It’s become commonplace for a majority of internet users to share personal information on the internet. With the disregard for protecting personal data becoming second nature, how do we protect ourselves and our users? That’s where the power of SSL comes in. If your site requires users to submit any valuable or fragile information, then having an SSL certificate is a must-have. Below you’ll learn what SSL actually is and how you can install your SSL certificate on your WordPress site. What is SSL? Having a secure website is an absolute necessity these days. SSL is the current web standard for exchanging information securely between a website and a user. Most information traveling over the web can be easy accessed anytime by people who know what they’re doing. You know, like hackers and the government. Since this is such a common occurrence, the best line of defense is to encrypt your data. The way anyone who accesses your data, besides the person you were intending, will receive nothing more than a string of gibberish. For SSL to be valid on your site, the first thing you need is to have working SSL certificate and a host capable of supporting SSL integration. When It’s Best to Use SSL Not every style of website requires SSL. For some websites obtaining an SSL certificate will be a waste of time and money. However, these cases are becoming more and more rare. In fact, Google recently announced that sites that have an SSL certificate will actually receive a rankings boost. So, if your site is reliant on search engine traffic to do business, then this boost might be a good idea for your site. Currently, the rankings increase you’ll receive is small, but if you’re in a competitive space, then this could mean all the difference. Beyond the reasons why you might want it, there are a few instances that basically require using SSL. These instances include: Requiring your users to login Users can submit personal information Credit card details SSN or other private details Personal address You run an eCommerce website If you want to run your site over HTTP/2 Without SSL there’s a chance your user’s information could be stolen, and in today’s internet age trust means everything. Drawbacks to SSL Now, SSL isn’t without its drawbacks. Below we highlight a few of the main objections about SSL. The cost. It isn’t particularly expensive, but an extended SSL certificate does cost a bit more. Plus, you need to remember to renew your certificate every year. ROI isn’t guaranteed. You need a little technical knowledge to set it up. SSL and HTTPS When your site is protected the usual http prefix will instead be changed to a secure https preface. There will also be a green padlock to the left of your domain, like the image below. Some sites will use an Extended Validation Certificate, which will make your site name and URL appear green, like we have at Pagely. These certificates offer more WordPress security and are issued after a more vigorous application and verification process. How SSL Works SSL encrypts the information traveling between the server and browser. If at any point someone beyond the intended recipient tries to access the information it will be illegible. In order to use SSL you need to install an SSL certificate on your server. You can obtain a certificate from a company known as a Certificate Authority. After you’ve purchased a certificate you’ll submit your website and company information and receive a public and private key. Your public key will then get submitted with your previous information in your Certificate Signing Request. Once this information is verified your SSL certificate will be signed with an SHA. Then, the actual certificate will be issued and you can use the certificate on your site. What Happens When an SSL Certificate Expires When you have an SSL certificate installed on your site you need to ensure it’s always active and hasn’t expired, or become invalid. When this happens your visitor won’t be able to visit your site, and will instead be taken to a screen that says ‘This site’s security certificate is not trusted!’ Having a first-time visitor see this screen when they visit your site probably won’t help to build trust with your visitors. At all. It’s important to purchase your SSL certificate from a known authority. Otherwise you run the risk of your user running into a screen that says ‘Secure connection failed’. This screen won’t look as malicious as having an expired certificate, but it still deters visitors from accessing your site. Integrating SSL With WordPress Once you obtain an SSL certificate you can then move forward with integrating SSL and your WordPress site. Before making any changes to your site it’s always a good idea to backup your site, just in case something happens. 1. Edit your wp-config file The first step will be editing your wp-config.php file. Open up wp-config.php in your favorite code editor program and add the following line of code. define(‘FORCE_SSL_ADMIN', true); This will force the SSL certificate to load for any user who comes across your site. 2. Create a 301 redirect in .htaccess Next we’ll add a 301 redirect to ensure visitors to your site are automatically sent to the secure HTTPS version. To do this we’re going to edit the .htaccess file. Open up your .htaccess file, or create one if your site doesn’t already have one, and add the code below. <IfModule mod_rewrite.c> RewriteEngine On RewriteCond %{SERVER_PORT} 80 RewriteRule ^(.*)$ https://www.mysite.com/$1 [R,L] </IfModule> You’ll need to change the URL of your site, and possibly the server port if yours is different. SSL is a great way to ensure your site remains protected, however, it’s one of many security measures you should take with your site. Having a secure hosting environment, strong admin passwords, and using a few select WordPress security plugins will help take your site the rest of the way.
If you’ve been searching for ways to speed up your WordPress site, you’ve probably stumbled upon this quirky little three letter acronym: CDN. Most blogs will tell you something like, “get a CDN to speed up WordPress”. Simple enough…but what is a CDN? And how does a CDN actually work? In this post, we’ll delve into CDNs on both a physical and theoretical level. After reading, you’ll come away with a better understanding of how CDNs function to improve your page load times and otherwise benefit your site. What is a CDN? A CDN, short for Content Delivery Network, is a network of servers located around the world. Each global server hosts an exact copy of your site’s static files. Ok, so why is that important? Let’s say you host your site at a data center in Dallas, TX. Without a CDN, every single visitor has to download all of your site’s files from Dallas, TX. That’s fine if some someone is visiting your site from nearby California. But what if someone is visiting from London? I mean, data travels fast. But that’s still 4,745 miles! So no matter how good your hardware is, that distance is going to make your site load more slowly for visitors on the other side of the world. CDNs eliminate this issue by caching your data around the globe. So even if your “home” data center is in Dallas, a CDN lets you store a cached version of your site at a London data center. That way, even European visitors get blazing fast speeds. Better yet, most CDNs offer caching servers on every major continent*. That means visitors around the globe can take advantage of quicker load times. *Well, except Antarctica, but I don’t think the penguins are interested in your site. What are the benefits of a CDN? Speed is the name of the game. And CDNs are one of the best ways to speed up your website for visitors around the world. It’s absolutely essential to have a fast loading website in order to compete in today’s online landscape. Improving your page load times can boost your: Conversion rates – for example, Intuit found that every one second decrease in page load time increased their conversion rate by 1%. Search engine rankings – Google publicly says that they use page load times as a ranking factor. And studies even show that something as simple as a one or two second delay can result in a 16% drop in overall customer satisfaction. That’s not surprising given almost a third of users want websites to load in under a second nowadays. All that to say, there’s a lot riding on your site’s page load times. Besides improved page load speed, you’ll get a host of other benefits like: The ability to handle high volumes of traffic without taking your site down, or having an interruption of service Protection against spam, bots, and DDoS attacks Reduction in the total bandwidth consumed any one server. That is, your bandwidth usage is spread across multiple servers. There’s simply no good reason not to try out a CDN with your existing host, especially when the costs are so low (and sometimes free). How a CDN Works Ok, so at this point, we’ve covered how CDNs work in theory. But what are the hardware elements that actually go into building that global network? Let’s dig in… CDNs are comprised of three different hardware elements. They are: 1. PoP PoPs, or Points of Presence, are the physical data centers your CDN operates. Most CDNs will have multiple points of presence spread across North America, Europe, Asia, and sometimes other continents. 2. Caching Servers Each Point of Presence then contains multiple caching servers. These servers are what actually do the hard work of caching all of your site’s static files. 3. Storage (SSD/HDD & RAM) And finally, each caching server is comprised of multiple solid state drives and hard drives. These are the actual physical resting point of your files. There’s also another technical concept called Push vs Pull. Pull CDNs “pull” content from your site as needed and cache it for a period of time. As such, they’re simple to set up. Push CDNs actually store your files, not cache them. That is, you “push” your files to the CDN for storage. Therefore, push CDNs can offer slightly better performance but have a more involved setup process. Overall, CDNs are a great way to speed up your site and make it more reliably available for visitors around the globe. If you are interested in setting up a CDN for your site, we here at Pagely offer an optimized CDN for WordPress lovers.
Do you spend too much time going back and forth between the different sites that you manage? Wouldn’t it be great if you could do site updates, or make code tweaks, all at once and all in one place? Well, with multisite WordPress hosting, you can. WordPress is a content management powerhouse, but you already know this. Still, plenty of developers and agencies are adding more work to their plate by looking at each site as a single island. WordPress multisite has been around for a while and allows you to manage an entire network of websites from a single place. If you need to make multiple edits to several sites at once, then multisite can be incredibly useful and a real time saver. Below we highlight what WordPress multisite hosting actually is, why you might want it, and how it changes your existing WordPress dashboard. What is Multisite? WordPress multisite is a feature that’s built-in to WordPress with their 3.0 update. Essentially, it allows you to create a network of websites that all run on a single install of WordPress. Instead of having a different install for every single site you’re managing. However, WordPress multisite doesn’t work with every web host. At Pagely, we can make the necessary modifications so your sites are supported. So, if you’re running a network of sites that all utilize the same plugins configurations and theme settings, then this can be a real time saver. In technical terms, you’ll just be running and managing a single site, then pushing out all of those updates to every site on your network. If you still don’t understand what WordPress multisite is and how it works, the team at WPMU DEV has written an extensive guide to help. This Is Why You Should Use WordPress Multisite Still, not convinced that you can benefit from using WordPress multisite? Then, take a look at some of the cool features below. 1. Only Have to Manage a Single Install If you currently host a few different sites with WordPress, then you’ll have multiple logins and sites to manage. With multisite WordPress hosting, all you need to do is install WordPress once. Then you can make changes to your entire network of sites from a single dashboard. 2. Can Share Themes and Plugins Multisite will enable you to share various plugins and themes with every other site in your network. This way you can make simple plugin or theme changes and push those changes out to every single site under multisite hosting. We cover this in more depth below. 3. Updates Are a Breeze Are keeping your themes and plugins up to date a headache for you? Whether you’re doing it from the command line or logging into the WordPress backend, updates take time. Now, imagine being able to update every site in your network with a single click. Well, with multisite WordPress hosting you can do just that. When WordPress Multisite Doesn’t Make Sense Now, WordPress multisite hosting doesn’t make sense for every kind of site. For example, if you only manage one website, then just do a single WordPress install. If you’re managing multiple websites that have completely different designs, goals, and purposes, then you may just want to manage these separately. However, if WordPress multisite sounds like something you need, and your current host doesn’t support it, then we recommend switching to a WP host like Pagely. What You Can Do With WordPress Multisite Since you’re already familiar with working with WordPress, then working with WordPress multisite won’t be that much different. Below, we highlight the key differences you’ll likely come across. 1. Plugin and Theme Maintenance One of the biggest differences between regular WordPress install and multisite install is how you’re going to go about managing your plugins and themes. The plugins or themes that are installed by a network admin will now be available to use across any site currently in your network. You’ll be able to network active certain themes and plugins, so it’s available across any site in the network. You can also enable and install plugins and themes on an individual basis as well. 2. The New Network Admin Dashboard Once you setup multisite WordPress hosting you’ll have a new network admin dashboard that allows you to manage all of your sites on a network basis. Only super administrators will have access to this part of the dashboard, which we dive into below. 3. The New Super Admin Role On a single WordPress install, users who are given admin access will have ultimate control over the site. But now, with multisite hosting, the super administrator role will have the metaphoric keys to the kingdom. You can still assign regular administrator roles to various sites on your network, but the super administrator will be able to manage every site in the network. If you’re an agency managing multiple sites for yourself and for your clients, then multisite hosting might be something worth looking into. If you have any questions about Pagely hosting and how it can help you take control of your network of sites, then get in touch today.
A lot of developers seem to enjoy grunt work – the thrill of fixing problems, building things, and losing yourself in lines of code. But there’s only so much time in the day. And you probably have better things to be doing than repetitive tasks that end up taking longer than they should. When you can do more work in less time, you’re freed up to work on more projects, grow your skills, or even take a little break. There is a world outside of our screens (shh… don’t tell anyone). WP-CLI is a command line tool that lets you accomplish a wide array of WordPress development tasks from within the command line. This means no breaking focus, and less wasted time. Below you’ll learn what WP-CLI actually is, and why you may want to consider using it. What is WP-CLI? For a long time WordPress didn’t have a way for developers to work around simple tasks that would take nothing more than a few lines of code. This has all changed with the introduction of WP-CLI. The WordPress GUI is pretty, but sometimes you don’t want to leave the command line. And now you don’t have to. If you’re looking to execute simple WordPress tasks in the most efficient manner possible, then you need WP-CLI on your side. Imagine being able to accomplish your WordPress related tasks without having to fire up your browser and login to WordPress. With WP-CLI, you can do anything you’d usually do within the WordPress Admin panel, without needing to login to the site. It’s very useful and an incredible time saver. What Can WP-CLI Help With? Basically, any general administrative task you’ll need to do within the WordPress dashboard can now be handled from you command line. Whether you want to create a new site, manage an existing site, or make changes to an existing database, this tool can help you do it. Some core functions that WP-CLI can be used to complete are: Installing a fresh WordPress installation Updating and installing WordPress themes and plugins The ability to list all plugins and their status Updating the core WordPress framework Uploading media files in bulk, avoiding having to do one at a time Creating database backups and restoring existing databases Creating or changing user accounts and permissions Easy search and replace functionality within the database To see what basic functionality WP-CLI is equipped with, you can check out their complete list of basic commands. Here’s a few basic tasks you probably complete on a regular basis. With WP-CLI, they take nothing more than a simple command – check them out: Installing a WordPress theme wp theme install twentyten Installing and activating a plugin wp plugin install woocommerce Then, wp plugin activate woocommerce Updating the WordPress core wp core update wp core updatedb Bulk importing images wp media import images_folder Doing regular WordPress administrative and maintenance tasks couldn’t be easier. A Few Of Our Favorite Features Beyond the commands and functions highlighted above you can do some really intricate stuff with WP-CLI, like using it remotely, adding WordPress multi-site features, and even the ability to run unit tests. Naturally, most developers are afraid of the dreaded fatal error that can happen from plugin and theme conflicts. When you’re working from the command line, it can be difficult to know if this error actually occurred. Luckily, WP-CLI has flags to ignore plugins or themes from being loaded, if they have PHP Fatals that will stop the site from loading. Another really great feature is the ability to manipulate wp-options. You can use something like (wp option get|set $name [$value]) as a quick shorthand instead of having to jump over the MySQL client. And it even unserializes your PHP objects for you! '$ wp option get pagely-cache-control stdClass::__set_state(array( 'all_caching_disabled' => '0', 'dev_mode' => '0', ))' This enables you make quick database changes, using shorthand, without having to hop over to the MySQL database. Very, very, useful. Plus, you can take WP-CLI even further with their packages that are available via their package index. Of course, there are a ton of additional features we didn’t mention in this post. The possibilities of WP-CLI are almost endless. If you’re looking for more information you can find out more on their website. If you’re thinking about using WP-CLI, or want to support its continued use we highly recommend reading about the potential costs of this tool. Which brings up the question: How much is your time really worth? Breaking flow and focus to login to the WordPress dashboard takes time. All that time adds up, and after awhile you’ll wonder where your day went. Don’t let this be your fate. WP-CLI sounds like a dream come true to most developers. But there is one catch: not all WordPress hosts support this kind of access. Luckily, your friends at Pagely do. So if the thought of using WP-CLI to speed up development tasks sounds like a must-have part of your coding life, then give our hosting a try.
<p align="justify">This article covers our public notifications related to major security issues our clients and the WordPress community should know about. We are always focused on <a href="https://pagely.com/solutions/secure-wordpress-hosting/">prevention and the mitigation of risk to our clients</a>, and keeping you updated here is part of that process.<!--more--></p> <h3 align="justify">List of Vulnerable Plugins During This Month</h3> <p style="text-align: center"><style type="text/css" name="visualizer-custom-css" id="customcss-visualizer-21824"></style><div id="visualizer-21824-2005308557"class="visualizer-front visualizer-front-21824"></div><!-- Not showing structured data for chart 21824 because title is empty --></p> <h3>Plugins Closed by WordPress Security</h3> <p style="text-align: center"><style type="text/css" name="visualizer-custom-css" id="customcss-visualizer-21828"></style><div id="visualizer-21828-312395930"class="visualizer-front visualizer-front-21828"></div><!-- Not showing structured data for chart 21828 because title is empty --></p> <p align="justify">WordPress security team decides to close a plugin when a security issue is found and the developer doesn’t release a patch in a timely manner. You can read more about this <a href="https://developer.wordpress.org/plugins/wordpress-org/alerts-and-warnings/" target="_blank" rel="noopener noreferrer">here</a>.</p> <h3 align="justify">Relevant Vulnerabilities</h3> <p align="justify"><a href="https://wpscan.com/vulnerability/10478" target="_blank" rel="noopener noreferrer">secure-file-manager</a>:<br /> <b>Authenticated File Upload</b></p> <p align="justify"><a href="https://wpscan.com/vulnerability/10471" target="_blank" rel="noopener noreferrer">ait-csv-import-export</a>:<br /> <b>Unauthenticated File Upload</b></p> <p align="justify"><a href="https://wpscan.com/vulnerability/10457" target="_blank" rel="noopener noreferrer">augmented-reality</a>:<br /> <b>Unauthenticated File Upload</b></p> <p align="justify">These plugins have critical vulnerabilities that when exploited would give an attacker complete control over your website. All of them are closed, which means no new installs are allowed but old installs will work without any issues, thus, please check if you have any of them installed <i>(</i><b><i>even if it’s not activated</i></b>) and remove them from your plugins folder.</p> <p align="justify"><a href="https://wpscan.com/vulnerability/10479" target="_blank" rel="noopener noreferrer">woocommerce-anti-fraud</a>:<br /> <b>Unauthenticated Order Status Manipulation</b></p> <p align="justify">Versions < 3.3 of this plugin have a bug that when exploited could cause unnecessary damage to your online store. An unauthenticated attacker would be able to change the status of all the orders making it difficult to handle them since the data will not be reliable. On <strong>November 23</strong> the developer released a <a href="https://dzv365zjfbd8v.cloudfront.net/changelogs/woocommerce-anti-fraud/changelog.txt" target="_blank" rel="noopener noreferrer">new version</a>.</p>
This article covers our public notifications related to major security issues our clients and the WordPress community should know about. We are always focused on prevention and the mitigation of risk to our clients, and keeping you updated here is part of that process. List of Vulnerable Plugins During This Month Plugins Removed From the Repository WordPress security team decides to close a plugin when a security issue is found and the developer doesn’t release a patch in a timely manner. You can read more about this here. If you are using one or more of the above plugins we recommend deactivating them until the developer releases a patch for the mentioned vulnerability or consider a more reliable alternative. Relevant Vulnerabilities Ti-woocommerce-wishlist : Authenticated WP Options Change A critical vulnerability was found in this plugin that when exploited allows an attacker to: Change the site options Create malicious redirects Escalate privileges (login as an administrator) This issue was resolved in the free version 1.21.12 on October 16, however when checking the premium version we noticed it was still vulnerable and was finally resolved on October 28 after we reported it. More details here. WPBakery Page Builder : Authenticated Stored XSS WPbakery Page Builder former Visual Composer had a medium vulnerability in versions before 6.4.1 that was only exploitable by high privilege users. Nevertheless we recommend all its users to update to the latest version. Loginizer : Unauthenticated SQL Injection Loginizer had an unauthenticated SQL Injection in versions before 1.6.4 caused by a lack of filtering before executing a database query. An attacker just had to craft a request with a malicious username. More information here.
