Pagely is thrilled to announce our partnership with Object Cache Pro. Utilizing state of the art compression technology, Object Cache Pro is now part of Pagely’s core offering, and available to all of our customers, platform wide. Offering major cost savings, access to some of the world’s best technology, and a dedicated DevOps team to personalize your setup, Pagely customers can look forward to continued scale and growth, with no hosting friction. A first of its kind partnership, Pagely is proud to help fund innovation in this WordPress space by investing part of our budget into working alongside the fantastic team at Object Cache Pro. We’ve already seen great gains with Object Cache Pro and our customers can look forward to more in the future! Why Object Cache Pro? Before Object Cache Pro, we faced two challenges with sites making use of an object cache – CPU overhead and network saturation. The underlying technologies in Object Cache Pro solved both of these problems for us, translating to less money spent on server hardware and fewer situations where the (quite generous) AWS network limits are reached. With Object Cache Pro’s state of the art technology utilizing the Zstandard compression library from Facebook, without a lot of CPU overhead, compression is now done at the extension level, talking to and from Redis. This means less hardware, lower costs, and a better experience for our customers. Aside from supporting an efficient compression algorithm (zstd), Object Cache Pro also uses the igbinary serializer which is a drop-in replacement for the standard serializer in PHP. This works about twice as fast at serializing and unserializing data. Additionally, the data footprint is smaller when using igbinary and that translates into less memory being used by the underlying Redis service. We also found an in-depth comparison on igbinary vs other serializers on Blobfolio that you may also enjoy reading if you’re into this kinda stuff: https://blobfolio.com/2017/03/benchmark-php7-serialization/ With a wide selection of Redis plugins available in the WordPress marketplace, Object Cache Pro was the obvious choice for us not only because of their forward-thinking tech but also because of the dependability we have come to expect and appreciate from their brilliant team. All of this aside, Object Cache Pro is unrivaled when it comes to bug fixing, an extent to which is a rarity across opensource software. There’s a saying in the opensource community that goes, “there’s a lot of eyes so all the bugs get fixed.” But, more what we see concentrated use of the software by lots of users leading to fewer bug fixes for fear of breaking one users’ site. That, and, no one owns the codebase, so less can get addressed in a timely manner. Similarly, we are continuously impressed by their coverage of testing, fully unit tested with 100% code coverage. Further, switching over to Object Cache Pro gives Pagely customers access to our commercial relationship with their team, which means any problems our customers see are fixed within a few days. You benefit from our relationship. Fewer bugs in the caching layer and full unit testing is a good thing, and that’s something we stand behind. So, What’s in it for the Pagely Customer? We are the first premium host to achieve this level of partnership with one of the best technology companies in WordPress. Through our relationship with Object Cache Pro, every single Pagely customer benefits from the work we’ve done to secure that. But real talk, what’s in it for you? Major cost savings. Even when it means less revenue for Pagely, we’re constantly looking out for cost savings for our customers. By decreasing our dependency on more hardware, you see the savings directly on your bill. Access to a premium partner. Since you’re at a premium hosting provider, you automatically get access to the partnerships we’ve developed. What’s more? You don’t pay an extra licensing fee. The best tech, baked into your Pagely account. We’re always on the hunt for the best and most innovative technology for you. With no effort on your part, we do the legwork of implementing this tech across our technology stack. All you do is benefit from it. Bigger performance wins possible with a little extra code work. WordPress has a feature called Transients. It’s a way to store the result of a complex query or a long-running remote API call temporarily in order to make subsequent lookups for that data return a lot faster without doing the same expensive operation again. Normally without any object cache, transients are stored in the WordPress database’s wp_options table. When using an object cache, it is stored in memory. Adding a few extra lines to your code allows you to tap into the power of this API for incredible performance gains. Having an efficient object cache utilizing fast compression and serialization only increases those gains. A dedicated DevOps team. While others might catch on and jump on the bandwagon of partnerships like this, Pagely still stands above the rest in meaningful ways that translate to real gains for you, the customer. Our DevOps staff becomes your dedicated, in-house team. Our engineers handle all the setup and optimization to make sure your usage of Redis is optimized specifically based on your exact circumstances and needs. Other hosts don’t do that! When you partner with Pagely for your WordPress hosting at scale, you know you have selected the most forward-looking host driven by advances in technology, cost savings for you, and tangible outcomes that help your business thrive. Object Cache Pro Helped FanSided Scale So let’s get to a real-life example here. One of the first Pagely customers we switched over to Object Cache Pro was FanSided. Here you can see a dramatic decrease in network utilization on the Amazon Aurora RDS instance after implementing Object Cache Pro along with custom Transients Caching, which dropped usage from 1 Gigabit per second to 400 Megabit per second; and yielded even lower usage after some more optimizations were made. FanSided comprises a massive network of over 300 active websites and needed a fast solution to maxing out servers and using way too much CPU. Pagely found that solution in Object Cache Pro and implemented it with no effort on FanSided’s part to completely eliminate those issues. Here you can see how memory is no longer being maxed out after the date we turned on Object Cache Pro for FanSided. The proof is in the data, and here you can see dramatic drops in CPU usage after Object Cache Pro was implemented, as well as servers being maxed-out-no-more after the switch. Dramatic drops in CPU usage after implementing Object Cache Pro for FanSided. Read the full FanSided + Object Cache Pro case study here, and take it from our CEO: “In the vacuum of 1 website, a small performance gain is useful. At our scale of hosting, processing hundreds of billions of requests per month across thousands of AWS EC2 instances, a small performance gain to each site means a real and quantifiable benefit to our customers and our bottom line. Now what if that performance gain was not so small, but major. We sought out and partnered with Object Cache Pro after seeing the dramatic results in terms of performance and resource usage when testing. We have thus deployed their Enterprise solution fleet wide and the results speak for themselves.” – Joshua Strebel, CEO of Pagely
The benefits of this WordPress security guide are two fold: Learn exactly what you need to know about WordPress security in 2020. Understanding WordPress security helps you adopt a security-oriented mindset that will help you prevent and mitigate risks as you make day-to-day decisions. Get actionable, step-by-step instructions for securing your WordPress site. The steps you need to take aren’t particularly time-consuming, don’t require advanced technical knowledge, and the linked guides are vetted for clarity and completeness. Of course, it’s impossible to cover every possible vulnerability and scenario. That’s why we also include the overarching “principles of WordPress security.” If you can follow these broad principles many of the minute details that are difficult to address in this type of post will take care of themselves. Why is WordPress security critical? It’s important you understand how big an issue WordPress security is so you give it the time and attention it deserves. Here are some sobering statistics: Google blacklists 10k sites a day for malware and another 50k for phishing each week. A blacklist from Google kills that source of traffic which can be highly disruptive to a business’s revenue. Fixing and removing a blacklist can be a hassle, particularly if your server was used to send SPAM emails. A blacklist from email service providers harms your deliverability rate which undermines the effectiveness of your email marketing. In 2018, 90% of CMS hacks were WordPress. Granted, WordPress is the world’s most popular CMS with 34% of the web powered by WordPress, but this is still a disproportionate amount of hacks. For a variety of reasons, WordPress sites are targeted and exploited more than any other CMS. 60% of attacks target small businesses. You may think that hackers won’t bother with your site because you’re a small fish but “security through obscurity” does not exist on the web. No one is too small to be a victim of an attack. WordFence reports that there are over 97,978 attacks happening per minute. This is not a small, isolated problem. Large swaths of WordPress sites are being probed for weaknesses at any given time. Will you be ready if your site is targeted? While these stats paint an intimidating picture of what you’re up against, it’s important you confront the realities of managing a WordPress site in 2020. If your business relies on WordPress, security is not something you can afford to ignore. If you haven’t taken steps to secure your site, you’re vulnerable to attack. It could be only a matter of time until your site becomes compromised. This is one area where “an ounce of prevention is worth a pound of cure.” The principles of WordPress security Securing WordPress is more than checking off a list of boxes, it requires you to adopt a security-oriented mindset that guides your decision making. These principles will help you prevent mistakes as you make day-to-day decisions like adding new WordPress users, plugins, and themes: Vulnerabilities are often introduced by WordPress users. Vanilla WordPress that is kept up to date and uses strong passwords is relatively secure. It’s often the decisions made by WordPress users that create weaknesses that hackers exploit. This is why articles like this one are so important. It’s up to you to be educated on, and consistently follow, the WordPress security best practices outlined here. Minimize plugins and themes. New WordPress users are often overjoyed by the extensive ecosystem of plugins and themes available for WordPress. This can lead to indiscriminate installation of plugins. But, each new plugin or theme adds code to your site that, potentially, adds new vulnerabilities. By minimizing the plugins and themes installed, you also minimize the amount of code your site uses, and, by extension, the number of potential security vulnerabilities. In general, if you can solve a problem without installing a plugin, that’s the best option. Install updates as soon as possible. Updates to the WordPress core and updates to plugins and themes often contain critical security updates. They should be installed as quickly as possible. If you have a good back up strategy in place, you can roll back to a previous version in the event the update causes issues. Follow the principle of least privilege. This is a core principle of cybersecurity in general and is not unique to WordPress. This is a fancy way of saying, “don’t give a user more privileges than they need because those extra privileges give hackers more power and access than they’d otherwise have if they compromise that account.” Attacks can still happen. You can try as hard as you can to cover all the bases and still fall victim to an attack. This is why regular, automated backups are critical. Do not ignore this advice. A hacked site can be disruptive but can generally be fixed with minimal cost and disruption, a hacked site without a backup to roll back to can be severely disruptive. You are never finished with security. Having a 100% secure WordPress site is an impossible task. You can’t accomplish complete risk elimination, so aim instead for ongoing risk reduction. This “risk reduction” mindset prompts you to continue taking steps to improve your security as part of an ongoing, never-ending initiative. The most common WordPress attack vectors Understanding the most common methods hackers use to exploit WordPress will help you understand how to address them and why the steps recommended later in this article are necessary: Brute Force Attack A cyber criminal uses trial and error to identify a password or pin. They use combinations of common usernames and passwords until they find the right one. It’s the equivalent of trying every key on a key ring to find the one that works. This is all done using a computer script so they can run thousands of combinations with very little effort. Given enough time, any account is hackable but strong passwords thwart this kind of attack. SQL Injection Malicious SQL code is injected into a database to gain access to database information that was never intended to be displayed. Depending on the hackers goals, this can lead to your database being deleted, customer information being stolen, or sensitive company information being accessed. Malware A virus or spyware is inserted using an expired theme or plugin. The attacker can gain access to your data, insert pages into your site for black hat SEO, and perform a number of other nefarious activities using your site. Cross-site scripting Javascript code is inserted which then collects data commonly used to exploit WordPress plugins. This can be used to redirect your site visitors to malicious content. also known as an “XSS attack.” DDoS Attack A Distributed Denial of Service (DDoS) attack floods a website with traffic which overwhelms server resources causing it to fail. Multiple machines send frequent requests to the server using malware installed on those machines for that purpose. The distributed nature of the attack can make it difficult to identify and block the sources of the traffic. Now that you understand how hackers will attempt to breach your site security, let’s look at how we can block and prevent these attacks… Steps to secure your WordPress site In spite of the many ways your site can be compromised, it is possible to mitigate these risks and prevent many attacks. Here’s a list of recommended steps to protect your WordPress site from security attacks: 1. Force Strong Passwords “81% of attacks are based on insecure or stolen passwords” “It only takes about 10 minutes to crack a lowercase password that is 6 characters long.” These two facts taken together make the case that you must use strong passwords for all WordPress users. Strong passwords are long and use a combination of upper and lower case letters, numbers, and symbols. Longer is better but 20-characters is probably plenty. Strong passwords are difficult to memorize, especially if you’re using unique passwords for each site (you should be!). This means a password manager, such as LastPass or Dashlane, is a critical tool. These apps make creating strong passwords easy, store them in a central location, and make logging into your websites easy by autofilling your passwords. Here’s how to make sure all your WordPress users are using strong passwords. 2. Turn on automatic WordPress Core updates One of the advantages of using a popular CMS like WordPress is that there are many people with a vested interest in keeping it secure. Thousands of people are contributing to WordPress security by reporting vulnerabilities to the WordPress team. This widespread collaboration means most holes are patched relatively quickly. But, if the updates that contain those fixes are not applied, you leave your site vulnerable to attack. The best way to ensure your WordPress core updates happen quickly is to turn on automatic updates. This way your WordPress site will be kept up-to-date without you having to do anything. Here’s how to turn on automatic core updates by modifying your config.php file. 3. Stay on top of plugin and theme updates You absolutely must keep your plugins and themes up-to-date. The importance of this cannot be overstated. You’ll also want to be careful to use plugins and themes that are updated often. If you’re using a plugin or theme that has not received an update in months, it’s a good idea to check in with the developer or find a more frequently updated plugin that accomplishes the same goal. When you search for a plugin in the WordPress plugin database, this information is provided in the sidebar: 4. Use Two-Factor Authentication (2FA) Two-factor authentication adds a layer of protection to your WordPress site by making it nearly impossible for a hacker to log in to your site — even if they know your username and password. You should set up 2FA for all WordPress users. 2FA can be set up quickly with simple, free plugins. Here’s a list of available 2FA plugin solutions for WordPress. 5. Brute Force protection Even with 2FA and strong passwords, it is good to setup brute force protection to help with overall performance on the server by reducing the amount of work PHP has to do. Here’s how to protect your site from brute force attacks. 6. Create automated, scheduled Backups In the event of an issue, there should always be recent database and file backups available. You should also create a backup before making any major changes to your site, such as installing plugin and theme updates. Many of the popular backup solutions take care of this for you. Here’s a list of backup solutions for your WordPress site 7. Change your login pages The default login pages for all WordPress sites are sitename.com/wp-login.php and sitename.com/wp-admin.php. Using these default login page URLs makes it easy for hackers to begin a brute force attack by trying combinations of usernames and passwords. By using a login URL that is difficult to guess, it makes it more difficult for hackers to begin the brute force attack because they don’t know where the login form lives. Here’s how to change your login page URLs. 8. Use SSL Secure Sockets Layer (SSL) encrypts all data sent from your website to the visitors browser obscuring potentially sensitive data. Using SSL has many benefits in addition to security. Google may rank your site higher in the search results and many browsers indicate whether a site is secured by SSL which can reassure them your site is trustworthy. Here’s a tutorial on setting up SSL for your WordPress site 9. Don’t use the default database prefix Using the default “wp_” database prefix makes it easier for a hacker to insert code into your database (SQL injection). Here’s how to change the default database prefix for a new site and an existing site. 10. Check your folder and file permissions File permissions define what actions can be applied to the files on your server. You should never set any WordPress file or directory to 777 permissions. Instead, make sure your permission scheme is as follows: Folders – 755 Files – 644 Here’s a guide to checking and fixing the permissions of your WordPress files and folders. 11. Disable pingbacks WordPress pingbacks are enabled by default. But for most sites, they offer little benefit. But, they can be used to turn your WordPress site into an unwilling participant in a DDoS botnet. To turn off pingbacks, you can go to “Settings –> Discussion” and uncheck the “Attempt to notify any blogs linked to from the article” box. It’s also a good idea to uncheck the “Allow link notifications from other blogs (pingbacks and trackbacks) on new articles” box: 12. Hide your WordPress version number One of the ways attackers gain access to a site is by exploiting known vulnerabilities in outdated versions of WordPress. Hackers can scan your site and easily find out what version of WordPress you’re using. If that version has a known vulnerability then the hacker has a good idea of how to proceed. The best way to prevent this is to keep WordPress up to date. However, you can also prevent a hacker from finding out what version of WordPress you’re running. Here’s how to hide your WordPress version number. 13. Don’t use the admin username Hackers can safely assume that a WordPress site is using the default “admin” username and that username will give them admin privileges so all they need to do is figure out the password. This gives them a direct path to gaining admin access to your site with a good probability of success. Eliminating the admin username makes it significantly more difficult to attack your site this way. If you’re already using the admin username, that’s okay, you can change it now. Here’s how to change the admin username. 14. Use a secure Managed WordPress Host A host that supports all the major CMSs will have difficulty staying on top of WordPress security. By specializing in the WordPress CMS alone, a WordPress hosting provider can devote the resources necessary to prevent many attacks. A reputable Managed WordPress Host will have a security team dedicated to shielding your site from threats. They’ll handle many of the concerns raised above like taking care of WordPress updates, creating backups, and more. Here at Pagely we have a comprehensive suite of security features called PressArmor that handles both WordPress application security and server security. Security questions to ask a potential managed WordPress host: Is your hosting environment chrooted? If your host has multiple domains on the same server, check with them to ensure they use chroot to isolate each WordPress app. If one app is hacked, this would help prevent access to other apps on the server. Is SSL included and easy to set up? A good WordPress hosting provider will provide SSL free of charge using a service such as Let’s Encrypt. Do you actively monitor my site specifically for WordPress vulnerabilities? If you detect a vulnerability on my site, how will you inform me? A good WordPress host will stay on top of the latest threats to WordPress sites and constantly scan your site for those threats. If they find a vulnerability, they will work with you to address it. Are you using a web application firewall (WAF) to protect my site? A WAF block malicious traffic before it reaches your site and can help prevent XSS attacks and SQL injections. Here’s a list of important considerations for choosing a Managed WordPress Host. Conclusion WordPress security cannot be taken lightly and you must take steps to secure your site. Using a Managed WordPress Hosting Provider like Pagely is one of the best ways to improve your security because you will have an experienced team dedicated to protecting you. Whether you choose to handle WordPress security yourself or leverage a host that specializes in WordPress, it’s important to treat WordPress security as an ongoing effort. You are never done with security but if you’ve taken the above steps you’ve protected yourself from many of the most common threats.
These monthly reports are provided for the WordPress community at large from Pagely’s head of security, Robert Rowley. Rowley and the entire security team keep their finger on the pulse of any potential vulnerabilities that might affect our customers, as well as any WordPress user. We sincerely hope these efforts help any and all that could use information from the experts on monthly security issues. We commend the researches and developers that help to identify and patch these issues in a timely fashion. WordPress Core No notable WordPress core security releases. Plugin/Theme Vulnerabilities of Note bbPress By The bbPress Contributors https://wpvulndb.com/vulnerabilities/10242 https://wpvulndb.com/vulnerabilities/10243 https://wpvulndb.com/vulnerabilities/10244 https://bbpress.org/blog/2020/05/bbpress-2-6-5-is-out/ bbPress version 2.6.5 was released on May 28th. This security release addresses multiple vulnerabilities including one which affects sites with New User Registration enabled, allowing privilege escalation on newly created accounts. WooCommerce By Automattic https://wpvulndb.com/vulnerabilities/10220 There exists a vulnerability within WooCommerce, which would allow users with access to modify and duplicate products to upload arbitrary PHP code to the website, then execute it. This is an authenticated vulnerability (requiring a user account), and high risk as it would allow attackers to execute code on the server itself. Note: This vulnerability is a Remote Code Execution (RCE) based on our review of mslavco’s findings. Page Builder by SiteOrigin https://wpvulndb.com/vulnerabilities/10219 The page-builder plugin before version 2.10.16 has a CSRF (Cross-Site Request Forgery) to Reflected XSS (Cross-Site Scripting) vulnerability. Attackers could utilize this attack to target site administrators to execute code within the administrator’s browser within wp-admin. The attack targets the live editor and action_builder_content functions of the plugins. Elementor Pro https://wpvulndb.com/vulnerabilities/10214 There is a critical vulnerability in Elementor Pro versions before 2.9.4 which allows any logged-in user the ability to upload and execute PHP scripts. This vulnerability is actively being utilized with a registration bypass vulnerability which affects Ultimate Addons for Elementor (described next), allowing for subscriber registration even if registration is disabled. Ultimate Addons for Elementor https://wpvulndb.com/vulnerabilities/10215 The Ultimate-Elementor plugin before versions 1.24.2 allows attackers to create subscriber-level users, even if registration is disabled on a WordPress site. As noted, this vulnerability is being combined with the Elementor Pro vulnerability described above which may lead to remote code execution on sites with registration open and both Elementor plugins installed. Photo Gallery By 10Web https://wpvulndb.com/vulnerabilities/10227 An unauthenticated SQL injection can be executed on this plugin and it looks to target the gallery_type area of the plugin specifically. Site owners have until June 5th to update to version 1.5.55 or higher before the vulnerability details will be made publicly available. Form Maker By 10Web https://wpvulndb.com/vulnerabilities/10237 A vulnerability in this plugin allows an administrator or higher-level user to perform a SQL injection via Form Maker. Site owners should update to version 1.13.35 or higher as soon as possible, as the security researchers have stated some details regarding how to exploit this vulnerability have already been released publically. Official MailerLite Sign Up Forms By MailerGroup (x2) https://wpvulndb.com/vulnerabilities/10235 https://wpvulndb.com/vulnerabilities/10236 The official-mailerlite-sign-up-forms plugin has two vulnerabilities that have recently been reported. The first deals with the MailerLite plugin not sanitizing user input data which leaves a site vulnerable to SQL injection, this vulnerability was fixed in version 1.4.4. The second vulnerability addresses CSRF issues and was patched in version 1.4.5 of this plugin. WP Product Review Lite By ThemeIsle https://wpvulndb.com/vulnerabilities/10226 The wp-product-review plugin before version 3.7.6 is susceptible to an Unauthenticated Stored XSS attack which bypasses built-in protections allowing malicious HTML or Javascript to be stored and injected on all the site’s product pages. See previous months’ WordPress security updates from April and March.
If you want to accept donations online through your WordPress website, then you need the free GiveWP donation plugin. It provides you an easy way to set up online donations with no upfront costs. This WordPress plugin allows you to accept online donations through customizable forms directly on your website. Set your donation options, include compelling content, and choose different display styles. Forms can be inserted into your posts and pages using a shortcode, Gutenberg Block, displayed as a widget, or published on a stand-alone landing page. The GiveWP demos page makes it easy to see just what this WordPress donation plugin can do and what it will look like on your site. You can also manage donors and integrate with a wide variety of third-party gateways and services. GiveWP add-ons include email marketing integrations, recurring donations, fee recovery, custom form fields, and many more. Additionally, GiveWP reports are built to give you everything you need to fully understand your fundraising performance at any time. Reporting includes multiple styles of charts, graphs, and lists with data breakdowns that help you gain a more granular understanding of your donors and campaigns. https://pagely.com/wp-content/uploads/2015/04/panning-shots-shapes.mp4 These powerful customization features and available add-ons give you complete control over your online donation forms. Build your perfect online fundraising platform however you want. HOW TO SET UP ONLINE DONATIONS WITH THE GIVEWP WORDPRESS DONATION PLUGIN Because GiveWP is free to use, it can be installed on your site directly from the WordPress plugin directory. To do so, log into your site’s admin area (http://yoursite.com/wp-login.php) and then navigate to Plugins > Add New using the sidebar menu. From the Add Plugins screen, enter ‘Give’ in the search field, and then install the first item listed in the results. Once the plugin has been installed and activated, you can start using it from the newly added Donations sidebar menu item. The plugin features a handy getting started guide that walks you through the four main steps of adding the ability to accept donations to your WordPress website. They also have a written version of the getting started guide in their plugin documentation. The setup process simply involves setting the donation amounts and customizing the form appearance. Then you can display the donation form wherever you want to on your site. Through the plugin settings pages, you can: select your default currency; which payment gateways to enable and how they should be configured; and personalize the donation email receipt template. TOP-NOTCH DEVELOPMENT AND SUPPORT Lastly, since this plugin was launched in 2015, the development has continued at a steady and rapid pace. It’s well built and is constantly getting new features and improvements. That’s probably why over 80,000 websites are using this donation plugin. Their support team continues to get accolades from the WordPress community over and over again. You can see their over 350 5-star reviews just for a few samples. And, if you ever run into issues, the plugin is well-supported and documented. They’ve even included lots of information for developers who want to customize the functionality of this tool. If you have any questions about the GiveWP donation plugin, or working with WordPress in general, please leave a comment below.
About a month ago we had the extreme pleasure of getting our remote-first team together for an in-person retreat in Gatlinburg, TN to strategize and plan the vision for our company in 2020 and beyond. Fast forward to today and we’re in the midst of a global pandemic, the likes of which none of us have ever experienced before. At Pagely we are focusing on supporting our fellow humans, being a source of light in a time that feels dark, and looking towards the future that we started planning for in Gatlinburg. For us, the daily life the nation is adjusting to right now isn’t hugely different from how we’ve been operating since we launched a decade ago. We’ve always been remote first, though the kids at home and the social distancing is something we’re still getting used to. Internally we have been discussing things like our disaster protocol, buddy systems to keep each other safe, and what this means for our team. But, ultimately we recognize the need for positivity right now, so that’s what we’re serving you here. That being said, we would like to take this time to share some insights about our team, our strategy moving forward, and what the future holds for Pagely. We hope that this can serve as a small distraction, even if for just a few minutes. Our Employees at Pagely are an Extension of Your Team The people on our team are the heart of Pagely. We’ve always known this, but we haven’t always put our faces, stories, and names in the forefront. Since we have long boasted our employees as an extension of your team, and the best-in-the-industry, it’s time you got to know us a little bit more. We are real people with families, pets, passions outside of work, and life stories just like you. So, here we are. Expect to hear more from us all in 2020 and beyond. Planning for Pagely in 2020 & Beyond Our team works remotely, spread out across nations, continents, the globe as a whole. Because of that, it’s extra special when we get the opportunity to get together in person. We met up earlier this month to hunker down in a big log cabin that sleeps 104 at the foot of the Smokey Mountains in Tennessee. In a word, it was: epic. Activities included home-cooked meals from our COO Sally and CTO Joshua Eichorn, karaoke, a pirate performance, Chipotle, and a ton of all hands strategy planning. Our company is broken down by departments, so during our strategy planning, we had the chance to hear from each department head about the current state of affairs and where things could be headed. While this isn’t a full overview of our product roadmap and strategies for each department, we’re sharing the high-level takeaways from the retreat. Also, a special shoutout to the handful of amazing Pagely team members that weren’t able to join at the retreat this time around. What We Value at Pagely Perhaps one of the biggest things to come out of our retreat was a clearly defined outline of what we value as people, and as a team, at Pagely. We’re now lovingly referring to it during team calls as The 7 C’s. You’ll see why as you read on. The long and short of it is that everything we do at Pagely is in line with these seven values, from our sales process to our security protocols and everything in between. Caring We believe passionately in living the golden rule and actively promoting the holistic well being and success of our customers, our company, and ourselves. Doing what’s right always comes first. Consistency We are consistent across our actions, communication, service delivery, and user experience. Creative We cultivate and freely share ideas to improve our product, profitability, process, and performance. We understand that constraints are a means of discovering creative solutions. Communication Trust is built on clear and timely communication at all times between each other and our customers. We talk about the good stuff as well as hard stuff to uncover and implement the best solutions and path forward. Competency We maintain and build on our depth and breadth of expertise, always seeking knowledge and refining our skills to bring them to bear for the good of our company and our customers. We aim to employ highly intelligent people who share the same values to drive the best products and services. “Control without competency is chaos” Confident We are confident in the solutions and value that we deliver to our customers and in our abilities as a team to discover and solve challenges before us. Conscientious We are aware of the cascading effects of our actions within our platform, how our tone may be perceived in communication, and how our individual efforts contribute or may detract from our mission. Support Under the supreme +1 leadership of Kris Lagraff, one of our longest-standing team members, our support team just keeps getting better and better. Looking ahead, our team will: Keep expanding our head count Continue crushing that 12 minute average response time to tickets Build on collaborating with the Product and Sales teams to ensure we’re building the best tools to fit our customers’ needs. Fun fact: Kris is based in Colorado and had a stint as a professional snowboarder. Engineering Our CTO, Joshua Eichorn, has a comprehensive road map in place to take us all the way through the year. We’ll get into more details in another post, but in the meantime, the engineering team is working on onboarding a new product manager to help us manage projects most efficiently. Fun fact: Josh is a father of two and his pool stays open year-round (because he lives in Arizona, lucky him!) Security We know at Pagely that due to the nature of security risks, we cannot plan out a roadmap as a set schedule, but instead must act dynamically, moving and reacting to new risks as they present themselves. Robert is planning for his team to focus on security not only for our customers, but also internally for our company to keep customer data as secure as possible. Fun fact: Robert knows a lot about beer, and eclectic music. Devops This guy right here, Arman, is a behind-the-scenes mastermind. His leadership in our devops department helps to keep the whole company running. In 2020 devops and hosting operations will be hiring new team members, scheduling more game days and hackathons, and helping to control our spending so we can keep prices as efficient as possible for our customers. Fun fact: Arman lives in L.A. and has cool tattoos. Marketing Our marketing department welcomes a new director with big plans for our brand, growth, and community relations. We’re currently undergoing a massive project to present Pagely in a more refined, intentional, and beautiful way. Stay tuned for design and branding rollouts over the course of 2020 and beyond. Fun fact: Dave just joined our team and his nickname is Digital Dave, Digi for short. Sales Our sales department is different. Matt and his team exist not only to sell our product but to make sure our new and existing customers are getting the most they possibly can out of our offering. Pagely being an extension of your team starts with these guys and gals. From day one, we’re focused on aligning your needs with the most value and advising you on how to best meet your business goals. Fun fact: Matt is as close as our team gets to an Influencer. He’s famous for hosting the WordPress podcast The Matt Report. Now, more than ever, we want to express ourselves as people who are standing with you, side by side, during this uncertain time. We won’t promise to fix the state of the coronavirus with our cure-all product. Instead, we will promise to be realistic with what we can offer, patient with each other, and fully supportive of the human race as a whole. We’re in this together. Stay healthy and keep looking towards the light! Photographic proof of Team Pagely on a pirate ship in Gatlinburg, TN.
Talk to any boots to the ground entrepreneur, especially in tech, and they’ll tell you Mixergy is one of the podcasts they listened to when they were getting their business started. The same goes for us. That’s why we’re psyched to announce our co-founder and COO, Sally Strebel, as the latest guest to go under the gauntlet with Andrew Warner (who we know and love). Andrew, the host of Mixergy, asks self-proclaimed uncomfortable questions to dig deep into the success and failures of the most successful business founders and thought leaders. With that preface, we weren’t sure what Sally was getting into ahead of time, but we jumped at the opportunity to share our story on such a well-respected platform. Listen to the full interview here, or on Spotify below. <span data-mce-type="bookmark" style="display: inline-block; width: 0px; overflow: hidden; line-height: 0;" class="mce_SELRES_start"></span> Sally and Andrew dig into topics that cover how Pagely got started over a decade ago how we were able to grow into one of the most well respected Managed WordPress Hosting providers in an age before social media marketing even existed, and why they turned down funding from Matt Mullenweg, one of the famed founders of WordPress and now CEO of Automattic. Plus, you’ll want to listen closely as Andrew and Sally get to the end of the interview when Sally lets you in on a little secret that will be redefining the future of Pagley. Tune in. We’re making it a priority to introduce you to the faces behind Pagely… Any developers should not miss Maura Teal, Pagely Engineering, on her detailed documentation strategy for distributed teams. Interested in supporting equal pay for women? Watch Lizzie Kardon, Pagely Marketing, on NBC fighting for pay equality. Follow Sally on Twitter, but beware you might blush on occasion because this female founder tells it like it is.
Today I went on national television to represent over 500 women in tech because it’s time to close the pay gap and start paying people what they’re worth. The tech industry has long been dominated by men, with only 25% of the workforce being made up of women. Yes, this isn’t a new conversation. Women make up only 25% of the tech industry workforce. I am, however, joining this conversation now as a proud member of Team Pagely, a marketer, and an advocate for working mothers and women. I’m using a platform I am blessed to have access to, to reach you here and use my voice to make positive change in an industry that desperately needs it. NBC reached out to me about a segment on women sharing salary info, after a viral New York Times piece circulated online. A project I put together caught their attention; the Women in Tech Salary Transparency Project, so they asked me to talk with them about it on the TODAY Show. This morning that segment aired to millions of viewers. Watch it here. Maybe it’s the fresh air of a new decade or the fact that I’m sick of hearing how my female peers are underpaid, but my Salary Transparency project came to life to illuminate the pay gap we’re still seeing in 2020 as women in tech. This crowdsourced data highlights the salaries, benefits, experience level, and location of over 500 women from across the world. Over $5M in annual salary revenue is missing here, because of gender inequality. By the numbers, with women making as low as .90 to every $1 for men, the 500 women in this project account for over $5M in missing annual salary revenue. Multiply that by the hundreds of thousands of people that work in tech? That’s a huge chunk of our economy. My hope with this project is that women can use this information to support themselves in salary negotiations and better understand their monetary worth when it comes to the work they’re doing every day. View the Women in Tech 2020 Salary Transparency Project Diversity in tech shouldn’t be something we’re scared to talk about, it should be celebrated. My hope is that this project and national coverage by NBC can help get us a little bit closer. Gender plays no part in how much I (or anyone else) get paid to do my job at Pagely…. and we’re hiring.
On stage at AWS re:Invent 2019 this week, Pagely was recognized as the best-in-class, and only, Managed WordPress Host AWS Retail Competency Partner. As AWS puts it, “if you’re on a journey to transform your business while driving new value to end customers, AWS Competency Partners have the expertise and comprehensive capability to help retailers succeed.” Pagely is widely regarded as the premier hosting provider for scalable e-commerce solutions. With this latest achievement, we’ve proven that we continue to push the boundaries of what customized, reliable, fast hosting means to high-traffic retail businesses worldwide. Today we add this to our ever-growing list of AWS programs that make us an Advanced Technology Partner. Serving our clients with the highest caliber of service and technology, as well as reaching an audience of over a million people through our work with AWS. Hosting with Pagely ensures personally fine-tuned performance, proactive protection for your customer data, smooth traffic surges, and a highly competent extension of your team. As your business scales, you won’t ever outgrow our hosting. How is that possible, you ask? Because Pagely’s infrastructure is built on AWS, giving you access to virtually unlimited server resources. “We think of each client’s needs holistically and not just monetarily or as a number” added Sally Strebel, our COO and Co-founder. Pagely was the only managed WordPress host recognized as AWS’s Top Partner for Highly Specialized Solutions. Our optimized hosting solution, combined with the expertise of our staff, helps business-critical e-commerce sites thrive during extreme moments of growth. That’s something you can count on across reliability, flexibility, durability, and transparency. Reliable WordPress Hosting for Retail & E-Commerce Since downtime means lost revenue, we guarantee 100% AWS infrastructure uptime, included in our standard service level agreement (SLA). We value transparency, so our SLA is publicly available here. With a high standard of service that includes proactive site monitoring and multiple availability zones (and high availability solutions) we help to mitigate against disruptions, and so much more. Flexibility to Ensure The Best Hosting For Your Retail Business At Pagely we understand every business is unique and we can help develop the best solutions for how best to scale your site. We use Amazon Elastic Cloud Compute (EC2) servers exclusively dedicated to the WordPress application and processing incoming front-end traffic. Your developers will always maintain command-line access, with the support of our team available around the clock when you need it most. A Durable Host for E-Commerce Sites that Scale We pride ourselves in offering an 11 nines data durability guarantee. Keeping recent backups is critical in the event of a catastrophe, especially during a promotional sale or big day like Cyber Monday. With that, we provide completely managed and automated nightly backups of all of your files and databases, with a 14 day retention period. Backups are archived in off-site secure storage at Amazon’s Simple Storage Service (S3) service. A Decade of Leadership in WordPress With our leadership team making the rounds at re:Invent 2019, Strebel, Joshua, and Arman can’t stop smiling after this exciting announcement. From what we hear in the company Slack channel, the guys are shaking all the hands, offering insightful recommendations for many, and celebrating with the wonderful partner team at AWS. Joshua Strebel (our famed CEO), Joshua Eichorn (the best CTO ever), and Arman Zakaryan (DevOps leader extraordinaire and all-around extremely nice guy) at re:Invent 2019 Pagely has over a decade of experience optimizing WordPress for e-commerce. Our work towards achieving this new competency is another way of showing you, our clients, how much we care about your businesses. For us, business is personal, and putting in the hard work to be able to serve you best is well worth the time and effort.
One of the biggest benefits of using the WordPress content management system is the enormous development community supporting it. Whether you need a new WordPress site with custom functionality or a nifty new plugin, there’s hundreds of web development companies ready to take on your WordPress project. But, having so many options presents a challenge: which WordPress agency is best for your project? OUR AGENCY PARTNERS: As the world’s #1 managed WordPress host, we’re deeply involved with the WordPress community so we have access to some of the best WordPress design and development companies in the world. These are companies we’ve carefully vetted and worked closely with on shared projects. If you’re looking for WordPress development, you cannot go wrong with any of these agencies. And, as Pagely partners, they’ll be able to build and host your project on our advanced WordPress hosting platform. Founded in 2010, Devrix is a technical WordPress development agency with a full menu of services. They employ developers, designers, systems engineers, and marketing professionals so they can help with everything from migration to social media marketing. No project is too large or complex. Devrix can create a WordPress-based SaaS app or website then help you host and maintain it. With their digital marketing background they also double as a marketing agency helping you grow your site traffic and community after its launched. Services offered: Custom WordPress development Design and frontend development Custom WordPress plugin development SaaS application development Third party API integration Marketing assistance and business consulting Server management and website maintenance Notable clients: FanBoom diginomica Tyche Software Devrix website Valet’s goal is to handle every aspect of your WordPress website so your company is free to focus on other aspects of managing and growing your business. They have unique systematic approach to website optimization they call their Website Health Hierarchy. This unique framework covers everything from website security to conversion so you can be sure you’ll end up with a website that is not only beautiful, but effective. Services offered: Host selection and site migrations Expert level WordPress site support WordPress development services Long-term WordPress website management Valet website 10up is a full-service digital creative agency with strategy, design, and engineering services. 10up has a large team distributed around the world allowing them to leverage global talent. They create “digital experiences that advance business and marketing objectives.” They’re committed to open source software and recently established an official Open Source Practice. Services offered: WordPress site design and development Design services Notable clients: Motor Trend FiveThirtyEight TechCrunch 10up website Since 2003, Creative Slice has been focused on creating websites that reflect the best of every organization they serve. This agency is a diverse team with specialists in everything from business topology mapping to advanced 3d modeling. And, of course, they’ve assembled a stellar group of programming and development, design, and marketing professionals capable of end-to-end service for your WordPress project. Services offered: WordPress development Ecommerce Illustration Branding SEO Notable clients: Taco Bell Tricon Homes Reid Park Zoo Creative Slice website Reactive Studios is a WordPress development company that specializes in complex integrations and custom development work. Focusing on simple solutions to complex problems, Reactiv’s unique skillset was summarized well by Chris Lema, “When you have a project no one has ever tried before, you need a different kind of smart. You need Reaktiv.” Services offered: Bespoke website design and development Strategy & consultancy API & integrations Platform migration Code review Notable clients: Harvard Business School Rainmaker Digital NextDraft Reaktiv Studios website You can think of WP Site Care as your outsourced development team for high-quality WordPress web design projects. If your company isn’t quite at the point where you can hire inhouse WordPress developers, WP Site Care might be the perfect solution. Services offered: Ongoing management and maintenance of your WordPress site & hosting Quality assurance On-demand development Notable clients: TekRevue.com XYPRO JaredAtchison.com WP Site Care website Performance Foundry builds better websites for better businesses. Usually operating on a retainer, they’re able to help with ecommerce websites, corporate sites, lead generation, blogs and publishing platforms, and more. They use a unique 7-step process to ensure their clients end up with a stellar, completely customized website that perfectly fits the bill. Services offered: WordPress site development WordPress speed optimization Malware removal and security hardening Notable clients: The Manila Times School Food Handler 5 Day Deal Capsilon Performance Foundry website Webdev Studios offers solutions for any size business, from small startups to world-class Enterprises. These guys literally wrote the book on WordPress with three books published so it’s fair to say they have valuable expertise that could benefit your WordPress-based business. Services offered: Data migration API integration Performance and security consulting Website design and development Ongoing website maintenance Notable clients: Starbucks Appirio Skype WebDev Studios website Other recommended WordPress agencies: Outside of the digital agencies we’ve partnered with, there are many excellent WordPress development companies to partner with. While we don’t have an official partnership with these premium WordPress agencies, these companies have stellar reputations and are an excellent choice for a new website, redesign, or app development. Whole Grain is a WordPress agency that’s focused on a caring, attentive approach. They’ve developed a unique approach to web development they’ve dubbed “efficient by design” that produces sites that “are performant, accessible, optimised for search and friendly to the environment, so your website looks good and is good at the same time.” Services offered: UI/UX design Frontend development WordPress websites that leverage the Granola framework Notable clients: UNICEF Method NetworkRail Wholegrain Digital website SAU/CAL is focused strictly on building the best ecommerce sites using WooCommerce. Their ecommerce specialization gives them unique expertise. While WooCommerce is a WordPress plugin, it’s its own animal with unique design and development challenges. SAU/CAL can help you design and develop a unqiue online store that converts and help you maintain it with customization options as you grow. Services offered: WordPress ecommerce with WooCommerce Ongoing support Managed maintenance Notable clients: Phlearn Output Hello Subscription SAU/CAL website Codal is a large, global agency with WordPress development expertise. Their mission is to “work with the best, design with a purpose, and engineer your company for an innovative future.” Headquartered in Chicago, they have offices in England and India for a global presence. Services offered: Fully responsive web and mobile development Ecommerce Digital strategy Emerging tech like Internet of Things, Machine learning, and AI Brand development Notable clients: Motorola Pepsi Quickbooks Codal website Human Made focuses on large publishers and Enterprise clients. They leverage open source solutions to create user-friendly, dynamic sites with advanced custom functionality. Their namesake tells you everything you need to know about their focus on user experience. Services offered: Custom WordPress development Strategy and consultancy Hosting infrastructure Notable clients: AirBNB USA Today Snopes Human Made website
B A N A N A S Pretty much sums up the last year – It’s been bananas. Never ending Pandemic, New Brands, Growth, Working towards compliance, New Product Launches, and more. This September 2021 is a very special month for us. Pagely, and by extension the entire multi-billion dollar Managed WordPress Hosting channel, is 12yrs old! Quick Flashback: In Early 2009 I opened up my IDE and started looking at some code we wrote in 2006 for a website builder based on WordPress. I added a few features to it, picked a new leet domain name, and in September 2009 – Launched Page.ly – The world’s first Managed WordPress hosting company. All the WordPress hosting buzzwords you know and love: Automatic Backups Automatic Updates Blazingly Fast Secure like Fort Knox 1 Click Staging Caching All. Of. It. Started. Here. Yes of course it is true we did not actually create everything under the sun, however the early work we did in the space is the parent to every Managed WordPress product offering available, regardless of the company selling it. Except billing for Pageviews, eff that noise – we don’t want any part of that. Team Retreat in 2015 Always Forward As Pagely begins it’s 13th year we have a strong wind at our back once again. I’m sure in some companies, especially investor fueled ones, growth is always fast and up while profitability is tied up in ropes and cinder blocks, then thrown off the end of the pier. In our company we’ve had our periods of growth insanity and just normal one foot in front of the other measured progress to increased profitability and high NPS scores. 2018 through most of 2020 was a bit of an odd timeframe for us when looking back – we invested heavily into the development of NorthStack and gained deep technical learnings. These lessons were then applied to Pagely as the decision was made to pause the NorthStack product while we felt out how the world was going to react to a fast spreading novel Coronavirus. Team Retreat Early 2020 As we came up to a major revenue milestone in 2020 we turned our focus inward to reevaluate our processes and to create new ones, address team makeup, and revisited our mission and values. We took the time to prepare for what was coming and to lay the foundational groundwork for our future goals. Less manic startup energy – more “we’re a real business now” mentality. We hired into newly created roles in team management, finance, enterprise sales, and compliance. Sally and I handed off more and more of the day-to-day responsibilities to our skilled team so we could take stock of where we are, and where we needed to go. Then we all worked together to formulate the plan to get us there. Allison’s (SupportOps Manager) dogs: Winne and Lola (“Karen”). The last year has been all about executing on that plan. We added 30% to our headcount – while improving and expanding our benefit offerings. We’ve engaged the services of an auditing firm and will shortly achieve SOC 2 – Type 2 compliance certification. Our brand glow up – which is the culmination of months of work by our Dir of Marketing Dave Amirault, and the creative team at Struck – will be launching momentarily. We’ve delivered on many of the requested features to our Enterprise clientele such as Single Sign On (SSO) to our services, and expanded support models and enhanced SLA’s. Back of the napkin math tells me our employees significantly increased their usage of PTO – after much encouragement and prodding from myself and their team leads. We launched Mercury just a few weeks back, which is a major win for our bottom line and our customers’ site performance. 20-30% faster network speeds on every request at cheaper data rates. Truly a win-win. These and many more items that are part of our strategic plan have resulted in a steadily growing sales pipeline and a pronounced upward shift in our momentum heading into 2022. Did I mention we are hiring? Get your tech jobs here. Times have changed. The important stuff has not. Jeff Matson’s doggo – Henry 2021 was also an emotional roller-coaster as we all bared witness to the, at times, abject selfish nature of people — and — the grit, empathy, and kindness of others. Sally and I have personally seen all of this up close and personal this year, a story we may share at another time. Each day though we took heart that by and large, the world is good and things tend to work out in the end. Keep the good people in your life close, and hug your kids every day. It costs you nothing to be kind. We lean on our core values as we make decisions and plan for the future. We also relied on them heavily in the past as we navigated the ups and downs of the pandemic. Sally has always said that if we do the right thing, success will follow. Doing the right thing by the people in our lives, our companies, and our communities is typically a selfless act with no expectation of return. At times though, the universe does surprise you with a healthy payback of goodwill, tenfold. There are lot’s of new faces at Pagely, as we said goodbye to others. It seems everyone has collectively reevaluated how they wish to invest their work time. Many leaned into the stability of good careers, others felt it was time to explore new options. At each coming and going I’m thankful to see new faces embrace our vision and values and old friends take a little part of the Pagely magic with them as they move forward to a new adventure. We are just as committed today as we were yesterday, and every day prior to becoming the best version of Pagely we can be. Branding work in 2021 Looking forward is as exciting today as it has been at each one of our 11 prior birthdays. I want to personally thank the team here at Pagely, and all of our customers and the fans we have in the WordPress community for being part of our journey thus far. Happy Birthday to Us. This coming year is going be the most interesting chapter in our story yet. I guarantee it.
