error, to see anyone has put together a guide for how to solve it. Finally, it’s a good idea to turn your WordPress logs off when you’ve finished your troubleshooting and found a solution. This is less important if you’re working with a staging site, but vital if you ever activate error logs on a live site. Leaving the log functionality on can slow down your otherwise fast WordPress site and expose sensitive information to potential hackers. To turn it off, you’ll simply need to open up wp-config.php once again, change true to false in both lines you added earlier, then save it. Wrapping up the Overview of WordPress Logs When errors occur, you may find yourself needing a little assistance. This is when WordPress logs come in very handy since they let you pinpoint the source of an error so you can search for a solution or ask for help. Before enabling WordPress logs on your site, it’s smart to have a recent backup in place and set up a staging site. Then, you can follow these three steps to create and use an error log: Access your website’s files using FTP. Edit your wp-config.php file. Locate your new WordPress logs. Questions about how to use WordPress logs to troubleshoot errors on your site? Ask in the comments section below. And for current Pagely clients needing help with logs, please review ‘Debugging Errors on WordPress & Viewing Logs.’
Pagely is thrilled to announce our partnership with Object Cache Pro. Utilizing state of the art compression technology, Object Cache Pro is now part of Pagely’s core offering, and available to all of our customers, platform wide. Offering major cost savings, access to some of the world’s best technology, and a dedicated DevOps team to personalize your setup, Pagely customers can look forward to continued scale and growth, with no hosting friction. A first of its kind partnership, Pagely is proud to help fund innovation in this WordPress space by investing part of our budget into working alongside the fantastic team at Object Cache Pro. We’ve already seen great gains with Object Cache Pro and our customers can look forward to more in the future! Why Object Cache Pro? Before Object Cache Pro, we faced two challenges with sites making use of an object cache – CPU overhead and network saturation. The underlying technologies in Object Cache Pro solved both of these problems for us, translating to less money spent on server hardware and fewer situations where the (quite generous) AWS network limits are reached. With Object Cache Pro’s state of the art technology utilizing the Zstandard compression library from Facebook, without a lot of CPU overhead, compression is now done at the extension level, talking to and from Redis. This means less hardware, lower costs, and a better experience for our customers. Aside from supporting an efficient compression algorithm (zstd), Object Cache Pro also uses the igbinary serializer which is a drop-in replacement for the standard serializer in PHP. This works about twice as fast at serializing and unserializing data. Additionally, the data footprint is smaller when using igbinary and that translates into less memory being used by the underlying Redis service. We also found an in-depth comparison on igbinary vs other serializers on Blobfolio that you may also enjoy reading if you’re into this kinda stuff: https://blobfolio.com/2017/03/benchmark-php7-serialization/ With a wide selection of Redis plugins available in the WordPress marketplace, Object Cache Pro was the obvious choice for us not only because of their forward-thinking tech but also because of the dependability we have come to expect and appreciate from their brilliant team. All of this aside, Object Cache Pro is unrivaled when it comes to bug fixing, an extent to which is a rarity across opensource software. There’s a saying in the opensource community that goes, “there’s a lot of eyes so all the bugs get fixed.” But, more what we see concentrated use of the software by lots of users leading to fewer bug fixes for fear of breaking one users’ site. That, and, no one owns the codebase, so less can get addressed in a timely manner. Similarly, we are continuously impressed by their coverage of testing, fully unit tested with 100% code coverage. Further, switching over to Object Cache Pro gives Pagely customers access to our commercial relationship with their team, which means any problems our customers see are fixed within a few days. You benefit from our relationship. Fewer bugs in the caching layer and full unit testing is a good thing, and that’s something we stand behind. So, What’s in it for the Pagely Customer? We are the first premium host to achieve this level of partnership with one of the best technology companies in WordPress. Through our relationship with Object Cache Pro, every single Pagely customer benefits from the work we’ve done to secure that. But real talk, what’s in it for you? Major cost savings. Even when it means less revenue for Pagely, we’re constantly looking out for cost savings for our customers. By decreasing our dependency on more hardware, you see the savings directly on your bill. Access to a premium partner. Since you’re at a premium hosting provider, you automatically get access to the partnerships we’ve developed. What’s more? You don’t pay an extra licensing fee. The best tech, baked into your Pagely account. We’re always on the hunt for the best and most innovative technology for you. With no effort on your part, we do the legwork of implementing this tech across our technology stack. All you do is benefit from it. Bigger performance wins possible with a little extra code work. WordPress has a feature called Transients. It’s a way to store the result of a complex query or a long-running remote API call temporarily in order to make subsequent lookups for that data return a lot faster without doing the same expensive operation again. Normally without any object cache, transients are stored in the WordPress database’s wp_options table. When using an object cache, it is stored in memory. Adding a few extra lines to your code allows you to tap into the power of this API for incredible performance gains. Having an efficient object cache utilizing fast compression and serialization only increases those gains. A dedicated DevOps team. While others might catch on and jump on the bandwagon of partnerships like this, Pagely still stands above the rest in meaningful ways that translate to real gains for you, the customer. Our DevOps staff becomes your dedicated, in-house team. Our engineers handle all the setup and optimization to make sure your usage of Redis is optimized specifically based on your exact circumstances and needs. Other hosts don’t do that! When you partner with Pagely for your WordPress hosting at scale, you know you have selected the most forward-looking host driven by advances in technology, cost savings for you, and tangible outcomes that help your business thrive. Object Cache Pro Helped FanSided Scale So let’s get to a real-life example here. One of the first Pagely customers we switched over to Object Cache Pro was FanSided. Here you can see a dramatic decrease in network utilization on the Amazon Aurora RDS instance after implementing Object Cache Pro along with custom Transients Caching, which dropped usage from 1 Gigabit per second to 400 Megabit per second; and yielded even lower usage after some more optimizations were made. FanSided comprises a massive network of over 300 active websites and needed a fast solution to maxing out servers and using way too much CPU. Pagely found that solution in Object Cache Pro and implemented it with no effort on FanSided’s part to completely eliminate those issues. Here you can see how memory is no longer being maxed out after the date we turned on Object Cache Pro for FanSided. The proof is in the data, and here you can see dramatic drops in CPU usage after Object Cache Pro was implemented, as well as servers being maxed-out-no-more after the switch. Dramatic drops in CPU usage after implementing Object Cache Pro for FanSided. Read the full FanSided + Object Cache Pro case study here, and take it from our CEO: “In the vacuum of 1 website, a small performance gain is useful. At our scale of hosting, processing hundreds of billions of requests per month across thousands of AWS EC2 instances, a small performance gain to each site means a real and quantifiable benefit to our customers and our bottom line. Now what if that performance gain was not so small, but major. We sought out and partnered with Object Cache Pro after seeing the dramatic results in terms of performance and resource usage when testing. We have thus deployed their Enterprise solution fleet wide and the results speak for themselves.” – Joshua Strebel, CEO of Pagely
Catch up on the conversation. This piece comes as a followup to our CEO Joshua Strebel’s recent piece on why you should never pay your WordPress host for pageviews. Managed WordPress hosting has exploded across the hosting industry since Pagely created it way back in 2006. Overall, the level of innovation that the mainstream has brought to WordPress is amazing. Unfortunately, this sometimes comes with negative side-effects. As investors demand higher profits, many of these managed WordPress hosts are looking for ways to gain a quick and easy boost to their margins. Like we mentioned in our definitive guide to PHP workers, there are a few different metrics that are often misinterpreted, whether intentionally or not. Today, we’re going to talk about pageviews and their role in the managed WordPress hosting world. What Counts as a Pageview? Many hosts cite pageviews as a billing metric with vague term descriptions, if any exist at all. Even with clarified definitions, pageviews tend to mutate on a host-by-host basis with a dizzying array of buzzwords. Although individual managed WordPress hosts vary on what they consider a “pageview”, most define it like this: pageviews are the number of unique IP addresses that access pages on your WordPress site per day, excluding known bots. (Yeah, I know. The term is more like “the number of unique request sources per day, based on predefined catch-all filters.” But I wasn’t the one that made this up, so bear with me here.) Pageviews as a Billing Metric Before we dig in any deeper into the details, let’s think about the definition that I mentioned. Considering that narrative, which of these sites would be more expensive to host? A directory website that houses billions of pages, showing 1,000 entries at a time. A personal blog who’s majority of traffic is to single posts. A documentation site where visitors typically access multiple pages per day. A simple informational website for a local restaurant. An online shop that sells small-batch artisanal snake oil. An API that uses headless WordPress to dynamically fetch content. If you guessed that they represent the same metrics in the eyes of pageview-based billing, your logic prevails! Assuming that they all experience the same number of unique visitors, they’re all treated the same way, regardless of how resource-intensive the site is or how many pages each visitor accesses. Of course, it would be silly to treat all of these sites the same way. Some pages might have large amounts of fully dynamic content, while others might be eternally served from cache. Using an umbrella term like pageviews as a billing metric causes several different issues, based on the site being hosted. Setting Realistic Expectations The first issue that pageview-based billing causes is an unrealistic expectation for low-performance, unoptimized sites. If you’re not familiar with how WordPress sites perform on the server side, you might think that these limits matter exclusively and use them to determine what capabilities you need from a hosting provider. If you’re evaluating your hosting options purely based on a pageview limit, you’re ignoring critical factors that can dramatically impact your WordPress site. Performance-Based Punishment What if you’ve put hard work into optimizing your site? Well, now you’re wasting money on a billing metric that doesn’t matter. If your site is highly cacheable, you’re feeling the impacts even further. When serving content from cache, it’s practically free from a hosting perspective. You’re being nickel-and-dimed for something that is entirely outside of your control. Knowledge is Power As you scale, knowing what you’re paying for can quickly become a critical part of maintaining a healthy, cost-effective site. Coupled with the fact that the same people who are charging for pageviews tend to hide their underlying infrastructure behind the curtains, there’s no way to verify or manipulate what’s being counted. While many claim that they exclude the known IP addresses and user agents of known bots from counting towards your monthly pageview bill, what’s their motivation for even bothering? After all, more pageviews mean more money in their pockets. Pageviews Are Still Helpful Many of our prospective customers ask, “How many pageviews can ‘x’ plan handle?” Like we mentioned earlier, the impact of each pageview dramatically varies based on the type of content viewed and how your site was developed. Every WordPress site is different. It would be impossible to accurately estimate the ideal hosting environment without a complete understanding of what your site’s usage looks like. Although pageviews are a faulty metric as far as billing is concerned, they can still be useful as part of a larger dataset. Whether you’re scaling, optimizing for better performance, or shopping for a new hosting provider, pageview data plays a role in getting a full picture of your site. For example, if you were running benchmarks to determine your server’s capacity, pageview data could be used to identify what a typical day looks like. Let’s say your site looks something like this: 10% of traffic is on the home page. 30% of traffic is to various landing pages. 30% of traffic is to different blog posts. 20% of traffic is to your product’s pricing page. 10% of traffic is on account-related pages. Using that traffic data, you could then estimate what types of content have the most significant impact on server resources. You may find that some pages underperform and could use some optimization, while other highly-cacheable content, like blog posts or landing pages, remain essentially free. If 90% of your traffic goes to fully-cached content, increases in traffic have a trivial impact on your bottom line, if any. Closing Remarks Operating a WordPress site at scale is all about a delicate balance of performance and cost. At Pagely, we partner with our clients to help them achieve those goals. While shopping for a new hosting provider, be on the lookout for hosts that impose false barriers, such as PHP worker limits and pageview counts. Those vague limitations are a red flag that they’re going to try to upsell you later. (These limitations are also a sign that they’re trying to sell you on shared hosting resources too, but that’s a topic for another discussion entirely.) We hope that you’ve learned more about the impact of pageviews (or lack thereof) and why it’s not an appropriate billing metric. Do you have any experiences with pageview-based billing that you’d like to share? Is there something we missed? Let us know in the comments below.
This monthly report is provided for the WordPress community at large from Pagely’s head of security, Robert Rowley. Rowley and the entire security team keep their finger on the pulse of any potential vulnerabilities that might affect our customers, as well as any WordPress user. We sincerely hope these efforts help any and all that could use information from the experts on monthly security issues. We commend the researches and developers that help to identify and patch these issues in a timely fashion. WordPress Core No notable WordPress core security releases. Plugin/Theme Vulnerabilities of Note Security & Malware scan by CleanTalk https://wpvulndb.com/vulnerabilities/10292 This vulnerability within CleanTalk allows an authenticated user, such as an editor or subscriber, to make unauthorized Ajax calls which could lead to file deletion or downloads and also potentially function calls. Adning Advertising https://wpvulndb.com/vulnerabilities/10293 The Adning Advertising plugin has a vulnerability in versions lower than 1.5.6 which allows unauthenticated requests to upload or delete files, leading to an RCE attack, which can then lead to full site takeover. Wise Chat https://wpvulndb.com/vulnerabilities/10299 Wise Chat versions lower than 2.8.4 are susceptible to a CSV injection via a command sent in chat messages by an unauthenticated user that is included in an exported CSV file, which then could potentially lead to an RCE attack. Email Verification for WooCommerce https://wpvulndb.com/vulnerabilities/10318 The Email Verification for Woocommerce plugin prior to version 1.8.2 is affected by a loose comparison issue. This could potentially lead to any user (authenticated or non-authenticated), to log into the WordPress site. SRS Simple Hits Counter https://wpvulndb.com/vulnerabilities/10316 The SRS Simple Hits counter plugin is currently vulnerable to an unauthenticated blind SQL injection vulnerability. The responsible reporting parties at Tenable ( https://www.tenable.com/security/research/tra-2020-42 ) are working with the developer to write a more comprehensive patch to address this vulnerability, and will not release more details on the attack until they know a patch has been released. Site owners using SRS Simple Hits Counter plugin on their sites should keep an eye out daily for the patch to be released. Payment Form For Paypal Pro https://wpvulndb.com/vulnerabilities/10287 The Payment Form for Paypal Pro plugin versions before 1.1.65 are vulnerable to an unauthenticated SQL injection attack. The attack is a trivial single request which can expose the contents of your database (which includes user passwords and potentially other secrets) to the attack. This is a high risk vulnerability and site owners should patch immediately. WooCommerce Subscriptions https://wpvulndb.com/vulnerabilities/10330 The WooCommerce Subscription plugin is vulnerable to an unauthenticated stored cross site scripting (XSS) attack in the subscription billing process. Attackers can submit their XSS attack payload to during the billing step in the signup process, and later that payload will be executed on the browser of the administrator/user who reviews the attacker’s account. Site owners should update WooCommerce Subscriptions plugin to version 2.6.3 and not check any new user account information until that update is performed. TC Custom JavaScript https://wpvulndb.com/vulnerabilities/10325 The TC Custom Javascript plugin is vulnerable to an unauthenticated stored cross site scripting attack. Sites running versions before 1.2.2 should update immediately, attackers can add their own javascript or HTML to the footer of all pages loaded by WordPress with a few basic requests. This vulnerability is likely to be targeted by SEO spam bots. KingComposer https://wpvulndb.com/vulnerabilities/10297 The KingComposer plugin is vulnerable to a reflected cross site scripting vulnerability in versions before 2.9.5 This means the attacker’s malicious HTML/javascript will only be available to the browser making this request. This still poses a high risk if an attacker can trick an already logged in user to click on a malicious link/form to the website, potentially exposing secrets viewable by the user giving them to the attacker. JobSearch https://wpvulndb.com/vulnerabilities/10328 The JobSearch plugin versions before 1.5.6 are vulnerable to a reflected cross site scripting vulnerability. Much like the KingComposer vulnerability above it is a high risk if logged in users to be targeted. The proof of concept for this vulnerability will be released on August 6th, 2020, site owners should patch before this date. See previous months’ WordPress security updates from May and June.
The benefits of this WordPress security guide are two fold: Learn exactly what you need to know about WordPress security in 2020. Understanding WordPress security helps you adopt a security-oriented mindset that will help you prevent and mitigate risks as you make day-to-day decisions. Get actionable, step-by-step instructions for securing your WordPress site. The steps you need to take aren’t particularly time-consuming, don’t require advanced technical knowledge, and the linked guides are vetted for clarity and completeness. Of course, it’s impossible to cover every possible vulnerability and scenario. That’s why we also include the overarching “principles of WordPress security.” If you can follow these broad principles many of the minute details that are difficult to address in this type of post will take care of themselves. Why is WordPress security critical? It’s important you understand how big an issue WordPress security is so you give it the time and attention it deserves. Here are some sobering statistics: Google blacklists 10k sites a day for malware and another 50k for phishing each week. A blacklist from Google kills that source of traffic which can be highly disruptive to a business’s revenue. Fixing and removing a blacklist can be a hassle, particularly if your server was used to send SPAM emails. A blacklist from email service providers harms your deliverability rate which undermines the effectiveness of your email marketing. In 2018, 90% of CMS hacks were WordPress. Granted, WordPress is the world’s most popular CMS with 34% of the web powered by WordPress, but this is still a disproportionate amount of hacks. For a variety of reasons, WordPress sites are targeted and exploited more than any other CMS. 60% of attacks target small businesses. You may think that hackers won’t bother with your site because you’re a small fish but “security through obscurity” does not exist on the web. No one is too small to be a victim of an attack. WordFence reports that there are over 97,978 attacks happening per minute. This is not a small, isolated problem. Large swaths of WordPress sites are being probed for weaknesses at any given time. Will you be ready if your site is targeted? While these stats paint an intimidating picture of what you’re up against, it’s important you confront the realities of managing a WordPress site in 2020. If your business relies on WordPress, security is not something you can afford to ignore. If you haven’t taken steps to secure your site, you’re vulnerable to attack. It could be only a matter of time until your site becomes compromised. This is one area where “an ounce of prevention is worth a pound of cure.” The principles of WordPress security Securing WordPress is more than checking off a list of boxes, it requires you to adopt a security-oriented mindset that guides your decision making. These principles will help you prevent mistakes as you make day-to-day decisions like adding new WordPress users, plugins, and themes: Vulnerabilities are often introduced by WordPress users. Vanilla WordPress that is kept up to date and uses strong passwords is relatively secure. It’s often the decisions made by WordPress users that create weaknesses that hackers exploit. This is why articles like this one are so important. It’s up to you to be educated on, and consistently follow, the WordPress security best practices outlined here. Minimize plugins and themes. New WordPress users are often overjoyed by the extensive ecosystem of plugins and themes available for WordPress. This can lead to indiscriminate installation of plugins. But, each new plugin or theme adds code to your site that, potentially, adds new vulnerabilities. By minimizing the plugins and themes installed, you also minimize the amount of code your site uses, and, by extension, the number of potential security vulnerabilities. In general, if you can solve a problem without installing a plugin, that’s the best option. Install updates as soon as possible. Updates to the WordPress core and updates to plugins and themes often contain critical security updates. They should be installed as quickly as possible. If you have a good back up strategy in place, you can roll back to a previous version in the event the update causes issues. Follow the principle of least privilege. This is a core principle of cybersecurity in general and is not unique to WordPress. This is a fancy way of saying, “don’t give a user more privileges than they need because those extra privileges give hackers more power and access than they’d otherwise have if they compromise that account.” Attacks can still happen. You can try as hard as you can to cover all the bases and still fall victim to an attack. This is why regular, automated backups are critical. Do not ignore this advice. A hacked site can be disruptive but can generally be fixed with minimal cost and disruption, a hacked site without a backup to roll back to can be severely disruptive. You are never finished with security. Having a 100% secure WordPress site is an impossible task. You can’t accomplish complete risk elimination, so aim instead for ongoing risk reduction. This “risk reduction” mindset prompts you to continue taking steps to improve your security as part of an ongoing, never-ending initiative. The most common WordPress attack vectors Understanding the most common methods hackers use to exploit WordPress will help you understand how to address them and why the steps recommended later in this article are necessary: Brute Force Attack A cyber criminal uses trial and error to identify a password or pin. They use combinations of common usernames and passwords until they find the right one. It’s the equivalent of trying every key on a key ring to find the one that works. This is all done using a computer script so they can run thousands of combinations with very little effort. Given enough time, any account is hackable but strong passwords thwart this kind of attack. SQL Injection Malicious SQL code is injected into a database to gain access to database information that was never intended to be displayed. Depending on the hackers goals, this can lead to your database being deleted, customer information being stolen, or sensitive company information being accessed. Malware A virus or spyware is inserted using an expired theme or plugin. The attacker can gain access to your data, insert pages into your site for black hat SEO, and perform a number of other nefarious activities using your site. Cross-site scripting Javascript code is inserted which then collects data commonly used to exploit WordPress plugins. This can be used to redirect your site visitors to malicious content. also known as an “XSS attack.” DDoS Attack A Distributed Denial of Service (DDoS) attack floods a website with traffic which overwhelms server resources causing it to fail. Multiple machines send frequent requests to the server using malware installed on those machines for that purpose. The distributed nature of the attack can make it difficult to identify and block the sources of the traffic. Now that you understand how hackers will attempt to breach your site security, let’s look at how we can block and prevent these attacks… Steps to secure your WordPress site In spite of the many ways your site can be compromised, it is possible to mitigate these risks and prevent many attacks. Here’s a list of recommended steps to protect your WordPress site from security attacks: 1. Force Strong Passwords “81% of attacks are based on insecure or stolen passwords” “It only takes about 10 minutes to crack a lowercase password that is 6 characters long.” These two facts taken together make the case that you must use strong passwords for all WordPress users. Strong passwords are long and use a combination of upper and lower case letters, numbers, and symbols. Longer is better but 20-characters is probably plenty. Strong passwords are difficult to memorize, especially if you’re using unique passwords for each site (you should be!). This means a password manager, such as LastPass or Dashlane, is a critical tool. These apps make creating strong passwords easy, store them in a central location, and make logging into your websites easy by autofilling your passwords. Here’s how to make sure all your WordPress users are using strong passwords. 2. Turn on automatic WordPress Core updates One of the advantages of using a popular CMS like WordPress is that there are many people with a vested interest in keeping it secure. Thousands of people are contributing to WordPress security by reporting vulnerabilities to the WordPress team. This widespread collaboration means most holes are patched relatively quickly. But, if the updates that contain those fixes are not applied, you leave your site vulnerable to attack. The best way to ensure your WordPress core updates happen quickly is to turn on automatic updates. This way your WordPress site will be kept up-to-date without you having to do anything. Here’s how to turn on automatic core updates by modifying your config.php file. 3. Stay on top of plugin and theme updates You absolutely must keep your plugins and themes up-to-date. The importance of this cannot be overstated. You’ll also want to be careful to use plugins and themes that are updated often. If you’re using a plugin or theme that has not received an update in months, it’s a good idea to check in with the developer or find a more frequently updated plugin that accomplishes the same goal. When you search for a plugin in the WordPress plugin database, this information is provided in the sidebar: 4. Use Two-Factor Authentication (2FA) Two-factor authentication adds a layer of protection to your WordPress site by making it nearly impossible for a hacker to log in to your site — even if they know your username and password. You should set up 2FA for all WordPress users. 2FA can be set up quickly with simple, free plugins. Here’s a list of available 2FA plugin solutions for WordPress. 5. Brute Force protection Even with 2FA and strong passwords, it is good to setup brute force protection to help with overall performance on the server by reducing the amount of work PHP has to do. Here’s how to protect your site from brute force attacks. 6. Create automated, scheduled Backups In the event of an issue, there should always be recent database and file backups available. You should also create a backup before making any major changes to your site, such as installing plugin and theme updates. Many of the popular backup solutions take care of this for you. Here’s a list of backup solutions for your WordPress site 7. Change your login pages The default login pages for all WordPress sites are sitename.com/wp-login.php and sitename.com/wp-admin.php. Using these default login page URLs makes it easy for hackers to begin a brute force attack by trying combinations of usernames and passwords. By using a login URL that is difficult to guess, it makes it more difficult for hackers to begin the brute force attack because they don’t know where the login form lives. Here’s how to change your login page URLs. 8. Use SSL Secure Sockets Layer (SSL) encrypts all data sent from your website to the visitors browser obscuring potentially sensitive data. Using SSL has many benefits in addition to security. Google may rank your site higher in the search results and many browsers indicate whether a site is secured by SSL which can reassure them your site is trustworthy. Here’s a tutorial on setting up SSL for your WordPress site 9. Don’t use the default database prefix Using the default “wp_” database prefix makes it easier for a hacker to insert code into your database (SQL injection). Here’s how to change the default database prefix for a new site and an existing site. 10. Check your folder and file permissions File permissions define what actions can be applied to the files on your server. You should never set any WordPress file or directory to 777 permissions. Instead, make sure your permission scheme is as follows: Folders – 755 Files – 644 Here’s a guide to checking and fixing the permissions of your WordPress files and folders. 11. Disable pingbacks WordPress pingbacks are enabled by default. But for most sites, they offer little benefit. But, they can be used to turn your WordPress site into an unwilling participant in a DDoS botnet. To turn off pingbacks, you can go to “Settings –> Discussion” and uncheck the “Attempt to notify any blogs linked to from the article” box. It’s also a good idea to uncheck the “Allow link notifications from other blogs (pingbacks and trackbacks) on new articles” box: 12. Hide your WordPress version number One of the ways attackers gain access to a site is by exploiting known vulnerabilities in outdated versions of WordPress. Hackers can scan your site and easily find out what version of WordPress you’re using. If that version has a known vulnerability then the hacker has a good idea of how to proceed. The best way to prevent this is to keep WordPress up to date. However, you can also prevent a hacker from finding out what version of WordPress you’re running. Here’s how to hide your WordPress version number. 13. Don’t use the admin username Hackers can safely assume that a WordPress site is using the default “admin” username and that username will give them admin privileges so all they need to do is figure out the password. This gives them a direct path to gaining admin access to your site with a good probability of success. Eliminating the admin username makes it significantly more difficult to attack your site this way. If you’re already using the admin username, that’s okay, you can change it now. Here’s how to change the admin username. 14. Use a secure Managed WordPress Host A host that supports all the major CMSs will have difficulty staying on top of WordPress security. By specializing in the WordPress CMS alone, a WordPress hosting provider can devote the resources necessary to prevent many attacks. A reputable Managed WordPress Host will have a security team dedicated to shielding your site from threats. They’ll handle many of the concerns raised above like taking care of WordPress updates, creating backups, and more. Here at Pagely we have a comprehensive suite of security features called PressArmor that handles both WordPress application security and server security. Security questions to ask a potential managed WordPress host: Is your hosting environment chrooted? If your host has multiple domains on the same server, check with them to ensure they use chroot to isolate each WordPress app. If one app is hacked, this would help prevent access to other apps on the server. Is SSL included and easy to set up? A good WordPress hosting provider will provide SSL free of charge using a service such as Let’s Encrypt. Do you actively monitor my site specifically for WordPress vulnerabilities? If you detect a vulnerability on my site, how will you inform me? A good WordPress host will stay on top of the latest threats to WordPress sites and constantly scan your site for those threats. If they find a vulnerability, they will work with you to address it. Are you using a web application firewall (WAF) to protect my site? A WAF block malicious traffic before it reaches your site and can help prevent XSS attacks and SQL injections. Here’s a list of important considerations for choosing a Managed WordPress Host. Conclusion WordPress security cannot be taken lightly and you must take steps to secure your site. Using a Managed WordPress Hosting Provider like Pagely is one of the best ways to improve your security because you will have an experienced team dedicated to protecting you. Whether you choose to handle WordPress security yourself or leverage a host that specializes in WordPress, it’s important to treat WordPress security as an ongoing effort. You are never done with security but if you’ve taken the above steps you’ve protected yourself from many of the most common threats.
Since this is the internet – and the rules of the internet clearly state everyone gets an opinion, I’d like to share one of mine around website hosting billing plans. Quick backstory: 10+ years ago when we launched Pagely we did so with a simple line on our pricing page denoting a rough estimate of the expected capabilities of that plan ie: Plan – 1 was suitable for ~1 million pageviews. Along came the next several providers who did something similar with one important difference. They actually attempted to measure and cap pageviews per hosting plan, bracketing their plans by this new billing metric. In my opinion Pageviews used as a billing item is a predatory and anti-consumer practice and you should be very wary of working with any company that applies this #successtax to your monthly bill. Definition of anti-consumer : not favorable to consumers: improperly favoring the interests of businesses over the interests of consumers Hi, I’m Joshua Strebel, Co-founder and CEO of Pagely – A leading Managed WordPress hosting company – Thank you for attending my TED Talk. What are you buying when you are buying “hosting”? To host a WordPress site you need a few key components. A server (a computer) connected to the internet with software installed to process requests and responses for your application. Storage / Disk space attached to that webserver to save your files to. Data Transfer / Bandwidth. This is the pipe the information flows through. That’s basically it. Hosting providers typically lease/sell you packaged fragments of these resources for a monthly fee. Plan A, Plan B, Plan C. etc. Of course there are other items that may be line-itemed such as included support levels, CDN GB’s per month, managed services, etc. Plan A has X amount of consumables for Z price. It’s all fairly straightforward as most consumers understand what a Gigabyte of Disk space is and can at least grasp that more CPU/RAM offered should equate to more potential performance. “Pageviews” does not fit this model well – as the definition of a pageview is amorphous and subject to exploitation. Oh, and spoiler alert, PHP workers is not a valid billing metric for WordPress hosts either. What does an automobile lease have to do with hosting plans? Pageview limits on hosting plans are akin to annual mileage limits on auto leases. It’s a cap on the use of an asset you already purchased. In an automobile lease context a mileage cap at least has some merit as being a form of controlling the depreciation of the vehicle – you are essentially financing the deprecation of the automobile asset with a lease – and the lease company expects to sell that car (New retail value – Depreciation) when you return it. If the depreciation is too high, they lose money on that transaction as they have to sell it for less than they calculated. Your hosting plan is not a depreciating asset though – the hosting company is going to sell the same resources to the next customer when you are done for the same or likely higher fee. Therefore in my humble opinion: Pageviews are just an arbitrary anti-consumer fee – a penalty tax for using the service you already paid for. A Pageview is (depending on who you ask) a wrapper around these items: A measurable amount of Data Transfer in and out A measurable amount of CPU resources to process the request and render the response A measurable amount of Disk and Database activity Are you not already paying for these items as part of your hosting plan? Hint: Yes you are. But wait, there’s more – and my colleague will dig into these more in a future post. This pageview billing model is so poorly defined by the hosts that use it – it is ripe for abuse. It’s a scheme to generate revenue for the hosting company and unfairly penalizes the consumer. Hint: You already “paid” for the sum of the parts of a “pageview”. No two pages are the same. A cached page even with a few images can be served a million times a month with ease, and yet a badly coded membership-site page may tax the hardware it runs on each time it loads. They have very different cost profiles to the host – yet both are treated equally under this model. If you invested the time to optimize your site, get it caching well and then blow it up with viral traffic.. That is a GOOD day for you and costs your host pennies of the monthly fee you are already paying them – yet when you get the overage bill for exceeding your pageview cap at the end of the month, are you going to enjoy that tax on your success? If you want to keep paying twice for the same resources you are welcome to. I simply do not think that is fair. Our friends down in Austin have made millions on charging their customers overage fees for exceeding their monthly pageview cap – even to the point having to publicly respond to criticism – only to keep the practice in place. Reminds me of airline baggage fees and fuel surcharges. and An “online payment convenience fee” when they only accept payments online. and JetPack being “free”. Happy WordPress’ing – Joshua Strebel
These monthly reports are provided for the WordPress community at large from Pagely’s head of security, Robert Rowley. Rowley and the entire security team keep their finger on the pulse of any potential vulnerabilities that might affect our customers, as well as any WordPress user. We sincerely hope these efforts help any and all that could use information from the experts on monthly security issues. We commend the researches and developers that help to identify and patch these issues in a timely fashion. WordPress Core WordPress 5.4.2 Security Release https://wordpress.org/news/2020/06/wordpress-5-4-2-security-and-maintenance-release/ A WordPress Security release (5.4.2) was made available on June 10th. This release addresses the following 6 vulnerabilities: Authenticated XSS in the block editor Authenticated XSS in media files Authenticated XSS in theme uploads Privilege escalation in set-screen-option() Open redirect in wp_validate_redirect() Information leak allowing comments to be read from password-protected posts and pages. Plugin/Theme Vulnerabilities of Note Removed from Repo WordPress website owners who have the following plugins installed are strongly encouraged to remove them from their websites or find a replacement as soon as possible. These plugins were removed from the WP.org plugin repository due to inaction of the developer to patch one or more security flaws: wp-pro-quiz delete-all-comments-easily High Severity Vulnerabilities ACF to REST API https://wpvulndb.com/vulnerabilities/10284 The acf-to-rest-api plugin versions before 3.3.0 are affected by a vulnerability which would disclose the values of the wp_options table to attackers. This vulnerability has varying severity based on what data is contained in a site’s wp_options table. KingComposer https://wpvulndb.com/vulnerabilities/10270 The kingcomposer plugin versions before 2.9.4 lack proper access controls for ajax endpoints, many of these ajax endpoints also include vulnerabilities which users with a valid accounts could target to change WordPress option values, inject content, store XSS code, delete files on the site or execute arbitrary code. wpDiscuz https://wpvulndb.com/vulnerabilities/10273 The wpdiscuz plugin versions before 5.3.6 are affected by an unauthenticated SQL injection vulnerability. This plugin is currently on release 7.0.3, and the plugin author is making 5.3.6 available as a back port for site owners not ready for version 7. Brizy – Page Builder https://wpvulndb.com/vulnerabilities/10261 Brizy Page Builder before version 1.0.126 is susceptible to an access control vulnerability via AJAX calls which allows a user with minimal privileges the ability to access editor functions. JobSearch https://wpvulndb.com/vulnerabilities/10255 The Jobsearch premium plugin before version 1.5.1 is affected by an unauthenticated reflected cross-site scripting vulnerability. The Proof of Concept is provided within the link below and is easily replicated: https://github.com/vladvector/vladvector.github.io/blob/master/exploit/2020-07-03-jobsearch-wp-job-board-wordpress-plugin-v1-5-1.txt See previous months’ WordPress security updates from April and May.
This article covers our public notifications related to major security issues our clients and the WordPress community should know about. We are always focused on prevention and the mitigation of risk to our clients, and keeping you updated here is part of that process. WordPress 5.4.2 Security Release June 11th, 2020 WordPress site users We trust them within reason. And patch, to be sure. The WordPress security team has released WordPress 5.4.2. This security release addresses 6 security vulnerabilities. There are numerous cross site scripting vulnerabilities addressed in this release however each required an authenticated user to execute the attack. There also includes one privilege escalation attack. If there were a theme in this release, it serves as a reminder to be sure you trust who you give accounts to on your WordPress site. The Pagely team has already begun rolling out this patch for all customers. If you have a version hold request on file, we will patch your site while keeping it on the same major branch version. WordPress 5.4.1 Security Release April 29th, 2020 You are safe at home, while we are patching your sites. Stay Safe. Stay Secure. The WordPress security team has released WordPress 5.4.1. This security release addresses 7 security vulnerabilities and includes 17 bug fixes. There are numerous cross site scripting vulnerabilities addressed in this release, so it is recommended site owner update right away (if you’re a Pagely customer we are already working on this for you.) The Pagely team will be rolling out this patch for all customers shortly. If you have a version hold request on file, we will patch your site while keeping it on the same major branch version. WordPress 5.3.1 Security Release December 13th, 2019 A vuln is a vuln, until a patch is released. Now it is secure. The WordPress core team has released WordPress 5.3.1, which addresses 3 security vulnerabilities and includes 1 security hardening measure. The higher risk vulnerabilities include XSS (Cross Site Scripting) in some unlikely situations, as well a vulnerability which could allow someone to mark a post “sticky” on the site, without the need for authentication. Pagely has tested this version and has the patch available for all customers running any WordPress version. Due to the weekend being upon us, we will begin upgrading sites on Monday December 16th. Any customers who would like the upgrade to be performed over the weekend can reach out to our support staff and they will be glad to help. PHP-FPM+Nginx Remote Code Execution (CVE-2019-11043) October 29th, 2019 Hasty vuln released. We checked immediately; Our servers are safe. On October 22nd, 2019 a security researcher released their findings related to a remote code execution in PHP-FPM, which was present on hosts with specific nginx configurations using fastcgi_split_path_info. Pagely’s stack does use the fastcgi_split_path_info directive within our nginx configurations, and our staff investigated the vulnerability on the 22nd the day of the relase. We identified we were already properly using the recommended remediation of try_files to ensure the file being requested actually exists on the website. Pagely’s default nginx configuration is not vulnerable. On October 24th the PHP dev team released the official patch version to address this vulnerability. Our staff have already started applying this patch to all customer servers. WordPress 5.2.4 Security Release October 15th, 2019 Secure WordPress Fast Six Vulnerabilities Secured by this Patch. The WordPress.org core team has released WordPress 5.2.4, a security release addressing six vulnerabilities from XSS to viewing unauthorized posts. Pagely staff have already begun applying patches to our customer’s WordPress websites. Customers with version holds will only receive the patch for the branch they are currently running. WordPress 5.1.1 Security Release Addresses XSS March 15th, 2019 Comment filter for Cross Site Scripting prevention; Helps secure WordPress. The WordPress.org core team has released WordPress 5.1.1 which is a security release to address two vulnerabilities related to improper filtering of comments on WordPress sites. Pagely staff have already begun applying the patch for each of our customer’s WordPress version, and will keep customers on their current branch version if they have requested a version hold. WordPress 5.0.1 (and 4.9.9) Security Release December 13th, 2018 WordPress new release Patches seven vulns in all. Handled by our team. The WordPress.org core team has released WordPress 5.0.1 which is a security release to address a number of vulnerabilities found in WordPress versions 5.0, 4.9.8 and older. The core team has also provided security releases for WordPress versions 4.9.x, 4.8.x, etc.. which addresses the same vulnerabilities for that WordPress branch release. Pagely staff will apply the appropriate patch for each of our customer’s WordPress version, and will keep customers on their current branch version. This means, if you’re running 5.0, we will apply the 5.0.1 patch, if you’re running 4.9 then we will apply the 4.9.9 patch, and so on with 4.8 and etc… This patching will be completed by the end of the week. WordPress 4.9.7 Security Release Addresses Arbitrary File Delete (CVE-2018-12895) July 5th, 2018 We patched this last week. This security release is safe to wait for. The WordPress.org core team has released WordPress 4.9.7 which adds some functionality and includes a security patch for the previously reported “Arbitrary File Delete” vulnerability (CVE-2018-12895) which we addressed last week Pagely implemented a patch to address this vulnerability on all customer websites, as there was no WordPress.org patch available when the vulnerability was publicly disclosed. Pagely customers can request to be upgraded to patched versions of WordPress over the weekend, all customer sites will be upgraded by early next week. WordPress Author Arbitrary File Delete (CVE-2018-12895) We trust our authors, to not delete files, but let’s not allow it. RIPSTech researchers Slavco Mihajloski and Karim El Ouerghemmi reported yesterday of a vulnerability in WordPress core which would allow users on a WordPress site with Author level access or higher the ability to delete and/or re-upload any file writable by the PHP process WordPress runs under. The limitation of this vulnerability hinges on the fact a malicious user must also be someone a site owner trusted with having author level access already (or a compromised author user account could be abused) The consequence of this vulnerability would be that an attacker or malicious user could potentially remove files on the server, which may disable protections (such as .htaccess files, or security plugins), or allow them to re-write a site’s wp-config.php (to point your site at the attacker’s database, or install their own credentials/secret keys.) Our infrastructure configuration does not allow PHP processes to be able to modify any WordPress core files, however the risk of modifications to plugins, .htaccess files or other user uploaded files remains. To address this we have implemented a recommended hotfix which sanitizes the file path in the attachment delete/modification function used by WordPress core. The patch implemented has been tested and verified as safe and will be pushed out to our customer servers this week. If for any reason this hotfix causes issues with your site user’s ability to remove or edit media on your blog, please let our support staff know and we can help sort out the problem. PHPMyAdmin File Inclusion and Remote Code Execution (CVE-2018-12613) (PMASA-2018-4) Admin your DB with php, securely. We did the upgrade Pagely customers who have phpMyAdmin configured on their servers can rest assured we have taken steps to upgrade all of our customer’s phpMyAdmin installations to address multiple vulnerabilities recently reported. TLS 1.0 Retirement It’s been a long time coming, so break out the gold watch and cake. TLS 1.0 is finally being retired across the web thanks to the push by PCI-DSS. Pagely is updating our customer websites this week to address this and will be supporting TLS 1.1 or higher by default on our servers this week. By default, customer websites will only communicate over HTTP using the more secure TLS 1.1 and 1.2 protocol versions, and TLS 1.0 will no longer be an option. The reason for the change has been a long time coming. There are multiple browser based vulnerabilities in TLS 1.0, and the protocol version has been depreciated for years. However, the big deadline is that PCI-DSS counsel has set a hard deadline for June 30th, 2018 as the final day that sites will no longer be able to pass PCI scans if they have TLS 1.0 enabled in any manner. The impact of requiring TLS 1.1 or higher, is almost certainly going to be negligible. Every major browser supports TLS 1.1 and 1.2, rough estimates put less than 4% of the global internet traffic as using a browser that only support TLS 1.0, this is mostly composed of old mobile devices. So, sorry everyone on a dated iPad or Android tablet/phone, it’s not safe for you to transmit data over HTTPS and hasn’t been for a long time! Luckily, this number continues to drop every year, as these old devices eventually get replaced or taken out of service. Pagely Login Page Updates Pagely customers will notice something new when accessing their Pagely administration panel https://atomic.pagely.com on May 31st 2018. Our new login portal! Don’t worry, this change is expected as we are rolling out some improvements to our administration panel and preparing for it’s replacement. When you visit https://atomic.pagely.com your browser will automatically be redirected to our new version of Atomic. You may see the words “BETA” here and there, and some customers (those already upgraded to ARES) will have new features available as well. There is nothing you need to do on your end at this time, your login will function as normal and the new atomic panel has all the same basic features as the old one — If you’re feeling a little nostalgic, you can still switch back to the old Atomic panel by hitting the “Atomic (Legacy)” button found in the panel. In the near future we will be offering a new 2FA feature to give our customers a better experience with their 2FA management, but this first login portal change on 2018-05-31 will not affect your existing login credentials. PHP Security Patch (CVE-2018-10546 CVE-2018-10547 CVE-2018-10548 CVE-2018-10549) You need a null byte; Or you get heap overflows! MakerNote take Note. PHP has released a security patch which addresses four security vulnerabilities, the worst of which is a heap overflow from uploaded images which lack null bytes or corrupted EXIF data in MakerNote files. Further details available in the PHP 7.0 Changelog and PHP 5.6 Changelog. Pagely has begun upgrading customer servers and all PHP versions will be on patched in the next few days, if not already. WordPress 4.9.5 Release Secure hardening in the four nine five release; Other bugs fixed too. WordPress version 4.9.5 has been released and is considered a security and maintenance release. The WP core team addressed 3 security related bugs which are not critical security bugs, but improve the code’s overall security. You can read more about the release here. Pagely will begin updating customer sites to 4.9.5 shortly. POP-ping WordPress Object Injection? DNS must be trusted. Or else, oh no! Hacks! Researcher Nick Bloor (@nickstadb) recently released a report on object inject+DNS vulnerabilities in WordPress which could lead to remote code execution/arbitrary file uploads to sites. Nick explains that if attackers control the name servers the website uses to lookup domains, then it’s possible to “spoof” being the WP update server due to WordPress defaulting to HTTP communications when HTTPS fails during updates. This report outline that if attackers were able to take control of a DNS server, they could pivot that access to then also take over WordPress website via the WordPress auto-updater as well as exposes a PHP Object injection as well. Pagely customers are not affected by this vulnerability, as we are a managed host and do not allow modifications to what name servers our customer’s servers utilize. Secondarily, our server permissions would not allow WordPress auto-updater to function on it’s own (we handle upgrades for customers), this is identified in the “caveats” section of the vulnerability disclosure page as a preventative measure. WordPress load-scripts.php DoS (CVE-2018-6389) Feb. 6, 2018 Loading all the scripts, leads to long web responses. Rate limiting, Win. We are aware of the reported Denial of Service (DoS) affecting WordPress’s /wp-admin/load-scripts.php; Assessing the risk we believe our caching system dramatically reduces any DoS threat targeting a single URL with scripts like this. We are implementing a fix which is currently in testing, it will limit the number of requests people can make to this file before being throttled and subsequently blocked. This fix will be available for all customers, including those on the new ARES platform. WordPress Security and Maintenance Release: 4.9.2 Jan. 16, 2018 Other people’s code How did it get on your site? Sad emoji face. WordPress version 4.9.2 has been released and it contains an update to address an insecurity in the Media Elements library, which is included in WordPress core. The patch addresses a cross site scripting (XSS) vulnerability, which could allow remote attackers to inject their own HTML onto your site. Pagely will be patching customer sites immediately, and should be finished shortly. If you would like to read more about this release please see the WordPress blog announcement here. Spectre and Meltdown Jan. 5, 2018 Reading memory, outside of your privilege. Time to patch kernels. [Update: Feb 2, 2018 CST] Our kernel hotpatch provider has released a working patch for Meltdown as well, and it has been applied to all customer servers. [Update: Jan 18, 2018 09:00 CST] Spectre: Patched without the need for a reboot Meltdown: Patch available if you request a reboot, we are still waiting on the no-reboot patch which is close to being tested as safe to apply. If you are concerned about the risks associated with Meltdown, contact support to request a server reboot. Or wait until our no-reboot patch has been tested and is working safely. Risk associated with Meltdown: There are still no PHP based proof of concepts, therefor we consider it a low-likelyhood that anyone (aside from someone with SSH access to your server) would be able to perform this attack on your site/server. If you disagree with this risk assessment, then please contact support and we will schedule a reboot to apply the patch for Meltdown ASAP. [Update: Jan 11, 2018 11:30 CST] Our kernel patch provider has released a working patch for Spectre, but not Meltdown. We will be applying the Spectre patch to all servers before the end of the week, and will be awaiting their patch for Meltdown when it becomes available. If you would like to hasten the patch time, we can apply the kernel patch from Ubuntu (released yesterday) however this will require a schedule reboot for the change to take affect. If you would like to schedule a reboot of your server, please contact our support staff from your account’s primary contact email address (or via our administration panel) These patches are known to cause a negligible performance hit on servers when applied. It’s likely you will not notice this performance hit on your site unless your code does a large amount of system calls and/or you are already close to needing an upgrade. Our engineers are working on a solution to this issue and we may be able to work with customers impacted to entirely remove this performance hit or actually come out ahead. [Update: Jan 9, 2018 09:00 CST] At this time (Tuesday January 9th) we do not yet have a stable patch to apply to customer’s servers. The patch plan for early this week was not met. This was due to the complicated nature of this patch, and ensuring a stable patch is what is pushed out to servers. It’s been identified by multiple sources that this patch is not the simplest, concerns of stability and CPU overhead come up and this has delayed the patch from either Ubuntu (our operating system) or KernelCare (our kernel patch provider). Risk assessment: The existing proof of concepts for these vulnerabilities are not executable against our customer’s sites due to how our PHP is configuration (we restrict/ban any exec/shell calls) which reduces the risk of this vulnerability. Only customers with compromised SSH accounts would be vulnerable (and if there does exist a PHP PoC in the future, only customers with compromised sites would be exposed.) We are delaying the patching process. This decision is made under the consideration that many people are reporting issues with the patches available, and the lower risk this vulnerability has at exploiting WordPress sites on our network. Tentative timeline: We expect patches from one of the upstream providers (Either KernelCare or Ubuntu) tomorrow, Wednesday Jan 10th, however this may be delayed. When a patch is available, if it is Kernel Care, no reboot will be required. If it is Ubuntu, then we will need to reboot your server for the change to take affect. We will begin applying patches for customers this weekend or next week (a few days after the patches are released so we have time to test the patch sets.) We will contact customers via email to schedule a reboot, if it will be required to apply this patch. [Original post] Pagely is aware of the multiple related vulnerabilities in Intel (and other) CPUs known as “meltdown” or “spectre” and has been working on patching affected servers. This vulnerability is a bit different than most, as it requires patching done on the bare-metal server as well as a second round of patching on our virtual instances for Pagely customers. Our data center provider notified us regarding what servers were affected by a security concern and needed reboots to apply a patch. We have already been working with the affected customers on and scheduled reboots to address this security concern. It’s likely that these CPU architecture vulnerabilities were likely the cause for the scheduled reboots in December. At least check, we have address almost all of these (and the last few are scheduled with the respective customers to happen shortly.) All remaining EC2 instances are on bare-metal servers which likely have been patched without the need for a reboot (however this may change). If you did not receive an email related to scheduling reboots on your site/server, then the patch for this vulnerability did not require a reboot to take affect. If this changes, we will be on contact with any customers who need to schedule a reboot. That only leaves the linux kernel on each of our EC2 instances as a remaining concern. Luckily we now utilize a new technology in the linux kernel which allows for live-patching the kernel without the need for a reboot. This patch will be applied to all of our customers as soon as the kernel patch is officially out and properly tested. The tentative timeline for this should be this weekend or early next week (and require no reboot of the server, it should be applied seamlessly.) PHPMyAdmin CSRF Jan. 5, 2018 Click this link my friend Cross-Site Request Forgery! But not with Pagely. Over the holiday break there was a CSRF vulnerability reported with PHPMyAdmin, this class of vulnerability would allow an attacker to send malicious links to users with browser’s already authenticated in PHPMyAdmin to perform actions as the logged in user. A patch was applied in 4.7.7 to address this issue, and all PHPMyAdmin installations Pagley has have been updated. WordPress Security and Maintenance Release: 4.9.1 Nov. 20, 2017 Holidays are for: Family, eating too much, and security. Don’t worry you can stay distraction free when dining with friends and family this holiday season, knowing that we have handled this WordPress security release update for you and your sites. Instead of worrying if your site has been patched, you can be the one to bring it up at social gatherings and watch as your friends or family with WordPress sites become uncomfortable not knowing if their sites are secure or not. Pagely customers will receive the WordPress 4.9.1 security release update this week. This security and maintenance release includes patches for multiple vulnerabilities including a cross-site scripting (XSS) and XML eXternal Entity (XXE) issues. This will also officially bring all customers up to the 4.9 branch from 4.8.3, unless you’ve previously written in requesting an upgrade to 4.9 in the last few weeks. You can read more about this security release and specific details on what it includes here on the WordPress news blog, as well as more details on how we handle major WordPress releases (like 4.9) on our blog here: WordPress 4.9 Release. WordPress 4.8.3 Oct. 31, 2017 WordPress Halloween. We patch the tricks, 4 8 3 You get the treats. Boo! There is nothing spookier than a WordPress security release, the 4.8.3 patch addresses an SQL injection vulnerability in WordPress core which could be exposed by insecure coding practices found in some plugins. This release hardens the WP Core code to protect the sites who may harbor an insecure SQL query that trusts user input, sanitizing the input before it’s passed along to the database server. More information on this release can be found on the WordPress blog, details on the changes and how it modifies the return value of of esc_sql() have been posted by Gary Pendergast on the Make WordPress Core developers blog. Thanks goes out to the reporter of the vulnerability (Anthony Ferrara) for working with the WordPress security team. And a special acknowledgement to our own Arman Zakaryan for the Haiku this time around. OptionsBleed Sept. 21, 2017 Memory Leaking over OPTIONS requests sent. This patch stops the leak. The vuln-du-jour is called OptionsBleed and affects Apache2 web servers. It was caused by a programming oversight in the Apache2 server project which allowed small amounts of memory to be leaked when an OPTIONS request is sent to the web server. This bug only affects sites that are configured with a LIMIT directive which attempts to filter nonexistent HTTP methods, which is extremely rare but does exist in just under 500 of the Alexa top 1 million websites. A more detailed write up about this can be found here. The Apache2 dev team wasted no time in providing a patch. Which we have already begun applying to customer servers. We are rolling this patch out slower than a normal security patch because it’s so rare for this misconfiguration to exist and initial reviews of customer sites shows no Pagely customers have misconfigured LIMIT directives which would put them at risk. That said, the patch will be applied in a safe manner over the next week as to minimize any risk of downtime on customer sites related to the upgrade. WordPress 4.8.2 Sept. 19, 2017 Within this release, Nine security patches. Sites are now secure This week brings a security update to WordPress core. The security patches include multiple serious vulnerabilities and we are applying patches as soon as possible for customers. The WordPress core and security team have also released version to address any of the patched vulnerabilities for the following versions: 4.8.2, 4.7.6, 4.6.7, 4.5.10, 4.4.11, 4.3.12, 4.2.16, 4.1.19, 4.0.19, 3.9.20, 3.8.22, and 3.7.22. Any customer of Pagely running older branches of WordPress will also be brought up to date with these security patches. Malicious Code in Display Widgets Sept. 13, 2017 We coined a new term: “plugin identity theft”. Let it not catch on. A popular plugin in the WordPress.org repository has been “hijacked” (for lack of a better term) by a developer with suspicious intent. The popular plugin “Display Widgets” is described as “Adds checkboxes to each widget to show or hide on site pages“, yet in the last few releases there have been some unexpected new features added: such as adding posts directly to the site and tracking site visitors. Wordfence, a security plugin, wrote a full explanation on how this might have happened, it’s worth a read here. For our customer’s safety, we have banned the plugin from our customer sites. If your site hosted with Pagely was affected we have already reaching out directly to help you with the concern. More information about the issue at hand with this plugin can be found on WPVULNDB and in the plugin’s support forum . Update: The plugin team at WordPress.org have released a patched version of Display Widgets which reverts it back to the last known safe version, but there appears to be no author to continue maintenance on the plugin. The plugin will remained banned on our network until a time that we see someone has taken responsibility for the plugin and the future of patching it’s code. Which plugins and themes aside from display-widgets should you avoid? See our full list here. WordPress 4.7.5 Release May 17, 2017 Patchy patchy patch I love patches for WordPress Here come the patches Pagely customer sites are being updated to address 6 vulnerabilities. The ExploitBox Unauthenticated Password Reset Vulnerability has still not yet been addressed; Pagely customers are still not affected. Further details on this release can be found here: wordpress.org ExploitBox’s CVE-2017-8295 May 5, 2017 Return to sender sending to the wrong domain read from HOST header. There was a recently released authentication bypass vulnerability that affects WordPress before and including 4.7.4, with specific server configurations. The attack requires a request to a WordPress site via it’s IP address, while the attacker sets the HTTP request header to their own HOST value. Pagely does not allow direct access to WordPress sites via IP address and requires the HOST field sent in the headers to be the actual site being requested, thus a request with a HOST value controlled by an attacker will not be directed to a WordPress installation at Pagely. Bonus Haiku: Pagely hosted sites are not affected by this reported exploit. For more details on the vulnerability and how it works, please read: https://exploitbox.io/vuln/WordPress-Exploit-4-7-Unauth-Password-Reset-0day-CVE-2017-8295.html WordPress 4.7.3 Security Release Mar. 6, 2017 XSS and more bugs get patched in this release. The update is done Customer sites are being updated to address 6 security related issues. Further details on the release can be found here: wordpress.org CloudBleed, Shattered, CVE-2017-6074 Feb. 28, 2017 SHA One Collision CloudFlare Leaking Memory and Kernel Patching Normally these Haiku’s are short and sweet, but it was a busy week for security in the headlines last week so I took a little more time to compile the following information for you: The CloudFlare Bug (A.k.a. “let’s not call it CloudBleed”) A security researcher working for Google’s Project Zero disclosed information on a bug identified in CloudFlare’s services. The bug was in CloudFlare’s services, and in some cases resulted in a trace amount of the contents of the CloudFlare’s servers memory being leaked. This could have had major repercussions as the contents of these servers may contain sensitive information being sent to or from the web server behind CloudFlare’s services (such as passwords, encryption keys, or other sensitive data.) Many news outlets reported this as a catastrophe, however CloudFlare patched it’s server’s before the announcement and there have been no reports of this being attacked in the wild before the report by the Project Zero researcher. Key points include that the data being leaked was not controllable by the attacker (it was always random, including no ability for an attacker to target a specific site’s data). The data was also limited to small chunks. The leaks however, have likely been happening for a while, no one knows how much data has been leaked to people looking for it or if any widespread attacks could have gleaned any usable data from the memory leaks. Ultimately, while it’s possible every password, SSL cert, and secret keys were pulled from CloudFlare server’s using this attack, it’s not likely to be the case. Most probably: the researchers at Google’s Project Zero were the first to be aware of the problem and reported it responsibly to CloudFlare. However, it is still yet to be seen if anyone reports malicious activity caused by these leaks in the weeks and months to come. How could this affect you? If you utilize CloudFlare on your site (or utilized a service that used CloudFlare) and wish to be absolutely sure your private data (such as a password) is safe then you may want to be pro-active and change that password or other secret data. The SHA-1 Collision: (A.k.a. “Shattered”) A collision in the SHA-1 algorithm was reported by a different team at Google. SHA-1 is a cryptographic hashing algorithm, commonly used to validate the integrity of data being sent. The collision released by the team at Google showed that they were able to send two different messages but they both validated with the same SHA-1 value; ultimately meaning that data signed or verified using a SHA-1 algorithm can no longer be trusted. There is some good news however, this attack is fairly expensive to execute (over $100k) and SHA-1 has been on it’s way out for the better part of a decade. SHA-256 has already been established as the replacement and most people have already migrated to the more secure algorithm. How could this affect you? If your site has SSL/HTTPS, then that certificate might be signed using SHA-1 , but it is probably already signed using SHA-256 (as of 2015) if you would like to double check you can always utilize a utility like ssllabs.com to look up your site’s SSL certificate and see what method is used to fingerprint it. If you find you are using SHA-1 only, then the fix is to get a new certificate (most likely whomever you purchased the certificate from will issue you a new one using SHA-256 without much hassle.) Secondarily, if you developed your site’s code explicitly using the sha1 function, then you may wish to swap that sha1 function with the sha256 function. CVE-2017-6074 While CVE-2017-6074 did not have a cool name or website or lots of media coverage; it was a more serious threat. This flaw could allow anyone with access to a Linux server to escalate their privileges from a normal user to root on the server. Linux servers running up to date kernels (such as ours) were affected and we were very concerned about getting this patched for our customers. Luckily we have been updating our infrastructure and these kernel based vulnerabilities no longer require reboots to apply new patches. We applied a patch to address this vulnerability on the same day it was made available and noted no issue with the new kernel code running. WordPress 4.7.2 Security Release Jan. 26, 2017 Sites updating now we handle the patch. So you focus on your site. Customer sites are being updated to address 3 security related issues. Further details on the release can be found here: wordpress.org CVE-2016-5195 “Dirty COW” Oct. 26, 2016 We have sent many email notifications about the reboot. Kernel patches have been applied on our servers, however a restart is required for it to take affect. Scheduled reboot notification emails have been sent out and reboots will take place the week of October 31st. More information on the vulnerability can be found here: dirtycow.ninja WordPress 4.6.1 Security Release Sept. 12, 2016 The update happened faster than I could write this haiku about it. All sites have been updated to address 2 security related issues. Further details on the release can be found here: wordpress.org httPoxy Jul. 20, 2016 A pox on proxy headers; that are misused by some developers. Updates to our server configs are being pushed out that remove any “Proxy:” values attempted to be set by a request header. More details here: httpoxy.org And see also: Pagely’s Reverse Proxy WordPress Hosting WordPress 4.5.3 Security Release Jun. 21, 2016 WordPress 4.5.3 Several security issues are addressed. We are currently testing and rolling out this security update. Further details on the release can be found here: wordpress.org WordPress 4.5.2 Security Release May 9, 2016 4 point 5 point 2; Patch vulnerabilities in cross site scripting Updates on our platform are finishing up today. Further details on the release can be found here: wordpress.org CVE-2016–3714 “ImageTragick” May 9, 2016 Image conversion tragedy; is currently patched by policy. Further details: ImageTragick.com CVE-2016-2107 CVE-2016-2108 May 3, 2016 High Severity Vuln? We patched openssl, so you don’t have to. Security Haiku: CVE-2015-7547 Feb. 19, 2016 Host lookup dangers? No worry, we already patched glibc Which plugins and themes aside from display-widgets should you avoid? See our full list here.
These monthly reports are provided for the WordPress community at large from Pagely’s head of security, Robert Rowley. Rowley and the entire security team keep their finger on the pulse of any potential vulnerabilities that might affect our customers, as well as any WordPress user. We sincerely hope these efforts help any and all that could use information from the experts on monthly security issues. We commend the researches and developers that help to identify and patch these issues in a timely fashion. WordPress Core No notable WordPress core security releases. Plugin/Theme Vulnerabilities of Note bbPress By The bbPress Contributors https://wpvulndb.com/vulnerabilities/10242 https://wpvulndb.com/vulnerabilities/10243 https://wpvulndb.com/vulnerabilities/10244 https://bbpress.org/blog/2020/05/bbpress-2-6-5-is-out/ bbPress version 2.6.5 was released on May 28th. This security release addresses multiple vulnerabilities including one which affects sites with New User Registration enabled, allowing privilege escalation on newly created accounts. WooCommerce By Automattic https://wpvulndb.com/vulnerabilities/10220 There exists a vulnerability within WooCommerce, which would allow users with access to modify and duplicate products to upload arbitrary PHP code to the website, then execute it. This is an authenticated vulnerability (requiring a user account), and high risk as it would allow attackers to execute code on the server itself. Note: This vulnerability is a Remote Code Execution (RCE) based on our review of mslavco’s findings. Page Builder by SiteOrigin https://wpvulndb.com/vulnerabilities/10219 The page-builder plugin before version 2.10.16 has a CSRF (Cross-Site Request Forgery) to Reflected XSS (Cross-Site Scripting) vulnerability. Attackers could utilize this attack to target site administrators to execute code within the administrator’s browser within wp-admin. The attack targets the live editor and action_builder_content functions of the plugins. Elementor Pro https://wpvulndb.com/vulnerabilities/10214 There is a critical vulnerability in Elementor Pro versions before 2.9.4 which allows any logged-in user the ability to upload and execute PHP scripts. This vulnerability is actively being utilized with a registration bypass vulnerability which affects Ultimate Addons for Elementor (described next), allowing for subscriber registration even if registration is disabled. Ultimate Addons for Elementor https://wpvulndb.com/vulnerabilities/10215 The Ultimate-Elementor plugin before versions 1.24.2 allows attackers to create subscriber-level users, even if registration is disabled on a WordPress site. As noted, this vulnerability is being combined with the Elementor Pro vulnerability described above which may lead to remote code execution on sites with registration open and both Elementor plugins installed. Photo Gallery By 10Web https://wpvulndb.com/vulnerabilities/10227 An unauthenticated SQL injection can be executed on this plugin and it looks to target the gallery_type area of the plugin specifically. Site owners have until June 5th to update to version 1.5.55 or higher before the vulnerability details will be made publicly available. Form Maker By 10Web https://wpvulndb.com/vulnerabilities/10237 A vulnerability in this plugin allows an administrator or higher-level user to perform a SQL injection via Form Maker. Site owners should update to version 1.13.35 or higher as soon as possible, as the security researchers have stated some details regarding how to exploit this vulnerability have already been released publically. Official MailerLite Sign Up Forms By MailerGroup (x2) https://wpvulndb.com/vulnerabilities/10235 https://wpvulndb.com/vulnerabilities/10236 The official-mailerlite-sign-up-forms plugin has two vulnerabilities that have recently been reported. The first deals with the MailerLite plugin not sanitizing user input data which leaves a site vulnerable to SQL injection, this vulnerability was fixed in version 1.4.4. The second vulnerability addresses CSRF issues and was patched in version 1.4.5 of this plugin. WP Product Review Lite By ThemeIsle https://wpvulndb.com/vulnerabilities/10226 The wp-product-review plugin before version 3.7.6 is susceptible to an Unauthenticated Stored XSS attack which bypasses built-in protections allowing malicious HTML or Javascript to be stored and injected on all the site’s product pages. See previous months’ WordPress security updates from April and March.
