Between November 1 and December 31 of 2017, e-commerce businesses racked up a total of $108.15 billion in sales, according to Adobe. 2018’s holiday season sales are estimated to reach $124.1 billion, which is an impressive leap and one that’s sure to delight e-commerce companies everywhere. Smart targeting of the 4 different kinds of holiday shoppers can help you take a larger piece of that pie than you might otherwise get. That said, the holiday sales season won’t last forever. When Shopify surveyed high-growth online merchants about seasonal sales spikes and how they saw that affecting sales in other quarters, Q1’s expectations were pretty abysmal. But does it have to be this way? Should you just kick back and let the post-holiday spending slump wash over you? Nope. Here’s our guide which you can start putting to use right now to set yourself up for a better kickoff to the new year, including 11 actionable ways to boost customer sales after the holiday season. Click each title to head straight to the full strategy plan below: Check and Update Your Tech Optimize Checkout Take Down the Decorations & De-Holiday Your Site Put Holiday Data to Use Enable Follow-Up Strategies Prepare for Returns Staff Your Customer Service Offer Post-Holiday Discounts Launch a New Product Promote (or Start) Your Loyalty Program Segment Your Marketing https://pagely.com/wp-content/uploads/2018/11/lumen5-video-5.mp4 I would argue that you can, in fact, still make a good amount of money from your e-commerce business even after the holidays. It’s simply a matter of preparing your website to appeal to customers’ altered state of mind. So, let’s talk about how to boost customers’ post-holiday spending with your WordPress site. Boost Customers’ Post-Holiday Spending with WordPress There’s no reason to throw in the towel after the holidays, though I understand why you may be inclined to do so. Holiday revelers are exhausted from all the festivities and gift-giving, and their wallets feel lighter than usual as a result. Plus, you did a lot of work to prepare your website, business, and inventory for the holiday season. Isn’t Q1 the perfect time for a break? Rather than embrace the assumed lull in website activity and sales after the holidays, there are certain things you can do to boost post-holiday spending with your WordPress site. 1. Check the Tech Before you do anything else, review the technology powering your website and sales flow. You’ve put a lot of pressure on it during the holiday season, so it’s good to take a moment and make sure those surges in traffic didn’t weaken the system. Plus, if you were busy managing things like customer service and order fulfillment at the time, you might’ve lost track of what was happening to your website over the holidays. Performance Run a speed test on your WordPress site. The free Pingdom speed test will let you know if any performance optimizations are needed. Ideally, your website should load in under 3 seconds. Review Pingdom’s suggestions and apply them to your website as soon as possible. Security The holidays are the perfect time for hackers and bots to sneak into a website when you’re busy looking in a million other directions. Sucuri SiteCheck is a free tool you can use to quickly check for security warnings or vulnerabilities. Before you start encouraging people to return to your website, check your security first. Updates If you’re not automating WordPress, plugin, and theme updates, make sure you have time scheduled every day (or, at the very least, every week) to log in to your website or WordPress management tool and verify that all updates have been made. With the recent release of WordPress 5.0 this is a good time to review for an update. These are essential not just for maintaining security, but also for keeping performance-optimized. Switch Hosting (optional) If you find that you let any of these essential parts of WordPress management fall by the wayside during the holidays, you might want to ring in the new year with some new tech. Specifically, by switching your website to a new managed WordPress hosting company. 2. Optimize Checkout According to a ShipBob infographic about shopping cart abandonment, there is a lot of money lost when checkout is not optimized: If customers left a lot of items in shopping carts over the holidays, it might be a sign that there’s something that could be improved with your checkout process or payment processing tool. Take some time to review the checkout flow and make sure there are no issues preventing users from converting. There’s a lot to gain if you do: 3. Take Down the Decorations You know those people in the neighborhood who wait until March to take down their outdoor decorations? Or those people who leave the Christmas tree up most of the year? The last thing you want is for post-holiday shoppers to look at your website with as much disdain as some people tend to do when they see unseasonal decorations hanging around. This means your website should be de-holidayed by January 1. Here are some ways to do this: Revise wording that’s festive in nature, even if it’s not as explicit as “Happy Holidays!” Undo any style changes you made to the design or color palette. Remove any promotions that ran over the holidays. Even if you intend on running the same or a similar sale in the new year, give it a new look and messaging. Adjust the home page to reflect the current season for your shoppers. Perhaps a shift to “New Year, New You” makes sense, or go with something more agnostically winter-themed. Restructure the navigation so that categories like “Gifts” and other popular products sold around the holidays don’t receive top billing anymore. Update your search metadata if you used it to target holiday shoppers looking for specific products. Even if you didn’t explicitly spiff up your e-commerce site for the holiday season, the start of the year is always a great time to give it a facelift. 4. Put Holiday Data to Use Whether you use Google Analytics or an alternative data-tracking tool to measure traffic and sales activity on your website, now is a great time to put it to use. A great way to boost customers’ post-holiday spending with your WordPress site is to deliver personalized content. The only thing is, personalization might be limited if the only real information you have is the referral source. However, because Q4 is ripe with on-site activity and sales, you now have a treasure trove of data to tap into. Look at the products that were viewed but not acted upon. Peer into their unfulfilled wishlist. Identify attractive upsell or cross-sell offers for things they did actually buy over the holidays. Dig deep into that data and put your analytics tool, CRM, and lead generation machine to work for you in Q1. Your customers might not have returned to your website with the intention of buying more; maybe they just wanted information on returns. But by presenting them with a custom-made recommendation or offer, you can increase the likelihood that they’ll stop and buy something while they’re there. 5. Enable Follow-up Strategies In order for this next one to work, you will need to enable these technologies before you get too far into the holiday shopping season. When implemented, you’ll have a way to automate follow-up with customers who already made a purchase or just window-shopped over the holidays. Cart Abandonment As I mentioned already, shopping cart abandonment can be a major problem for e-retailers. Obviously, you need to get your technology in line first to make sure you’ve provided the optimal experience at checkout. Then, install cart abandonment and recovery software to automate the follow-up with customers via email: “Oh, hey! Looks like you forgot to buy this.” Consider using Conversio. This email marketing tool helps you recover customers at different stages of the conversion flow. Retargeting Retargeting is another way to stay on top of visitors after the holidays are over. If they spent enough time looking at a product or another page on your website, your tracking pixel follows them onto other websites. Reminders will be subtle ad placements, familiar enough to get them to stop in their tracks and wonder: “Is that the item I was looking at last month?” By using what you know from their time on-site, you can effectively drag them back to complete the sale. One of the best tools to do this is Google AdRoll, which will place your reminders and ads all over the web: 6. Prepare for Returns After the 2017 holiday season, shoppers were expected to return $90 billion in gifts. That is a quarter of all returns that retailers have to process all year long. The United States Postal Service said the first two weeks of January 2018 brought a huge increase in returns, thanks to online holiday shopping. They handled 6 million returns in those two weeks alone. Jonathan Byrnes, a senior lecturer at MIT’s Center for Transportation & Logistics said: “Returns are one of the most under-managed and most expensive areas in business. Retailers don’t know what to do, so they’re basically putting their heads in the sand and hoping it’ll go away.” But that’s the worst thing you can do at a time like this. The customer experience doesn’t end with the sale. Realistically, it should never end if you’re focused on retaining their business over the long term. Which means you need to build a process for, first, handling returns and, second, reducing the losses during the post-holiday returns bonanza. Here are some suggestions on how to do this: If you have a brick-and-mortar store counterpart, allow for in-store returns. This will take the load off of your online team as well as reduce the cost of shipping you personally have to handle (if you offer free shipping). Hire and quickly train a team of dedicated freelancers to work solely on processing returns in the month of January. Streamline the returns process online. Encourage customers to create an account at checkout so that they can log in and download shipping labels and start the returns process on their own. Provide a space on your shipping insert to allow for exchanges. This way, customers aren’t forced to return and re-purchase something if a different variation of the item can easily be exchanged. Make sure you use a payment processor that quickly handles refunds. I would also suggest updating your website with personalized recommendations around these returns-related areas, like the support, contact, and account pages. That way, if customers came to the website with the intention of exchanging or returning an item, you’ve conveniently provided them with helpful suggestions for replacing the unwanted item. 7. Staff Your Customer Service Support for customers post-holidays won’t just revolve around handling returns. You need to be ready to answer questions about the things they bought or received from others during the holidays, too. To start, have FAQs set up on your site as the first line of offense. It’ll answer all the common questions asked about your products, services, or policies. Also, set yourself up on all the customer service channels your customers typically go to. Consider: A support portal Customer service phone line Live chat Email Social media Facebook Messenger, Slack, or other messaging channels Finally, don’t be afraid to develop a set of canned responses to equip your team with. Just as you want your website to provide customers with consistent and helpful messaging throughout, you want your team members to be able to do the same. 8. Offer Post-Holiday Discounts As you do all this work to make your WordPress site an appealing destination for post-holiday spending, sweeten the deal with discounts they can’t get other times of year. Many e-commerce companies go the route of hosting an annual sale the first week of January every year. Long-time customers know when it’s coming, so it’s an easy way to bring them back to do more business. It’s also a great way to motivate new customers to stop by. However, I’d suggest you take a look at last year’s analytics and sales reports to see what your traffic and sales looked like on a daily basis throughout January. Were there any days of the week that saw more visitors than usual? Or certain parts of the month? If you know when they’re more likely to open their wallets again, you can run your post-holiday sales during those time periods. When choosing what to discount or promote, be sure to take a look at your inventory. There are creative ways to boost post-holiday spending if you choose the right items to promote. For instance: The Candy Bin Run a sale that’s up to 90% off (or whatever percentage you’re most comfortable with). Then, look at the extra inventory that was difficult to sell over the holidays and give those items the deepest cuts. It’ll be like a drug store candy bin after Halloween or Valentine’s Day. Free Gift with Purchase Another way to get rid of inventory that didn’t sell well during the holidays is to give it away as a “free” gift. It should be something that doesn’t cost too much, but that customers would still find appealing enough to make a purchase in order to get their hands on it. Product Bundling This one is especially great for companies that sell services and software. Look for creative ways to bundle popular items with items your customers might not be aware of. New Year, New You Tap into people’s inherent desire to start a new year afresh. Even if they didn’t immediately rush out on January 1 to snag that product or service to make them healthier/happier/more organized/etc., they’ll likely eventually get into that mindset as they watch everyone around them jump on the bandwagon. You can take advantage of this by running your own “transformation” promotion during Q1. 9. Launch a New Product While the competition is kicking back and accepting their new year’s slump, you can charge forward with the release of a new product. We’re taking our own advice here with NorthStack officially going live in January! Start promoting it during the holidays and drum up people’s interest early so that, when it does launch in Q1, you have people eager to buy it. This would also be a good opportunity to put a waitlist on your website and let customers sign up early. With their permission, you can send them updates on the release as well as occasional reminders about other things you sell that might be of interest. 10. Promote Your Loyalty Program If you’re trying to boost post-holiday spending – or, really, spending any time of the year – a loyalty program is a fantastic way to do it. While you can certainly build trust and loyalty in customers without one, a loyalty program helps you build deeper connections with consumers which, in turn, increases their confidence in spending money with you. According to this press release and report from Bond Brand Loyalty: Consumers spend 37% more with brands when they are a loyalty program member. So here is my suggestion to you: Contact loyalty program members shortly after the holidays with something like: “You’ve earned 25,000 points since July. Nice work! How about you put those points to work and buy yourself something nice now that holiday spending is behind you?” And for those shoppers whose email addresses you have, but who haven’t yet signed up for your loyalty program, contact them with something like this: “Did you miss out on our insider deals during the holidays? Make sure that doesn’t happen next year. Loyalty members saved 35%, on average, over the holidays!” You get the point. You want to reinforce the idea that membership has its privileges – and that those benefits are ripe for using at this time of year, too. 11. Segment Your Marketing If you want to reach new customers and stay in touch with current ones, you have to constantly strategize ways to get in front of them even when they’re not on your site. Above, I mentioned a number of ways in which you can use your site to market to your customer base and boost post-holiday spending. But you can use your other channels for this as well. Just make sure you segment them accordingly. Email Marketing Email marketing, for instance, is best used for: Current customers: Provide personalized suggestions based on activity on the site and previous purchase history, pointing them towards similar or related items they can buy now. Loyalty members: Offer insider deals and special loyalty rewards to encourage them to shop during certain time periods in Q1. Warm leads: Continue with your value-driven messaging, educating prospective customers on all the reasons why they should buy from you and providing incentives for them to do so. You should also have your email marketing platform and site configured to send follow-up emails to anyone who made a purchase over the holidays. The first message, of course, would be a Thank You and Confirmation email. The subsequent one could provide more details on the item purchased, remind them of support options, and so on. And later ones can just be brief messages that alert them to upcoming sales or new seasonal items they might be interested in. The point is, keep in touch. Social Media Marketing Your retargeting efforts on social media are ideal for connecting with people who already visited and made a purchase on your website. However, in the post-holiday period, social media itself is a great way to reach a new set of customers. Just remember that social media has to be about THEM and not YOU. Craft some visual content you can share on social organically. You’ll want to create paid ad counterparts that you can then promote in places like Facebook, Instagram, and Google. And make sure that whatever you advertise there aligns with the reality on the site. First impressions are a big deal, so you want to make sure you 100% deliver on the promise that lured them to your site in the first place. Wrapping Up The holiday sales season is an incredibly profitable one for online retailers. But I don’t believe it has to stop there. By realigning your site and your business to the customers’ shifted mindset, you can effectively boost their post-holiday spending and keep your profits on the up-and-up well into Q1.
As of December 6, 2018 WordPress 5.0 Bebo has been released, making Gutenberg now the defacto editor on WordPress applications. Pagely strives to keep all applications up to date, ensuring that the latest version is available to and being utilized by our customers. Given the magnitude of this update we wanted to address some steps you can take to ensure compatibility as well as announce that we will be holding off until after the holiday season to implement the update for all of our customers, unless specifically requested. We’ll notify our customers when we are ready for a hard release of Bebo early next year, and you can read our full plans for the release between now and then. There’s lots of documentation online about the new release, so we’re boiling it down to everything you actually need to know about Gutenberg and how to make sure your application is compatible. What is Gutenberg? Gutenberg modernizes the editor experience in WordPress, replacing the classic editor utilized for creating Posts and Pages. TinyMCE will be utilized within blocks, which are movable objects within the new editor. The content is still saved in the same place (wp_post) and utilizes the same function, but the editor itself is now an SPA (single page application), meaning it runs on a single page load. To do this, Gutenberg runs COMPLETELY on JavaScript and Ajax requests utilizing the React framework. Why is the Gutenberg release a big deal? The reason this is such a big deal is because of the way content creators and developers have used WordPress in the past. All customizations in the WordPress dashboard, such as unique post types that have to do specifically with an event, or a person’s profile, whatever you can imagine, were displayed to function with the traditional editor – so if the WordPress API didn’t interact properly with these custom post types and respective meta boxes – you were in a bit of trouble. Compounding to this anxiety was the meta boxes – If we have this new interface to interact with, what happens to meta boxes? Meta boxes are basically user interface pieces. Wrappers for individual sections of the interface on the post editing screens. There are several by default, such as the Formats, Tags, and Category boxes. A plugin can add meta boxes to be used for whatever purpose they need them, and meta boxes can both have information and receive input. Over time (like most things) this has begun to seem like not as big of a deal, as there are methods to either make custom post types compatible with Gutenberg, or to default to the classic editor. Meta boxes appear to work, but are inconveniently put at the bottom of pages now. Still, meta boxes should be tested – Please read WordPress.org’s Gutenberg handbook on meta-box extensibility. Main areas of concern: Custom post types and PHP meta boxes seem to be the biggest concern. Unless you’re a developer who has been proactive, proceed as if everything can and will break. How to test your Application’s compatibility with Gutenberg: First, we recommend using a staging or development environment that’s a direct clone of your production environment. We suggest doing some heavy unit testing, for this you can use the block unit test plugin. If you find issues that you don’t believe you can resolve right now, you can try installing the Classic Editor Plugin which will return you back to the old version of the editor. Your developer can check here for additional information on checking Gutenberg compatibility. Helpful Resources: We’ll keep on the lookout for how the community is handling Gutenberg and helpful links, and update that information here. Just in case you want to revert, use the Classic Editor Plugin Here’s the technical overview of Gutenberg Matt Mullenweg’s Gutenberg FAQ, notes and community commentary Check back here for the development updates to Gutenberg Yoast is integrated with Gutenberg WooCommerce has a multi-layered response and has released a crash course video on how to survive Gutenberg After two years in dev, the official AMP plugin is out and Gutenberg ready Zac Gordon’s Gutenberg Development Course to get up to speed Please let us know in the comments if you have any resource suggestions for us to add to this list. Our hope is to provide an easy resource for you and all of our WordPress using friends. …and a big congrats to all of the people who worked really hard (and continue to do so every day) to keep improving WordPress!
Online sales during the 2018 holiday season are expected to top $123.4 billion in the United States alone. There’s never a better time to generate more sales as an ecommerce business than during the holidays. But many online stores don’t develop a plan to target the right buyers, causing them to miss out on potential customers. Not all customers are alike, though. If you market to everyone the same way, you’re not going to get the best results, because different buyer personas respond to different messages. I’m going to show you how to target the four different types of holiday shoppers to increase your ecommerce conversion rate. https://pagely.com/wp-content/uploads/2018/11/lumen5-video-4.mp4 Holiday Shopper #1: The Evergreen Shopper The most basic holiday shopper is the evergreen shopper. These are individuals who shop all year-round and are what you’d consider the average consumer. They’re not obsessed with finding the latest deals and you won’t find them doing their shopping last minute. Instead, they’re more balanced. Your marketing will need to reflect that, bringing me to my first point. Get Your SEO in Check A total of 74% of evergreen shoppers use search engines for shopping. So if your SEO isn’t in good shape, you’re not going to get any organic traffic. This means losing sales to competitors that are putting this into practice. The main component of SEO is the on-page side. Optimizing your pages and products can be done and left to reap the rewards for months to come. It’s a good idea to audit it on a regular basis, perhaps every quarter, but it’s initially set-and-forget. The result? More organic traffic driving evergreen shoppers to your website. One of the first steps for optimizing your store is using Google’s Pagespeed Insights tool. This will uncover issues that you probably don’t even know you have. Because pagespeed is a ranking factor in Google’s algorithm, it will help you boost your rankings and creates a good base to work from. Type in your URL and click “Analyze.” This will scan the website to find common issues that will not only improve the overall user experience, but also how Google ranks your site. Common issues include: Uncompressed and unoptimized images or files Too much Javascript or CSS No caching to speed up browsers No HTTPS Some of these are simple fixes, such as installing an SSL certificate or a caching plugin. Others will require deeper technical skills, but you should be able to solve most issues and get a nice performance boost – improving your SEO at the same time. But we’re not done yet. Next, you need to perform keyword research. These keywords will be placed in precise areas to get put in front of evergreen shoppers in the search engines. To begin, sign up for a Google Ads account and navigate to the keyword planner tool. You’ll want to search for the following types of keywords: Top-level: A description of your store. This might be “mens tennis clothing store” or “womens gold jewelry store” for example. Product names: The title of products you sell, such as “mens brown suede dress shoes” or “12′ HP laptop.” Product categories: Phrases that describe the overarching categories, like “mens dress shoes: or “glass tables.: Pay attention to the monthly search volume. It’s good to have a mix of low, medium, and high volumes to get a variety. A top-level keyword should be placed in the title tag of your website and on your about page. This helps Google understand what your store is about, ranking for that keyword; when evergreen shoppers are looking for that exact kind of store, you’ll be one of the first they see. You can see the title tag of any website by hovering over its tab in a browser. You’ll also want to rank for individual products and categories, though. Just like on your homepage, include keywords for these elements in the title tags as well. You also want to place keywords in the URL and meta descriptions. Note that when you enter a phrase into Google, it will bold in the description. This is proven to increase click-through rates, and is a quick win every ecommerce store owner can take. Holiday Shopper #2: The Early Bird Some people like to get their holiday shopping out of the way early in the season. That’s why we call them the early bird. They’re all about getting a lot of shopping done at once, and getting it done ASAP. Keep this in mind because it will play heavily in how you can increase your conversion rate while targeting them. Speed Up Your Sales Funnel Imagine the sales funnel of your store like a roller coaster. How fast can users sit down, buckle in, and enjoy the ride? Some will be waiting for hours, and we all know how dreadful waiting in line feels. You want the sales funnel to shoot users through fast, like a cannon, instead. The three main parts of every funnel include: The product page The cart page The checkout page All of these can be tweaked in small ways to increase conversion rates, funneling users through quicker and more easily. One of the primary ways to create a great user experience is to make the user not think. The process should be so simple that they can just do it without questioning anything or getting stumped. Optimizing the Product Page If your product pages aren’t exciting, nobody is going to add the items to their cart. The first thing you should do is ensure that you have great images. High-resolution photos from several angles will give the customer a better idea of exactly how an item will appear in person. Having a zoom function is also useful. Always include dimensions, as photos are sometimes deceiving. Next, clean up your copy. So many ecommerce store owners make the mistake of writing bland product descriptions. They need to be exciting, fun, and speak to the customer’s needs. With that being said, always focus on benefits over features. Remember that features are factual pieces of information: think size, color, or material. Benefits highlight the emotional connections and deeper reasons why a customer wants to purchase a product. For example, you want them to feel that they’re not just buying a t-shirt, they’re buying increased confidence, better style, and higher self-esteem. You can mix that into your copy by saying “A modern style that will improve any outfit and boost your confidence.” That’s much better than just stating boring facts. Lastly, make adding to a cart easy as 1, 2, 3. The cart button should be in plain sight and a color that’s proven to work for your industry. For example, black tends to work for fashion brands while red is the most popular in general. Optimizing the Cart Page After the early bird has added products to their cart, they head over to the cart page. You’ll want to add some tweaks to ensure that they don’t bounce before making it to the final stage – the checkout. The first way to do that is with a clear and detailed product summary. Customers should know exactly what they are buying, how much it will cost, and what quantity they chose. It’s also wise to allow them to change quantities and sizes, like ASOS offers below. This saves them from having to manually remove items or add more from the previous page. Also, note that the subtotal and shipping information is displayed and selectable before checkout is reached. This makes the purchasing process simpler, helping to increase the number of users converting to paying customers. Next, ensure that the call to action is bright and stands out. Continuing with the ASOS example, the green button jumps from the screen and grabs your attention. It should proceed in a logical sequence and, in this case, is placed after the subtotal and delivery options. Optimizing the Checkout Page The average cart abandonment rate is 69%. That’s nearly three out of every four potential customers leaving before they’ve finished purchasing. Most abandonment happens at the final stage – the checkout page – so it’s crucial you make it watertight. To optimize your checkout page, begin by making the form short and sweet. Remove any unnecessary fields that add time to the overall process. Asking for too much information may also deter some early birds that value their privacy. The order summary should also be clear and concise, with shipping and taxes neatly displayed. Just like on the cart page, adding the option to remove line items can be very useful. Display which payment methods you offer so customers know their options ahead of time, too. Holiday Shopper #3: The Deal Seeker We all know one – that person who’s always on the lookout for coupons and the latest deals. I mean, who doesn’t want to save money? It makes sense. Discount codes are used by 93% of customers throughout the year. It’s such a common practice in ecommerce that many users expect it. Here’s how you can better target these deal-seeking consumers during the holidays. Clearly Advertise Discounts and Sales Targeting these users should consist of promoting discounts and coupons, and making your holiday specials very noticeable. Top bars and popups are going to be your best friend. These allow you to place the deal they are looking for right in front of their eyes upon landing on your website. Look how Wayfair pulled this off for one of their 70% off holiday specials: The large banner is impossible to miss, and it features a call to action for users to jump right in to shopping. Ensure Your Store is Mobile-Friendly People aren’t just scrolling through Instagram on their phones all day – they’re also shopping, browsing products, and researching future purchases. It’s way more convenient to shop from a phone on the go than to sit at a computer for hours. This is why you need to ensure that your online store is responsive for mobile devices. Otherwise, you’ll suffer from a high bounce rate. The average bounce rate for mobile devices during shopping is 48%. That means almost half the users that come to your store from a smartphone will probably leave without visiting another page. You can expect this number to be a lot higher if you don’t have a responsive store – and that means losing out on sales. To test whether your website is mobile friendly, use Google’s free Mobile-Friendly Test tool. Plug in your URL and hit the “Run Test” button. This will display a preview of your website on a mobile device along with a rating of its performance. Be sure to fix any issues you experience with loading your store on mobile. Even if your site looks crisp on a desktop or tablet, it might be unusable on a phone. Google and market research company Ipsos found that most deal seekers are shopping from their phones these days. Display Customer Reviews A total of 91% of users read online reviews on a regular basis. They provide insight if the product is high quality, will satisfy their needs, and solve a problem they are facing. Think about the last time you shopped online. Did you check out the reviews to get insight from previous customers? You most likely did, and your deal-seeking customers are no different. They are likely to look at product reviews, meaning you need to have them on display. If there’s one website we can all look to for ecommerce inspiration, it’s Amazon. Few companies pull off reviews as well as they do. Note how they display total reviews, a breakdown of ratings, customer images, and the reviews themselves. Testimonials help build trust and are one of the best ways to increase conversion rates with all shoppers, but especially with deal seekers. Holiday Shopper #4: The Last-Minute Shopper Have you ever done last-minute Christmas shopping? It’s okay – most of us have! If you’ve been there yourself, you know that feeling of urgency. As a marketer, you can use this to your advantage. Create a Sense of Urgency There’s a psychological phenomenon known as fear of missing out, or FOMO for short. It’s very literal. It means taking action because you’re afraid of missing out on a good deal or opportunity. See where we’re going with this? You can increase conversion rates when targeting last minute shoppers by adding more urgency into your copywriting. Look how Joe Fresh makes customers feel like they need to take action so they don’t miss out on a 40% sale. To achieve this same effect, use calls to action like these in your promotions: “Don’t miss out!” “Limited time only” “7 days left” Use Low Stock Warnings Another effective way to to increase conversion rates by promoting urgency is through stock warnings. Display a message when the inventory for certain products is low. Customers will feel that if they don’t purchase an item soon, they might miss out. House of Fraser, a fashion ecommerce company, uses this tactic of displaying the amount of stock left for products and enticing users to purchase them sooner. Last-minute shoppers are already crunching time. By implementing urgency, you’re going to tip the scale and convert them to a customer. Wrapping Up The holidays can be the most profitable time for your ecommerce store. But you have to do your marketing correctly. Too many entrepreneurs miss out on generating more sales because they market to different demographics with the same methods. By targeting the four types of shoppers we’ve explored in this article – evergreens, early birds, deal seekers, and last-minute shoppers – in a more direct manner, you can ensure that sales don’t slip through your grasp this holiday season. So, what are you waiting for? Use what you’ve learned here to develop a marketing plan to lock in your success during the holidays.
Now is as good a time as any to stock up on WordPress deals to set your site up for success in time for the holiday rush. We’ve weeded through the slew of deals to present a handful of the good ones here. Deals on themes, plugins, managed WordPress hosting and much more, just in time to assist your team with the holiday rush. For Building Pages and Themes Themify Trusted by over 74,000 customers, Themify provides beautiful, responsive themes for every size business in any type of industry. They also offer a slew of plugins to boost your website including a form field builder, ecommerce functionalities, conditional menus, and much more. The Themify suite will help any business’ website stand out, no matter the expertise of the web management team. Cyber Monday Deal: Themify is offering 40% off all theme purchases. They are also discounting their library of plugins, BBuilderAddons, and even their memberships. Beaver Builder Praised as one of the best page builder platforms, Beaver Builder is a WordPress page builder for even the most novice users. With over half a million users using the service, Beaver Builder is used to build beautiful, professional pages that are easy to create with simple drag and drop functionality. In addition to page building, the plugin provides powerful, flexible themes, fit for any industry. Cyber Monday Deal: Beaver Builder will be offered at 25% off Want some WordPress theme inspiration? Check out our post on WordPress Themes to Gawk At. For WordPress Hosting NorthStack True serverless WordPress hosting is here with our newly released NorthStack product. We deconstructed the traditional hosting plan to free customers from worrying about plan limits or servers. All hosting resources, in addition to Aurora Serverless by AWS, can be thought of as streams in which your site simply plugs into and you only pay for what you use. Cyber Monday Deal: Join the Beta for NorthStack and get a $50 usage credit. Here’s the direct link to join the Beta For Creating Sliders and Elements Soliloquy One of the best responsive WordPress Slider Plugins, Soliloquy helps you create beautiful sliders simply. With a drag and drop builder, responsive designs, and slider templates, Soliloquy helps bring your strongest website visuals to life. Soliloquy allows offers dynamic sliders, full screen lightboxes, and a commerce product slider. Cyber Monday Deal: The plugin is being offered at 30% off PrestaShop A product by MotoPress, the PrestaShop plugin allows you to transform your product features into a hip slideshow that will turn a casual window shopper into a buying customer. The easy backend management offers a wide range of customization options including categorization options, calls to action, slider duplication for various pages, and much more. The sliders come responsive and mobile ready out of the box and include features such as animated layers, animation effects, and full screen capabilities. Cyber Monday Deal: 50% off of any plugin, theme or membership plan. Envira Gallery Display your photos beautifully with one of the best WordPress gallery plugins. The Envira Gallery is an easy to build gallery with a slew of features including a drag and drop builder, pre-built gallery templates, and supersize lightbox images. It also has the capability and flexibility for multiple addons such as videos, slideshows, pagination, and much more. The Envira Gallery is built for even the most novice WordPress editors to get their images displayed beautifully in their website. Cyber Monday Deal: All Envira Gallery plans will be offered at 30% off For Sales LifterLMS Everything you need to create, sell, and protect engaging online courses. LifterLMS is a powerful LMS plugin for WordPress that helps you increase course engagement, sales and learner results. You can also offer memberships to students and lock your content so only the right people are seeing it at any given time. Cyber Monday Deal: 15% discount for the LifterLMS plugin For Capturing Leads WPForms For the most novice WordPress users hoping to capture leads, WPForms is a great solution. With several form templates, a drag and drop form builder, and mobile responsive settings, WPForms can help a business of any size in any industry turn website visitors into leads and eventual customers. WPForms settings including smart conditional logic, instant notifications to respond to leads quickly, and a dynamic entry management interface to streamline your workflow. Make sure to keep up with email marketing trends to ensure your capitalizing on your leads. Cyber Monday Deal: WPForms will be offered at 60% off WP-CRM System WP-CRM System is an innovative plugin that allows you to add a CRM system to your WordPress website. The robust system allows you to easily manage your contact information, ongoing campaigns, and even invoicing all in one place. The WP-CRM System allows you to keep all of your information on your website – not a third party app – allowing for ease of use and the ability for you to own all of your data for the lifetime of your website. With the ability to integrate with a wide range of apps and extensions, WP-CRM System is a great solution for a small business wetting their toes with customer relationship management. Cyber Monday Deal: WP-CRM will be offered at 50% off For many businesses, this time of year can be a hectic one and we can use all the help we can get. Take a good look at your website and marketing efforts and figure out what it needs to assist you in achieving your year-end goals. Take advantage of the Cyber Monday deals and make the last quarter of 2017 the best one yet. Cyber Monday might only be one day, but the rest of the year is really fair game for maximizing your sales efforts before 2019. Here are our tips to increase your impact on sales this season.
It’s well known that analytics tell a story about what happened to your website. For example, your monthly Google Analytics report says you had X amount of visitors last month and some number of them returned to the site regularly. You also know things like popular referral sources for traffic and a variety of demographic & usage information about those people, like device, location, time spent on site, etc. In short, you use this data to learn more about who visits your site and what they do when they’re there. Then you apply it to future actions to deliver personalized content and drive better outcomes for your website. But what if you could use your data to look into the future? https://pagely.com/wp-content/uploads/2018/11/lumen5-video-2.mp4 Predictive analytics is a process by which you study the ebb and flow of traffic on a website. This allows you to get a sense of the natural rhythm of traffic, as well as identify events that have triggered unexpected traffic surges. As a result, you can be more productive in preparing your website for surges rather than throwing away exponentially more time reacting to disasters when a site becomes painfully slow or stops altogether. Let’s explore why traffic surges are such a big deal and how to use your data to avoid them. Why Traffic Spikes Happen It’s interesting how traffic surges in restaurants are similar to those that happen online. The Quiet Deceives The lunch rush comes and goes and the staff handles it capably because they know what to expect. The manager of the restaurant looks at the number of staff working and says, “Hey, I’m going to send a bunch of you home since the middle of the day is always dead.” So a skeleton crew remains to staff the kitchen and the floor. Your Website While your web hosting would never cut back the amount of storage or bandwidth you have access to, even in slower periods, there are limits set on hosting accounts for a reason. If a traffic surge hits your site and exceeds bandwidth limits, your hosting company might not call on additional resources to help out. Your site could just slow down or go offline (but you should know that if you host your site with Pagely, we don’t let bad things happen to business critical sites and we’ll always contact you during a traffic surge). The Unexpected Traffic Surge Arrives Sometime around 2 or 3 p.m., a small party shows up to the restaurant. The staff perks up, excited for something to keep them busy during an otherwise boring afternoon. But what they don’t know is that the party has come from a local event that just let out. The event isn’t big enough to show up on the manager’s radar (like a Thanksgiving parade or school graduation), so he or she didn’t think to leave extra staff coverage in place. Your Website Traffic surges (and the resulting downtime, in some cases) occur on websites for a number of reasons: Events like the holiday shopping season drive traffic to unprecedented levels. Content goes viral and people can’t help visiting the source. A well-known influencer or brand mentions a website and its followers want to become your followers. Your offering suddenly becomes the go-to solution to fill a timely need (like privacy policy plugins around the time GDPR was implemented). There’s an imbalance between the number of marketing campaigns pushed out for your brand and the resources behind your site to handle the ensuing traffic. Malicious bots have targeted your site and are trying to break through with repeated attacks. Some of these events can be predicted. Others cannot. Regardless, if you don’t make the effort to predict when these high volumes of traffic are set to hit your site, you can pretty much expect stress and panic to dominate the management of your website. It Hits the Fan As more and more couples, families, and large parties trickle into the restaurant, the staff begins to panic. The host gets too busy seating guests to deal with the line of people waiting at the door. The remaining servers and bartender aren’t prepared to handle all of the new guests – at least not in a timely fashion. And the kitchen just doesn’t have the inventory on hand to deal with the unexpected diners. The customers just have to sit there amid all this chaos, wondering why they haven’t been greeted, why their food was undercooked, and why the service is just plain terrible. Your Website Whatever the reason for it, a traffic surge that you’re unprepared to handle can seriously harm your site. For starters, your site will generally face one of two direct consequences: It will slow to a crawl, testing visitors’ patience far beyond a reasonable limit. It will go offline, causing visitors to look for another website that can fill their need. The failing performance of your site – even for a short period of time – can have long-standing consequences on your business. Cleaning Up While Counting the Losses Keeping with the restaurant analogy, traffic surges were often seen by management as a good thing. “Hey, it’s better that we’re busy than completely dead, right?” The problem with that thinking is that it’s not a simple matter of counting the number of people that came into the restaurant and patting yourself on the back because of the boost in business. A customer’s sour experience can translate into sales that won’t be made. If orders were messed up, customers were likely given a discount on their meal. If the host, bartender, or server was slow to take care of the customer, then the tip left was probably measly (if one was left at all). If the server seemed unenthusiastic and stressed out because of the overwhelming traffic pouring in, the customers probably sensed it. And the servers’ lack of enthusiasm was reflected in the customers’ lack of enthusiasm to order as much food as they had intended on. Even if the restaurant raised its bottom line with the unexpected surge, think about what happens once those customers leave the restaurant and tell their friends, family, and colleagues about what a poor experience they had. That’s why it’s always a good idea to look at the bigger picture. Your Website There’s a lot of work involved in restoring a website after a traffic surge has taken it down. You have to call your developer or host to amp up the bandwidth and/or get your website back online (which also means paying more than you would have otherwise). Also, think about the opportunities missed when inventory goes out of stock or if there is too great a demand for your sales team’s attention and time. Traffic surges will burn through your company’s resources, which can leave those late to the party feeling disappointed that your brand was unable to keep up with the excessive interest. Then, there’s the reputation cleanup to factor in. Visitors who had the unfortunate experience of trying to go to your website during one of these unplanned surges may be completely turned off by the experience, not wanting to attempt another return to the site. And what about those first-time visitors? They heard all this buzz about your website from someone they trusted and then your website wasn’t even online. With no previous relationship or communication channels established, you have no way to reach out and say, “Sorry. We experienced an unexpected server outage, but here’s 45% off your next purchase.” What to Do with Predictive Analytics to Prevent Traffic Spikes Of course, all this may seem hopeless. After all, unexpected traffic surges are unexpected. What can predictive analytics possibly do to help? With predictive analytics, you’ll begin to look at your data differently. Here is the approach I suggest taking: 1. Pull a Couple Years’ Worth of Data If your business has been around for more than two years, you can use Google Analytics to pull the last couple of years’ worth of traffic data for your WordPress site. You can find this data under Audience and Overview. Set the time frame to compare two consecutive years. The resulting chart will show you where the traffic surges occurred. For some businesses, you will have a consistent ebb and flow of traffic from year to year. For others, it might not be as predictable. That said, you still need to have access to this data so you can dig into specific surges and find out what caused them. If your site has been live for less than two years, don’t sweat it. You can use a tool called Similar Web to borrow traffic surge insights from your competition. Gather up a list of four or five competitors and stack their websites against your own in a Yearly Competitive Analysis. In this example, you can see that many of the leading restaurant chains have the same peaks and valleys in their data. If you can pinpoint major surges for the entire industry (or your geographic region), you can predict your own surges more effectively. 2. Identify a Baseline for Traffic Using your data from Google Analytics – all you need is a full year of business for this one – establish a baseline for daily traffic. How many visitors does your website see, on average, every day? To find out how many people visit your site daily, take your total number of users for the year and divide that number by 365. This is an important data point to have, so that you can 1) narrow your focus to significant traffic surges in the data, and 2) monitor traffic growth, in general, since that can affect server performance too. 3. Plan for Predictable Traffic Spikes Now that you have a bird’s eye view of what happened over the last couple of years, and you know what is the norm for your site, we can start using predictive analytics. First, you want to identify predictable traffic spikes. These are ones that tend to occur at the same time. This may mean they happen during the same timeframe each year – like e-commerce sites probably experience around Black Friday with holiday shoppers. Or they could be surges that occur at the same time of day – like a sports blog might experience on Sunday afternoons during football season. Before you do anything else, make a plan for these kinds of traffic surges: Verify that your web server can handle the additional load at those times. Prepare and monitor your inventory accordingly. Assign additional team members to manage the site during those times. If you know the surge is coming, don’t leave it up to chance or settle for so-so server performance just because the cost of more bandwidth or resources seems too expensive. The number of visitors whose business you’ll capture by having a site that stays online and runs well will more than make up for the extra costs. 4. Use Your Marketing to Even Out Traffic Try to control the conversation surrounding your website with marketing. While this won’t come in handy for unpredictable surges, you most certainly can use your marketing channels to gain better control of your traffic. It works like this: You know that shoppers come to your website to buy Mother’s Day gifts. The first problem is the traffic surge that almost always slows down page loading speeds to about 15 seconds. You’re sure you’ve lost business because of it. The second is that some customers buy their gifts too late and then end up returning them because they didn’t want to show up at Mom’s house empty-handed so picked something else up in person. That costs you too, since you’ve been kind enough to offer free returns. Because your predictive analytics tells you this is what happens, why not direct visitors to shop earlier? Write a blog post a month before the event to remind visitors to get their shopping done. Get featured on a guest blog, podcast, or other high-traffic source to get more people thinking about this in a timely fashion. Share steady reminders on social media and keep the subject top-of-mind with customers. Launch a pop-up or email promotion, but set the discount to expire a week before the event. That way, visitors are compelled to get their shopping done in a reasonable time frame. The way you handle this will change based on what sort of event you’re trying to avoid, but just know that there are a variety of ways to redirect visitors with your marketing efforts. If all else fails, or you’re nervous that people just won’t listen, then at least make sure you have remarketing configured for your website. This way, you can capitalize on all that extra traffic on your performance-optimized website. With all those additional eyes on your pages, this means more potential revenue when you lure them back to your site later. 5. Figure Out Why Unpredictable Traffic Surges Occurred Next, take some time to look at the unpredictable traffic surges that occurred over the last couple of years. Can you correlate those dates with an event or other significant change that would’ve drawn in extra visitors? See if you can identify patterns here. If your website is repeatedly hit by bots, then your security plan likely needs a revamp. If the competition runs an annual or semi-annual sale but is failing to satisfy demand, your site could be receiving the overflow and needs to do a better job preparing for it. If the reasons for the surge are unclear at first, look to your data. Look at the sources of the traffic and look at the kinds of people driven there during these times. And if it’s not in the data, check the news. You may be surprised at what sort of connection you are able to make. 6. Prepare for Unpredictable Traffic Surges and Prevent Downtime Preparing for an unexpected traffic surge is about bolstering your site’s performance and security now so that it won’t matter how much your traffic levels fluctuate. Here are some of the ways to do that: Upgrade to Managed WordPress Hosting with a trusted provider. If you can afford it and it makes sense for your business model, switch to VPS hosting. Use a CDN like PressCDN to keep loading times fast. Install a caching plugin to optimize your server performance. Install an image optimization plugin to keep images sized appropriately. Install a security plugin to block those nasty DDoS attacks. Institute automated monitoring for performance, uptime, and security. Use a real-time inventory monitoring tool so you have a way to keep an eye on your stock. Have a team on standby to step in and provide support through ticketing and live chat during unexpected surges. Conduct quarterly stress testing of your website. Schedule a reasonable number of marketing campaigns for your website. Monitor all of your marketing efforts closely: social media, email, PPC, and so on. Set up Google Alerts to track news related to your website, brand, industry, competition, related legislation, and anything else that might cause traffic to soar. The key takeaway here: don’t be like that restaurant manager who assumed traffic levels would remain at a normal pitch on a midday afternoon. Always have a preparedness plan in place and ready to protect your website. Predictive Analytics: Keeping Traffic Surges in Check You want to predict traffic volumes on your website rather than having to react after the fact to traffic surges that have caused harm. If you can do that, you can reduce the time you spend cleaning up your site and repairing your reputation and, instead, focus on conversion-boosting initiatives.
Businesses and enterprises have a lot of data to contend with. From acquisition and retention metrics to prospective customers, internal business processes, partners, affiliates, and competitor data, knowing what data matters most to your business can be difficult. Often, businesses can’t -or simply neglect to -leverage their data effectively into actionable wins that can grow revenue and help them operate more efficiently. That’s where business intelligence (BI) tools can really help. They pull your data from dozens of sources, clean it up, transform it, and display it visually via dashboards and reports, which are far easier to interpret than raw numbers and fields. BI also makes it easier to track the ins and outs of what’s actually happening in your company. While BI tools have been around for decades, there’s been an explosion of excellent online tools entering the market in recent years. These tools are constantly evolving to meet the ever-expanding and fast-changing needs of businesses of all sizes and niches. But choosing a BI tool for the first time can be overwhelming -there are currently more than 100 vendors available. Below, we’ve collected some of the highest-rated and most often recommended business intelligence tools for companies of all shapes and sizes, with options for both well-established enterprises and businesses that are just getting started. Choosing the Right Business Intelligence Tool Working out which tool is going to be right for your business comes down to a few key considerations: 1. Data Sources and Integrations You need to ensure that the BI tool you go with can read all of your data sources and has all the integrations you need, particularly for popular sources like Salesforce, Quickbooks, Google Analytics, and your customer database(s). Because if it doesn’t, you won’t get the specific information you need. 2. Data Cleanup Inevitably, data will be dirty when you first collect it. There’ll be missing fields, or fields that contain inconsistencies. There’ll probably also be spelling errors and values that don’t make sense. Cleaning up data can be a hugely time-consuming process. So keep this in mind when looking -you want a solution that can do the cleanup for you, and do it with some level of automation. 3. Data Analysis Obviously, you’ll want to be able to easily read and analyze your data. But beyond that, you’ll want to have the ability to analyze historical trends and really dig in to your data to understand different aspects of your business, and build models to test new ideas. Some businesses might even want the ability to predict future performance based on statistical models and, potentially, machine learning models. 4. Flexible Dashboards, Charts, and Reports Through the use of data visualizations, dashboards simplify complex data sets to provide users with at-a-glance awareness of current performance. BI tools differ hugely in the flexibility and design of the dashboards they provide, along with the numbers of chart types they offer and the reports they can generate. You’ll want dashboards that you can tailor not just for an executive overview of what’s happening with your business, but for different parts of your organization, from marketing and sales to support and finance. 5. Ease of Use You don’t want a BI that’s overly complicated to use and requires expertise in statistical analysis. So before you commit to a particular tool, try out a bunch. Take note of the user experience -what you like and don’t like. Involve people in your business with different skill sets, who would potentially be using the tool, and ask for their feedback. 6. Collaboration Data is most powerful when your whole company can rally around metrics that matter, but thats hard to achieve when only a handful of people have access to those metrics. So be sure to investigate whether you can share with other users, and how many, and whether there are options for different user roles. Your decisions around collaboration will ultimately impact cost. 7. Cost Many BI software companies don’t list their prices on their websites; they tell you to get in touch for a quote. There’s a legitimate reason for this, given that BI tools are often not a one-size-fits-all solution and need to be customized to be useful. But this lack of clarity is still frustrating. BIME, for example, has a $490-per-month base plan for two users, and adds $90 per month for each additional user. Meanwhile, Grow charges by the number of metrics you want to use and track, rather than by the number of users. 9 Business Intelligence Tools 1. Grow Price: Determined according to business need, pricing quotes are available upon request. While researching for our own BI tools at Pagely, we were quoted $500 per month. Best for: Mid- to large-sized companies and enterprise businesses that want a better way to visualize their data and need help with setup. With more than 150+ integrations, including everything from Asana to Dropbox, Facebook, Google Analytics and, of course, HubSpot, Grow stands out with support for lots of data sources and lots of chart types (300+ pre-built reports, in fact). Grow promises to implement 8x faster than competitors so you can hit the ground running, which I’d say is a fairly accurate assessment. The analytics are fully customizable and offer real-time updates, letting you mash up and compare your data from lots of different sources on one easy to monitor dashboard. Another plus is that you don’t need to be a data expert to use it. Grow takes care of all the data cleanup, pivoting, grouping, filtering, and applying formulas and functions, so you can track what’s most meaningful to your business. Grow is a fantastic and capable BI system, and I know because it’s what we originally decided to use at Pagely. In part, Grow was so attractive to me as a marketer because most of the other BI tools we investigated had overly complex setups. Grow walked us through the setup process, creating many of the initial reports for us. 2. Domo Price: The Standard plan is $83 per user per month. The Professional plan runs $160 per user per month. The Enterprise plan is $190 per user per month. Free trials are available. Best for: Domo is a heavy-duty product for companies serious about data. Domo brings together a huge assortment of data connectors, i.e. integrations. There are 450+, in fact, including Salesforce, AWS, Asana, GitHub and Google Analytics -pretty much anything you can think of. Domo says its customers connect to thousands more custom data sources. Domo also provides a unified data store, a huge selection of visualizations, integrated social media, and comprehensive reporting. Domo’s self-service ETL (Extract, Transform, and Load) toolkit, Magic, provides dynamic data transformation capabilities for users of all skill levels. There’s also Buzz, a collaboration tool for assigning and coordinating work around data in your organization. Another nice touch is the Domo app store, which provides apps for even more visualizations. Here’s what the Domo marketing dashboard looks like: 3. BIME Price: The Base plan is $490 per month and includes 45+ connectors. The Big Data plan is $690 per month and includes the features of the Base plan plus access to SQL DB connectors like Amazon Redshift, Google BigQuery, MongoDB, and more. Two user licenses are included with each plan. Each additional user is $90 per month, and each additional viewer is $9 per month. Best for: Small, medium and large companies. BIME is widely adaptable. With 65+ data connectors, BIME’s BI tool offers the ability to track all kinds of data (flat files, CRM, web apps, and databases), transform your data into meaningful metrics and attributes, and presents analytics beautifully with 25+ data visualization tools. Customizable dashboards let you add images and choose from 100+ icons, allowing you to present data tables as charts that are impactful and interactive. A useful Salesforce and BIME integration for support teams lets you track the entire user journey from prospect to customer to churn. There are also out-of-the-box tools, such as a forecasting feature that can predict future values based on your current data set. 4. ChartMogul Price: ChartMogul is free for small companies and costs $125 per 1,000 customers per month once you generate more than $10,000 in monthly recurring revenue. Best for: Subscription-based SaaS companies. Unlike the other options on this list, ChartMogul has been built specifically for SaaS companies that run on subscriptions. With this tool, you can keep an eye on your monthly recurring revenue, watch your net cash flow, calculate the average revenue per customers, and generate cohort analytics to look at churn over time. Here’s what ChartMogul looks like: You can connect ChartMogul with Stripe, PayPal, and many other payment services. It can also automatically retrieve all your payment data and process it, as well as manually import CSV files. ChartMogul also lets you associate names and orders with payment IDs. This allows you to enrich your data through integrations with Intercom or MailChimp, for example, and know who is paying for what. It’s also possible to segment customers and target them with customized emails to woo back those who churn. 5. Looker Price: Determined according to business need, pricing quotes are available upon request. We were quoted $3,000 per month. Best for: Small, medium, and large business analyst teams that want powerful access to their data. Looker is an incredibly compelling BI option for one single reason: its data modeling layer, LookML. The language operates like a simplified version of SQL, which is reusable and modular, and in turn, way easier for first-time users to learn. This fundamental innovation provides tools for building sophisticated analytics, which can then be pulled into easy-to-build reports. This powerful combination is what BI tools strive to provide, and Looker does it better than anyone else. Here’s Looker: Compared to other BI tools, Looker lacks customization and visualization features, providing only fairly basic graphing and data manipulation features. However, it makes up for these drawbacks with its powerful data integrations (like Redshift and Aurora), intuitiveness for business users, and excellent support. 6. Tableau Price: Tableau Desktop Personal Edition is $35 per user per month and connects to files like Excel and Google Sheets. The Professional Edition is $70 per user per month and includes integrations with web applications and more. Best for: Small, medium, and large businesses that want intuitive data visualization and analytics. Tableau is a pioneer of drag-and-drop analytics -it was among the first BI systems to offer intuitive dashboards where users could manipulate data via drag-and-drop. With its customizable dashboards, Tableau lets users easily create, publish, and share dashboards without touching code. It can also connect to dozens of data sources, including Amazon Aurora and Redshift, Google Analytics, and Azure. There are three different Tableau products: Tableau Desktop, Tableau Server and Tableau Online. Tableau Desktop is the primary product and data visualization tool. Tableau Server comes with all the features of Tableau Desktop and adds networking capabilities, while Tableau Online is a hosted version of Tableau Server. Here’s what the Tableau Desktop dashboard looks like: 7. Slemma Price: The Basic plan is $29 per month) for three users, the Small Business plan is $99 per month for 10 users, the Standard plan is $199 per month for 30 users, and the Client Reporting plan is $599 per month for 80 users. A free trial is available. Best for: Small to medium-sized businesses that want a solution that is relatively easy to use and implement. Slemma is a powerful reporting and BI tool that lets you easily create dynamic dashboards from multiple data sets. It connects to 75+ services and tools (including Amazon Redshift, Google Analytics, Intercom, Azure SQL, Oracle and more). There’s also a step-by-step chart designer that makes report generation quick and painless with pre-built templates, allowing you to visualize your third-party data in minutes. With Slemma, you can analyze, collaborate, and securely distribute dashboard insights internally or with clients. A dashboard library lets you hit the ground running, with dashboards for popular tools like Hubspot, Salesforce, and Google Analytics. While Slemma lacks the data power of some of the bigger BI players, it makes up for it with ease of use and report creation. Like all these tools, you can also access Slemma on mobile devices. 8. Chartio Price: Determined according to business size, pricing quotes are available upon request. Free trials are available. Best for: Small, medium, and large businesses. Chartio scales with your company. Chartio provides cloud-based data exploration designed to be usable by anyone, so that business users don’t have to rely on analysts for answers. But if you are an analyst, there are powerful features available with SQL and interactive query modes. For business teams, Chartio enables you to create self-service interactive dashboards for marketing, sales, and support teams that pull data from every function of your company. There are out-of-the-box connections to your data sources from Amazon Redshift to CSV files, so you can start exploring data immediately. There’s also a chart builder that lets you easily query data using a drag-and-drop query generator or a SQL query editor. The provided charts are very well designed, flexible, and smart, so they fit the data being fed to them. Here’s what Chartio’s dashboard looks like: 9. Sisense Price: Determined according to business needs, pricing quotes are available upon request. Free trials are available. Best for: Small, medium, and large organizations. Sisense is ideal for data-crunching beginners, but also provides powerful features for companies at scale. Sisense is the only BI system I’ve come across that offers a test-drive for prospective clients – a 90-minute trial using your own real data. The best way to take advantage of this is with an actual business case, which they will solve during the demo. It’s safe to say Sisense is customer-focused. Not only is their customer support top-notch, the platform is built with non-technical users in mind. So the vast majority of what you’ll want to do can be achieved via a simple drag-and-drop interface. That’s not to say power users are neglected – SQL and advanced functionality are also available. Here’s an example of what a help desk ticket dashboard looks like: One of Sisense’s core features is its “in-chip” back-end technology, which maximizes the way existing resources, including RAM and CPU, are used on a user’s computer to allow your system to do more with less. According to Sisense, this allows the platform to work with 100 times more data at 10 times the speed. In practice, this makes it easy for data-newbies to join complex data from multiple sources, build interactive and business intelligence reports, and share it all in one click. What are your favorite business intelligence tools? Share with us in the comments
It’s critical that your website provides a solid foundation for running and scaling your business. Rather than hiring Devops engineers with WordPress experience to manage your site and infrastructure, you may consider using a Managed WordPress Hosting solution. Your company will save money and have a team of hosting experts ensuring your WordPress website remains available, secure, and fast. Read on to discover how Managed WordPress Hosting can help your company. TABLE OF CONTENTS What is Managed WordPress Hosting? The Advantages of Managed WordPress Hosting High Availability and Uptime Expert Technical Support A Modern High-Performing Hosting Stack Updates Data Retention and Recovery Mission-Critical Security Premium DNS Developer-Friendly Tools Scalability Global Reach Conclusion WHAT IS MANAGED WORDPRESS HOSTING? Managed WordPress Hosting is a specific type of web hosting solution that is tailor-made and optimized specifically for supporting WordPress sites and users. Managed WordPress hosting is like having a team of WordPress and hosting experts working on your website, removing the cost and burden of managing your site’s hosting in-house. Managed WordPress Hosting exists as a separate option from other types of hosting because WordPress websites have unique needs. They have different server resource footprints than other types of websites, have unique security concerns, and properly supporting them requires WordPress expertise. Managed WordPress Hosting solutions are typically defined by: Managed WordPress security Automatic WordPress theme, plugin, and core updates Managed server resources that compliment WordPress’s technical needs Experienced WordPress experts on staff to handle support It’s hosting designed from the ground up to serve WordPress. Let’s take a look at how Managed WordPress Hosting services compare to other hosting options, like shared hosting and VPS hosting, to see which offers the best WordPress hosting solution. WHAT IS SHARED HOSTING? Many small businesses are attracted to the affordable pricing of shared hosting, which can be as little as $3-20 a month. It’s important to understand what shared hosting offers and what it doesn’t. For a hosting company to be profitable at those prices they depend on volume and corners must be cut. A shared host charging $5 a month simply cannot profitably offer quality support and adequate server resources to every customer. Instead, this business model relies on minimizing support interactions and upselling. When someone complains that their site has gone down or is running slow, these hosts generally recommend that the website owner move up to a more expensive hosting plan to fix the problem. Basically, these rock bottom prices are a way to get people onto their hosting solution with the goal of getting them onto more profitable plans as they outgrow their shared hosting service. They do not expect that a business would run an important, high-traffic website on a shared plan. Shared hosting is defined by: Low prices Minimal support Minimal server resources No WordPress expertise, solutions, or specialized support Popular shared hosting companies are GoDaddy, A2Hosting, and HostGator. However, that isn’t to say that shared hosting doesn’t ever make sense. If you have a hobby blog or a side business, shared hosting may be adequate. But, if you’re an established business that depends on your website being available, fast, and secure, shared hosting probably isn’t the best option. Shared hosting simply can’t offer the same quality of hosting service that more expensive options do. Here, the age-old maxim, “you get what you pay for,” applies. What is VPS HOSTING? VPS hosting, or Virtual Private Server hosting, is like shared hosting because your site shares a server with other sites. However, there are fewer sites on the same server compared to the shared hosting option. The server is also partitioned into different virtualized server environments. Unlike shared hosting, WordPress VPS Hosting usually provides baseline guaranteed resources eliminating the “noisy neighbors” problem. VPS hosting is a huge step up from shared hosting but has a major disadvantage for many people — managing a VPS requires technical skills most businesses don’t possess. If your VPS server goes down for whatever reason, you’ll need to know how to troubleshoot and fix it. VPS hosting is defined by: Fewer sites per server Virtualized containers give sites separate resources The need for technical skills to manage the VPS Popular VPS providers are Digital Ocean, Linode, and InMotion. MANAGED WORDPRESS HOSTING Managed WordPress Hosting is designed specifically to handle WordPress. It provides optimal technology and resources to support WordPress websites. Partnering with a managed WordPress hosting company takes care of all the technical aspects of hosting for you – including security, performance, and other factors. Managed WordPress Hosting is particularly well-suited to large and enterprise-level businesses due to its superior security, reliability, and high performance. Any company that relies on their WordPress site is going to want a host that specializes in that CMS. Managed WordPress Hosting prices vary, with plans ranging from $25 to $2,000 per month depending on the resources and level of support they offer. Businesses invest in this because they understand that the benefits of the service far outweigh its costs. These companies save time and money because they do not have to pay for dedicated engineers to manage their sites. Partnering with an experienced WordPress host also improves site performance, further bolstering the bottom line via key metrics like conversion rate, time on site, and more. THE ADVANTAGES OF MANAGED WORDPRESS HOSTING There are some fundamental benefits only managed WordPress hosts can deliver. 1. HIGH AVAILABILITY AND UPTIME Site availability and server uptime are crucial for any online business. If your company’s website generates revenue, downtime means lost revenue. Also, it can damage your brand’s reputation and negatively impact your site’s visibility to search engines (also known as Search Engine Optimization). Typically, web hosts guarantee at least 99% uptime. Unfortunately, this doesn’t mean you’ll actually get 99% uptime. High traffic to a WordPress website can put a lot of strain on server resources because of WordPress’s dynamic functionality. A host that is optimized for WordPress hosting can use intelligent caching and robust database solutions to ensure your site stays functional and responsive when you need it most. To ensure maximum uptime, here at Pagely we provide two different layers of uptime monitoring. If anything is detected that could potentially lead to downtime, the entire support team is notified. In the vast majority of cases, we identify issues and fix them before downtime can occur, so issues are corrected before customers are even aware of them. This proactive support is what separates great hosts from the rest. We also receive proactive notifications if you get close to your resource limits, and run tests after updates to check that all sites are still up. If a problem from a plugin update is found, we automatically rolls back the update. For enterprise websites that need maximum uptime, it might be best to choose a host that provides high-availability architecture that spreads the workload over two or more servers in different zones. This approach reduces the risk of an outage during maintenance events, unforeseen outages, or traffic spikes. 2. EXPERT SUPPORT A web hosting company that does not specialize in WordPress will have a more difficult time addressing WordPress-specific technical concerns. When you speak to customer support about an issue with your website, you want to talk to someone who has the WordPress expertise and experience to solve your problem immediately. Shared and VPS hosts may offer more affordable services than Managed WordPress Hosting, but when you run into an issue such as an attack on your WordPress site or uptime issues, it could take several days of emailing back and forth just to get your support request escalated to someone with the WordPress familiarity and expertise to address the issue. Meanwhile, you could be losing thousands of dollars in sales. Expert WordPress technical support starts with the people manning the support lines. Look for a host that employs a passionate and exceptionally skilled group of engineers who know how to apply technology to solve big problems. Typically, on the company’s About Us page, you can get a feel for the types of employees you’ll run into when you contact support. Inquire about things like level-one phone operators reading a script, some hosting companies direct you to unskilled operators as a cost-saving measure. It’s always best to speak immediately with bona fide engineers to help you manage your site and solve your problem the first time. 3. A MODERN HIGH-PERFORMANCE HOSTING STACK A reputable and experienced Managed WordPress Hosting company continually tests the latest hardware and software to find the optimum hosting environment specifically for WordPress. They use a modern hosting tech stack and fine-tune it to handle the unique demands of WordPress. Most modern hosts leverage a public cloud provider because cloud platforms, like Amazon Web Services and Google Cloud Platform, provide hosting infrastructure advantages over traditional options. At Pagely, our hosting stack is built on AWS. This allows our customers to leverage a nearly infinite amount of server resources and the vast ecosystem of cloud hosting services AWS has created. These resources and tools allow us to support and scale WordPress applications as needed and without constraint. With such a vast and flexible pool of server resources available, we can use everything from a pair of nodes to a cluster of 10+ machines to ensure hardware is never a limiting factor on your site’s growth and reliability. This allows your host to carry massive amounts of web traffic without sacrificing performance. In addition, with access to AWS customers can leverage 13 global data centers around the globe. What you’re looking for are the fastest, most flexible hosting environments leveraging intelligent caching/acceleration, security, and configuration flexibility. Along with technologies like PHP7, HTTP/2, and free SSL certificates, at Pagely we use proprietary NGINX/OpenResty HyperProxies. It delivers unmatched speed and Redis to further accelerate the WordPress experience. The following is the suite of other in-house services and a great example of the type of stack you should inquire about when shopping around with different hosts. If for nothing else, consider this a point to reference for comparison sake: PressDNS: Premium DNS powered with Amazon’s route 53 service that takes advantage of geo-balancing and geo-routing PressCACHE: A global WordPress acceleration system that works much like a CDN, but is specifically designed to cache and serve WordPress page output PressARMOR: Pagely’s security architecture, including a web application firewall, malware scanning, chroot user separation, and network edge rulesets PressTHUMB: On-demand image optimization and thumbnail creation PressFORMANCE: Performance monitoring analytics and assessments 4. AUTOMATIC UPDATES A Managed WordPress Hosting plan provides an easy way to update the core WordPress application and needed plugins. Keeping the software that powers your site up-to-date is critical for the security, performance, and compatibility of your site. A well-managed WordPress host may handle WordPress updates for you. But an expertly managed WordPress host will keep your software up-to-date and actively monitor how each updates impacts your site through automated tests that ensure your site is still running smoothly. In the event an issue is detected, the update can be automatically rolled back, restoring your site to functioning condition. 5. WORDPRESS SPECIFIC SECURITY Shared hosting packages typically don’t offer any assistance if your site falls victim to a cyber attack or if you encounter malware problems. Secure WordPress hosting is perhaps the biggest incentive for moving to Managed WordPress Hosting. When you partner with a managed WordPress host, routine software updates and a specialized hosting environment mean your site is better guarded against hackers, bots, and other security concerns. And you can expect regular security checks and malware removal. A good hosting reputation will prove outstanding security for its clients. If a host can boast that they’ve experienced a single serious security incident, you’re in good hands. A robust suite of security services is a comprehensive security architecture that hardens and protects a network, hardware, and WordPress applications with a focus on prevention and the mitigation of risk to clients. For base-level security, your host should use a dynamic web application firewall (WAF) that blocks code injection attacks, known exploits, and rate limits access attempts. This greatly reduces the success of a distributed denial of service attack or a brute force attack. They should also practice real-time system malware scanning of every WordPress installation, constantly looking for things like trojan horses, viruses, worms, keyloggers, spyware, and adware. In the event that security defenses fail, your host should have a daily backup of your site to restore from. These automatic backups become invaluable should your site become compromised. 6. PREMIUM DNS The Domain Name System (DNS) is, essentially, the phone book of the internet. When you enter a domain name like pagely.com into a web browser, the browser uses DNS to translate the domain name into an Internet Protocol (IP) address, which tells the browser where to get the desired webpage. When you’ve invested so much in your site, you don’t ever want your domain names to go offline. This is why investing in a premium DNS provider is a must. But typical shared or VPS hosting packages, and even most Managed WordPress hosts, don’t offer premium DNS. However, there are options where you’ll enjoy the benefits of a DNS system backed by Amazon’s Route53 service. This service answers DNS queries faster by using a global network of DNS servers and uses infrastructure redundancy to ensure availability. 7. DEVELOPER-FRIENDLY TOOLS If your team wants to be hands-on with your server environment, Managed WordPress Hosting provides developer-friendly tools that you’re unlikely to get with most shared hosting plans. You get tools like SSH, staging, GIT and WP-CLI, in addition to basics like SFTP, database access, and error/access logs. In addition, you receive support for customer PHP extensions including New Relic, system crontab access, and more. If it’s important to you, look for integration with the WordPress REST API. A Partner API would be useful for customers who want to integrate their host into their workflows to quickly spin up new sites under their hosting account. The ability to quickly clone your live site and test your changes is hugely beneficial so you can also push updates back to your production site using your own workflows. 8. SCALABILITY WordPress scalability, the ability to quickly handle and adapt to sudden traffic increases, is critical for any online enterprise. If a celebrity endorsement drives more customers to your site, the unexpected increase in pageviews will require more resources. WordPress is highly scalable as long as its hosting platform is configured to keep up with the increase in database requests caused by high traffic. As your business grows and your site gains more traction, you’ll require additional website resources to keep things running smoothly. You’ll also to need to be able to collect customer data efficiently. If you haven’t equipped your site to scale fluidly, it could crash. And any unexpected downtime could lead to lost sales and damage to your brand reputation. Choosing the right Managed WordPress Hosting plan can help safeguard your business against this kind of catastrophe. Strongly consider choosing a market leader in providing scalable solutions for WordPress. We recommend choosing a host who has built its hosting stack and solutions-oriented services specifically to address the complex scaling, security, and performance needs of the world’s biggest brands. 9. FAST PAGE LOADS AROUND THE WORLD Small businesses using shared or VPS hosting typically use caching plugins and Content Delivery Networks (CDNs) to optimize page speed. This provides faster loading times for international visitors. Managed WordPress Hosting can take care of all that for you. For example, PressCACHE technology is a global WordPress acceleration system. It works much like a CDN, but was designed specifically for WordPress page output. It handles the server-level caching of your site content to speed up the delivery of your pages. All you need to do is turn it on, then sit back and enjoy the speed. PressCACHE is also responsible for globally serving your content from one of Amazon’s data centers in the United States, Asia, and Europe. It routes the requests for your website to the global Point of Presence (PoPs) servers closest to the user. This shortens the distance between visitors and your website, speeding the load time of your site to a global audience. Related: Optimizing Your WordPress Site Managed WordPress Hosting Provider Options The following sites are near 100% WordPress focused, and offer varying levels of ‘managed’ service. Which is the best managed wordpress hosting for your needs? That really depends on the level of support you’re looking for and your budget. As you get more support and better infrastructure, the cost of your hosting will go up. MANAGED WORDPRESS HOSTING IS CRITICAL FOR HIGH-DEMAND WEBSITES To summarize, anyone responsible for managing a high-traffic WordPress site should seek out an experienced Managed WordPress Hosting Provider if they do not have WordPress experts on staff. WordPress has unique resource demands, security concerns, and support needs that only a host that specializes in WordPress can deliver. Interested in Managed WordPress Hosting? As the world’s first WordPress host and the only provider with a decade of experience, we’re pros. Get in touch to learn more about how Pagely can help your business. We offer in-depth sales consultation and free migration.
At Pagely, we strongly believe in higher education as a vehicle to improve and enrich individual lives, as well as our shared communities. To that end, we created the Pagely Scholarship earlier this year to reward the students that inspire us with their story and life goals. The 2018 Pagely Scholarship Recipients 1st – $1,500 Dominika Maria Wojtowicz is a Sophomore at DePaul University, majoring in Data Science with a minor in Public Relations and Advertising. In her essay, Dominika highlights the intriguing influx of new technology and the concerns that linger behind these powerful concepts. Specifically, data collection. From Siri and Alexa to algorithms being used by Instagram, our search behavior and even our conversations are being tracked by Big Data. While their goal may be to improve daily life and efficiency of search, there can be unintended consequences and, at the very least, the uneasy feeling one’s privacy could be invaded. Notably, with AI like Siri and Alexa which, if not disabled, monitor all conversations had in their presence. This is a concept that fascinates and intrigues her and will no doubt play a role in her studies. 2nd – $1,000 Joshua Alexander Foster is studying Electrical Engineering at Missouri State University. Joshua has a rare, incurable retinal disease known as Stargardt’s Disease that will eventually result in blindness. With little accommodation offered for Joshua, he has had to become his own advocate, investigating ways to thrive in school and circumvent obstacles. Joshua also has a one-year-old son who suffers from a hearing condition. While his infant son benefits from hearing aids, they unfortunately change how he hears sounds. As an engineering major, he hopes to be able to improve the technology behind his son’s hearing aids and provide him with a quality auditory experience one day. Instead of allowing these traumatic events to stop him from following his dreams, he believes they have happened because his destiny is to revolutionize technology – which may not have been possible had he been born before the technological revolution. 3rd – $500 Jasmine Randle is a first-year Film & Television Master’s Degree candidate at DePaul University in Chicago Illinois. It is a technical degree that highlights the advancement of cinematography, production, post-production, and more. In her essay, Jasmine discusses how being gifted her first cellular phone had a large impact on her life and how she was inspired by the ability to remain in contact with loved ones at the touch of a button. She goes on to discuss starting college and how her beloved Macbook Pro became a very significant part of her life. Not only is it where she wrote essays, designed media layouts and edited photos, but it was also a loyal companion by her side as she traveled abroad. In summation, technology has played an integral role in her life and inspired her career path. Thank you to all of the students that participated in this year’s scholarship. We were truly impressed by the quality and ingenuity of the applicants! About Pagely Pagely provides managed WordPress hosting services to big brands, including leading colleges and universities all across the world.
It’s every system administrator’s worst nightmare. Hackers gain access to your system, stealing mission-critical information, locking sensitive files, or leaking proprietary information to the public. Frankly, it can be hard for companies to recover from such an attack. The data breach at Equifax in 2017 is turning out to be one of the most costly in history, costing the company upwards $275 million. And even if the consequences aren’t that high for your company, you can be sure that you won’t escape unscathed. Whether it’s a damaged reputation, lost data, or even federal sanctions, cyber attacks are tremendously destructive. But not all cyber attacks are the same. They utilize different methods to achieve different ends, and as such, require different prevention strategies. Here are the top six cyber attacks you need to be ready for in 2019. Cyber Attack #1: Ransomware This is as scary as it sounds. Ransomware is, essentially, the digital version of kidnapping. It works something like this. A hacker manages to get a ransomware file onto your servers. Typically, hackers will use some form of phishing, in which a user in your system receives an email with a malicious file attached. Of course, this file doesn’t look malicious. It looks completely legitimate, like something they receive every day. When the user opens the file, the ransomware file is deployed, encrypting and locking specific, highly sensitive files on the user’s computer or your servers. When the user attempts to open the files, they are confronted with a message stating that their files have been locked, and that they will only receive the encryption key if they pay a specified amount to the hacker, usually through an untraceable Bitcoin payment. This type of attack is massively on the rise, with ransomware attacks growing 2,502% in 2017. Who is at risk for ransomware attacks? While there’s a sense in which everyone is at risk, hackers often target organizations that need quick access to their files, such as medical facilities or government agencies. The effects of a ransomware attack can be crippling. As David Bisson at Tripwire notes: On 26 July 2017, Arkansas Oral & Facial Surgery Center suffered an attack at the hands of an unknown ransomware. The incident didn’t affect its patient database. However, it did affect imaging files like X-rays along with other documents such as email attachments. It also rendered patient data pertaining to appointments that occurred three weeks prior to the attack inaccessible. At the time of discovery in September 2017, Arkansas Oral & Facial Surgery could not determine whether the ransomware attackers accessed any patients’ personal or medical data. It therefore decided to notify 128,000 customers of the attack and set them up with a year of free credit-monitoring services. Unfortunately, a ransomware attack places an organization between a rock and a really, really hard place. They can pay the ransom to release their files, but that will mean instant bad publicity for them and the widespread knowledge that they’re willing to pay for locked files. If they refuse to pay, they may lose business-critical files, which can also cost them enormous sums of money. Cyber Attack #2: Internet of Things The Internet of Things is made up of all the digitally connected items that, in the past, have never been able to connect to the internet. We’re talking appliances, thermostats, cars, and thousands of other things. And while these smart home innovations can certainly make life easier, they also make your company much more vulnerable to attack. The unfortunate reality is that many IoT devices are riddled with security holes which smart hackers can slip through, usually without notice. And if hundreds of IoT devices can be coordinated for an attack, it can create chaos and catastrophe on an enormous scale. In 2016, a coordinated IoT attack was launched that resulted in huge portions of the internet simply being inaccessible. Sites from HBO to Etsy to Fox News and PayPal were affected, and eventually led to an investigation by the Department of Homeland Security. This problem isn’t going anywhere and presents a significant threat to your company, especially as more IoT devices are incorporated into your network. As Greg Nichols noted in ZDNet in March of 2018: The average number of IoT devices in the workplace is expected to increase by nearly 9,000 to an average of 24,762 devices. 97 percent of respondents [to a survey] say an attack related to unsecured IoT devices could be catastrophic for their organization and 60 percent are concerned the IoT ecosystem is vulnerable to a ransomware attack. 81 percent say that a data breach caused by an unsecured IoT device is likely to occur in the next 24 months. Only 28 percent say they currently include IoT-related risk as part of the third-party due diligence. These are staggering numbers and indicate just how large this problem is. Expect this to be one of the prime areas targeted by hackers in the next few years. Cyber Attack #3: Social Engineering and Phishing These hacker methods sound as old school as they are, but they likely aren’t going anywhere. Why do they still work? Because they rely solely on people. Social engineering and phishing involve hackers posing as legitimate institutions in order to trick people into entering sensitive information. For example, a hacker may email employees at your company, posing as a system administrator, asking them to reset their password. A link is included in the email that directs the employees to a page that looks like one of your legitimate password reset pages, including fields for the username and old password. When the employee enters their old password, the hacker gets access to what is actually their current password. They can then immediately log into your system without any detection. These types of attacks are getting increasingly sophisticated. For example, hackers often launch these attacks in the wake of legitimate security breaches. People who would normally never fall for such a scam are much more liable because they know there was a security breach and that password resets are standard protocol following a breach. The stats indicate that phishing isn’t going anywhere. Dashlane notes: Phishing attempts are up 65% over the last year 76% of businesses reported being the victims of a phishing attack Phishing rates are increasing across all industries, meaning no business is immune This is an example of a 2017 phishing scam that hit nearly 1 billion Gmail users. It looks like a Google sign in, but imputing your data would give hackers access to your Gmail. These types of attacks will continue simply because humans don’t change. There will always be ways to deceive people into giving up sensitive information, no matter how many measures are put into place. Cyber Attack #4: Cracking Cracking is when hackers use high-powered computer programs to systematically enter millions of potential passwords in the hope of “cracking” some of the easier ones. And we all know that millions of people still use laughably simple passwords, including the ones they use to log in to your system. We’re talking passwords like: “Password” “Abc123” “111111” Their own name Their birthday A recent study showed that a staggering 35% of people have what are considered to be “weak” passwords. These are easily crackable passwords. And most of the other 65% use passwords that can be cracked, given enough time. As computers grow increasingly powerful, cracking programs can quickly generate billions of potential passwords to try. If passwords aren’t sophisticated enough (i.e. they don’t contain enough random characters), they can still be somewhat easily cracked. And while system administrators are increasingly forcing users to devise more complicated passcodes, cracking attacks will always be a danger until users are forced to create completely unique passcodes that are very difficult to crack. Cyber Attack #5: Man In The Middle Man in the middle attacks happen when one of your employees conducts company business on an unsecured wireless network. For example, let’s say an employee is traveling and they stop in a coffee shop to catch up on a bit of work. If the wifi in the coffeeshop is unsecured, a hacker may be able to intercept any information being sent from the employee’s computer. This could include passwords, sensitive emails, contact information, and anything else they might transmit over the network. While there are certainly precautions that can be taken against this, such as installing VPN software on employee computers, there’s still the risk of information being captured from personal devices, such as tablets and mobile phones. Cyber Attack #6: WordPress Specific Attacks Given that WordPress powers approximately 30% of the internet, it should come as no surprise that WordPress security attacks are increasing in number. WordPress is generally secure out of the box, but as a site gains more traffic and notoriety, hackers will resort to increasingly sophisticated methods to take down WordPress sites. One area of particular vulnerability is third-party plugins. If these aren’t updated on a regular basis, they can introduce risks to your system. A recent study by Securi noted that 25% of hacked WordPress sites were exploited because of out-of-date plugins. Additionally, WordPress sites that don’t use SSL certificates are vulnerable when being accessed through unsecured networks. Hackers on the networks can use Man In The Middle attacks to sniff out login details, then login into the site and deface it. Finally, failing to disable pingbacks can put your site squarely in the middle of a DDoS botnet. As WordPress continues to expand its reach, it will be increasingly important to lock down sites against attacks directed specifically at the platform. What Should You Do? There are number of basic precautions that can and should be taken regarding security, such as regularly training employees on the basics of security, forcing employees to use VPNs on all work related devices, implementing the latest security software, etc. However, as the threat of cyberattacks grows, you should also consider more sophisticated measures such as secure WordPress hosting. If you truly want to protect your company, you’re going to want to utilize such techniques as a dynamic web application firewall, chroot user separation, real-time malware scanning, and full restoration processes in the event of a breach. When it comes to web security, don’t settle for half-measures. When they fail, the costs are enormous and you’re left to pick up the pieces.
PressThumb has been an off the menu speciality item for the past year or so, and in that time we’ve put it to the test for the whole range of use cases and scale. From a convenient and free add-on to your existing VPS, to full scale dedicated infrastructure processing countless requests per minute, it’s now ready for a wider audience as a Pagely branded feature! What is PressThumb? PressThumb is Pagely’s solution for image optimization and on-the-fly thumbnail generation. It is powered by Thumbor and integrated with Pagely’s hosting stack using a combination of custom NGINX rules and an mu-plugin. Images on all of your pages are dynamically treated with no up front bulk processing required. It’s pretty neat stuff. IMAGE OPTIMIZATION There are many options out there for optimizing your images. Most of them require you to process all of your assets up front, as a pre-optimization. We recommend this option if you are looking to save on disk space as well as bandwidth usage. PressThumb does not require this up front processing because assets are generated on-the-fly with each request. Once it’s on, it just works and you do not need to run any extra commands. THUMBNAIL GENERATION It’s the same story for thumbnails, too. PressThumb generates thumbnails for original size images on the fly (and optimizes them in the process). This is where the huge savings in disk space can come in! You only need the original size of a given image to live in your library and PressThumb will handle the rest. Imagine all the space you’ll save from not needing 20 copies of the same image just to have all your dimensions covered. Neat. So how much? PressThumb is available for any VPS or Enterprise hosting plan for no additional cost. The Standard Version is configured as another service that runs on your existing servers. The premium version gets you dedicated nodes for handling all image processing without impacting the CPU on your application servers, starting at $250/mo. Any other gotchas? Both of these new features require switching to NGINX-only mode. This can be done on a per-application basis and is generally a more flexible and higher performance option than our standard NGINX+Apache mode. As always, reach out to our team with any questions you might have.
Pagely is thrilled to announce our partnership with Object Cache Pro. Utilizing state of the art compression technology, Object Cache Pro is now part of Pagely’s core offering, and available to all of our customers, platform wide. Offering major cost savings, access to some of the world’s best technology, and a dedicated DevOps team to personalize your setup, Pagely customers can look forward to continued scale and growth, with no hosting friction. A first of its kind partnership, Pagely is proud to help fund innovation in this WordPress space by investing part of our budget into working alongside the fantastic team at Object Cache Pro. We’ve already seen great gains with Object Cache Pro and our customers can look forward to more in the future! Why Object Cache Pro? Before Object Cache Pro, we faced two challenges with sites making use of an object cache – CPU overhead and network saturation. The underlying technologies in Object Cache Pro solved both of these problems for us, translating to less money spent on server hardware and fewer situations where the (quite generous) AWS network limits are reached. With Object Cache Pro’s state of the art technology utilizing the Zstandard compression library from Facebook, without a lot of CPU overhead, compression is now done at the extension level, talking to and from Redis. This means less hardware, lower costs, and a better experience for our customers. Aside from supporting an efficient compression algorithm (zstd), Object Cache Pro also uses the igbinary serializer which is a drop-in replacement for the standard serializer in PHP. This works about twice as fast at serializing and unserializing data. Additionally, the data footprint is smaller when using igbinary and that translates into less memory being used by the underlying Redis service. We also found an in-depth comparison on igbinary vs other serializers on Blobfolio that you may also enjoy reading if you’re into this kinda stuff: https://blobfolio.com/2017/03/benchmark-php7-serialization/ With a wide selection of Redis plugins available in the WordPress marketplace, Object Cache Pro was the obvious choice for us not only because of their forward-thinking tech but also because of the dependability we have come to expect and appreciate from their brilliant team. All of this aside, Object Cache Pro is unrivaled when it comes to bug fixing, an extent to which is a rarity across opensource software. There’s a saying in the opensource community that goes, “there’s a lot of eyes so all the bugs get fixed.” But, more what we see concentrated use of the software by lots of users leading to fewer bug fixes for fear of breaking one users’ site. That, and, no one owns the codebase, so less can get addressed in a timely manner. Similarly, we are continuously impressed by their coverage of testing, fully unit tested with 100% code coverage. Further, switching over to Object Cache Pro gives Pagely customers access to our commercial relationship with their team, which means any problems our customers see are fixed within a few days. You benefit from our relationship. Fewer bugs in the caching layer and full unit testing is a good thing, and that’s something we stand behind. So, What’s in it for the Pagely Customer? We are the first premium host to achieve this level of partnership with one of the best technology companies in WordPress. Through our relationship with Object Cache Pro, every single Pagely customer benefits from the work we’ve done to secure that. But real talk, what’s in it for you? Major cost savings. Even when it means less revenue for Pagely, we’re constantly looking out for cost savings for our customers. By decreasing our dependency on more hardware, you see the savings directly on your bill. Access to a premium partner. Since you’re at a premium hosting provider, you automatically get access to the partnerships we’ve developed. What’s more? You don’t pay an extra licensing fee. The best tech, baked into your Pagely account. We’re always on the hunt for the best and most innovative technology for you. With no effort on your part, we do the legwork of implementing this tech across our technology stack. All you do is benefit from it. Bigger performance wins possible with a little extra code work. WordPress has a feature called Transients. It’s a way to store the result of a complex query or a long-running remote API call temporarily in order to make subsequent lookups for that data return a lot faster without doing the same expensive operation again. Normally without any object cache, transients are stored in the WordPress database’s wp_options table. When using an object cache, it is stored in memory. Adding a few extra lines to your code allows you to tap into the power of this API for incredible performance gains. Having an efficient object cache utilizing fast compression and serialization only increases those gains. A dedicated DevOps team. While others might catch on and jump on the bandwagon of partnerships like this, Pagely still stands above the rest in meaningful ways that translate to real gains for you, the customer. Our DevOps staff becomes your dedicated, in-house team. Our engineers handle all the setup and optimization to make sure your usage of Redis is optimized specifically based on your exact circumstances and needs. Other hosts don’t do that! When you partner with Pagely for your WordPress hosting at scale, you know you have selected the most forward-looking host driven by advances in technology, cost savings for you, and tangible outcomes that help your business thrive. Object Cache Pro Helped FanSided Scale So let’s get to a real-life example here. One of the first Pagely customers we switched over to Object Cache Pro was FanSided. Here you can see a dramatic decrease in network utilization on the Amazon Aurora RDS instance after implementing Object Cache Pro along with custom Transients Caching, which dropped usage from 1 Gigabit per second to 400 Megabit per second; and yielded even lower usage after some more optimizations were made. FanSided comprises a massive network of over 300 active websites and needed a fast solution to maxing out servers and using way too much CPU. Pagely found that solution in Object Cache Pro and implemented it with no effort on FanSided’s part to completely eliminate those issues. Here you can see how memory is no longer being maxed out after the date we turned on Object Cache Pro for FanSided. The proof is in the data, and here you can see dramatic drops in CPU usage after Object Cache Pro was implemented, as well as servers being maxed-out-no-more after the switch. Dramatic drops in CPU usage after implementing Object Cache Pro for FanSided. Read the full FanSided + Object Cache Pro case study here, and take it from our CEO: “In the vacuum of 1 website, a small performance gain is useful. At our scale of hosting, processing hundreds of billions of requests per month across thousands of AWS EC2 instances, a small performance gain to each site means a real and quantifiable benefit to our customers and our bottom line. Now what if that performance gain was not so small, but major. We sought out and partnered with Object Cache Pro after seeing the dramatic results in terms of performance and resource usage when testing. We have thus deployed their Enterprise solution fleet wide and the results speak for themselves.” – Joshua Strebel, CEO of Pagely
Catch up on the conversation. This piece comes as a followup to our CEO Joshua Strebel’s recent piece on why you should never pay your WordPress host for pageviews. Managed WordPress hosting has exploded across the hosting industry since Pagely created it way back in 2006. Overall, the level of innovation that the mainstream has brought to WordPress is amazing. Unfortunately, this sometimes comes with negative side-effects. As investors demand higher profits, many of these managed WordPress hosts are looking for ways to gain a quick and easy boost to their margins. Like we mentioned in our definitive guide to PHP workers, there are a few different metrics that are often misinterpreted, whether intentionally or not. Today, we’re going to talk about pageviews and their role in the managed WordPress hosting world. What Counts as a Pageview? Many hosts cite pageviews as a billing metric with vague term descriptions, if any exist at all. Even with clarified definitions, pageviews tend to mutate on a host-by-host basis with a dizzying array of buzzwords. Although individual managed WordPress hosts vary on what they consider a “pageview”, most define it like this: pageviews are the number of unique IP addresses that access pages on your WordPress site per day, excluding known bots. (Yeah, I know. The term is more like “the number of unique request sources per day, based on predefined catch-all filters.” But I wasn’t the one that made this up, so bear with me here.) Pageviews as a Billing Metric Before we dig in any deeper into the details, let’s think about the definition that I mentioned. Considering that narrative, which of these sites would be more expensive to host? A directory website that houses billions of pages, showing 1,000 entries at a time. A personal blog who’s majority of traffic is to single posts. A documentation site where visitors typically access multiple pages per day. A simple informational website for a local restaurant. An online shop that sells small-batch artisanal snake oil. An API that uses headless WordPress to dynamically fetch content. If you guessed that they represent the same metrics in the eyes of pageview-based billing, your logic prevails! Assuming that they all experience the same number of unique visitors, they’re all treated the same way, regardless of how resource-intensive the site is or how many pages each visitor accesses. Of course, it would be silly to treat all of these sites the same way. Some pages might have large amounts of fully dynamic content, while others might be eternally served from cache. Using an umbrella term like pageviews as a billing metric causes several different issues, based on the site being hosted. Setting Realistic Expectations The first issue that pageview-based billing causes is an unrealistic expectation for low-performance, unoptimized sites. If you’re not familiar with how WordPress sites perform on the server side, you might think that these limits matter exclusively and use them to determine what capabilities you need from a hosting provider. If you’re evaluating your hosting options purely based on a pageview limit, you’re ignoring critical factors that can dramatically impact your WordPress site. Performance-Based Punishment What if you’ve put hard work into optimizing your site? Well, now you’re wasting money on a billing metric that doesn’t matter. If your site is highly cacheable, you’re feeling the impacts even further. When serving content from cache, it’s practically free from a hosting perspective. You’re being nickel-and-dimed for something that is entirely outside of your control. Knowledge is Power As you scale, knowing what you’re paying for can quickly become a critical part of maintaining a healthy, cost-effective site. Coupled with the fact that the same people who are charging for pageviews tend to hide their underlying infrastructure behind the curtains, there’s no way to verify or manipulate what’s being counted. While many claim that they exclude the known IP addresses and user agents of known bots from counting towards your monthly pageview bill, what’s their motivation for even bothering? After all, more pageviews mean more money in their pockets. Pageviews Are Still Helpful Many of our prospective customers ask, “How many pageviews can ‘x’ plan handle?” Like we mentioned earlier, the impact of each pageview dramatically varies based on the type of content viewed and how your site was developed. Every WordPress site is different. It would be impossible to accurately estimate the ideal hosting environment without a complete understanding of what your site’s usage looks like. Although pageviews are a faulty metric as far as billing is concerned, they can still be useful as part of a larger dataset. Whether you’re scaling, optimizing for better performance, or shopping for a new hosting provider, pageview data plays a role in getting a full picture of your site. For example, if you were running benchmarks to determine your server’s capacity, pageview data could be used to identify what a typical day looks like. Let’s say your site looks something like this: 10% of traffic is on the home page. 30% of traffic is to various landing pages. 30% of traffic is to different blog posts. 20% of traffic is to your product’s pricing page. 10% of traffic is on account-related pages. Using that traffic data, you could then estimate what types of content have the most significant impact on server resources. You may find that some pages underperform and could use some optimization, while other highly-cacheable content, like blog posts or landing pages, remain essentially free. If 90% of your traffic goes to fully-cached content, increases in traffic have a trivial impact on your bottom line, if any. Closing Remarks Operating a WordPress site at scale is all about a delicate balance of performance and cost. At Pagely, we partner with our clients to help them achieve those goals. While shopping for a new hosting provider, be on the lookout for hosts that impose false barriers, such as PHP worker limits and pageview counts. Those vague limitations are a red flag that they’re going to try to upsell you later. (These limitations are also a sign that they’re trying to sell you on shared hosting resources too, but that’s a topic for another discussion entirely.) We hope that you’ve learned more about the impact of pageviews (or lack thereof) and why it’s not an appropriate billing metric. Do you have any experiences with pageview-based billing that you’d like to share? Is there something we missed? Let us know in the comments below.
This monthly report is provided for the WordPress community at large from Pagely’s head of security, Robert Rowley. Rowley and the entire security team keep their finger on the pulse of any potential vulnerabilities that might affect our customers, as well as any WordPress user. We sincerely hope these efforts help any and all that could use information from the experts on monthly security issues. We commend the researches and developers that help to identify and patch these issues in a timely fashion. WordPress Core No notable WordPress core security releases. Plugin/Theme Vulnerabilities of Note Security & Malware scan by CleanTalk https://wpvulndb.com/vulnerabilities/10292 This vulnerability within CleanTalk allows an authenticated user, such as an editor or subscriber, to make unauthorized Ajax calls which could lead to file deletion or downloads and also potentially function calls. Adning Advertising https://wpvulndb.com/vulnerabilities/10293 The Adning Advertising plugin has a vulnerability in versions lower than 1.5.6 which allows unauthenticated requests to upload or delete files, leading to an RCE attack, which can then lead to full site takeover. Wise Chat https://wpvulndb.com/vulnerabilities/10299 Wise Chat versions lower than 2.8.4 are susceptible to a CSV injection via a command sent in chat messages by an unauthenticated user that is included in an exported CSV file, which then could potentially lead to an RCE attack. Email Verification for WooCommerce https://wpvulndb.com/vulnerabilities/10318 The Email Verification for Woocommerce plugin prior to version 1.8.2 is affected by a loose comparison issue. This could potentially lead to any user (authenticated or non-authenticated), to log into the WordPress site. SRS Simple Hits Counter https://wpvulndb.com/vulnerabilities/10316 The SRS Simple Hits counter plugin is currently vulnerable to an unauthenticated blind SQL injection vulnerability. The responsible reporting parties at Tenable ( https://www.tenable.com/security/research/tra-2020-42 ) are working with the developer to write a more comprehensive patch to address this vulnerability, and will not release more details on the attack until they know a patch has been released. Site owners using SRS Simple Hits Counter plugin on their sites should keep an eye out daily for the patch to be released. Payment Form For Paypal Pro https://wpvulndb.com/vulnerabilities/10287 The Payment Form for Paypal Pro plugin versions before 1.1.65 are vulnerable to an unauthenticated SQL injection attack. The attack is a trivial single request which can expose the contents of your database (which includes user passwords and potentially other secrets) to the attack. This is a high risk vulnerability and site owners should patch immediately. WooCommerce Subscriptions https://wpvulndb.com/vulnerabilities/10330 The WooCommerce Subscription plugin is vulnerable to an unauthenticated stored cross site scripting (XSS) attack in the subscription billing process. Attackers can submit their XSS attack payload to during the billing step in the signup process, and later that payload will be executed on the browser of the administrator/user who reviews the attacker’s account. Site owners should update WooCommerce Subscriptions plugin to version 2.6.3 and not check any new user account information until that update is performed. TC Custom JavaScript https://wpvulndb.com/vulnerabilities/10325 The TC Custom Javascript plugin is vulnerable to an unauthenticated stored cross site scripting attack. Sites running versions before 1.2.2 should update immediately, attackers can add their own javascript or HTML to the footer of all pages loaded by WordPress with a few basic requests. This vulnerability is likely to be targeted by SEO spam bots. KingComposer https://wpvulndb.com/vulnerabilities/10297 The KingComposer plugin is vulnerable to a reflected cross site scripting vulnerability in versions before 2.9.5 This means the attacker’s malicious HTML/javascript will only be available to the browser making this request. This still poses a high risk if an attacker can trick an already logged in user to click on a malicious link/form to the website, potentially exposing secrets viewable by the user giving them to the attacker. JobSearch https://wpvulndb.com/vulnerabilities/10328 The JobSearch plugin versions before 1.5.6 are vulnerable to a reflected cross site scripting vulnerability. Much like the KingComposer vulnerability above it is a high risk if logged in users to be targeted. The proof of concept for this vulnerability will be released on August 6th, 2020, site owners should patch before this date. See previous months’ WordPress security updates from May and June.
The benefits of this WordPress security guide are two fold: Learn exactly what you need to know about WordPress security in 2020. Understanding WordPress security helps you adopt a security-oriented mindset that will help you prevent and mitigate risks as you make day-to-day decisions. Get actionable, step-by-step instructions for securing your WordPress site. The steps you need to take aren’t particularly time-consuming, don’t require advanced technical knowledge, and the linked guides are vetted for clarity and completeness. Of course, it’s impossible to cover every possible vulnerability and scenario. That’s why we also include the overarching “principles of WordPress security.” If you can follow these broad principles many of the minute details that are difficult to address in this type of post will take care of themselves. Why is WordPress security critical? It’s important you understand how big an issue WordPress security is so you give it the time and attention it deserves. Here are some sobering statistics: Google blacklists 10k sites a day for malware and another 50k for phishing each week. A blacklist from Google kills that source of traffic which can be highly disruptive to a business’s revenue. Fixing and removing a blacklist can be a hassle, particularly if your server was used to send SPAM emails. A blacklist from email service providers harms your deliverability rate which undermines the effectiveness of your email marketing. In 2018, 90% of CMS hacks were WordPress. Granted, WordPress is the world’s most popular CMS with 34% of the web powered by WordPress, but this is still a disproportionate amount of hacks. For a variety of reasons, WordPress sites are targeted and exploited more than any other CMS. 60% of attacks target small businesses. You may think that hackers won’t bother with your site because you’re a small fish but “security through obscurity” does not exist on the web. No one is too small to be a victim of an attack. WordFence reports that there are over 97,978 attacks happening per minute. This is not a small, isolated problem. Large swaths of WordPress sites are being probed for weaknesses at any given time. Will you be ready if your site is targeted? While these stats paint an intimidating picture of what you’re up against, it’s important you confront the realities of managing a WordPress site in 2020. If your business relies on WordPress, security is not something you can afford to ignore. If you haven’t taken steps to secure your site, you’re vulnerable to attack. It could be only a matter of time until your site becomes compromised. This is one area where “an ounce of prevention is worth a pound of cure.” The principles of WordPress security Securing WordPress is more than checking off a list of boxes, it requires you to adopt a security-oriented mindset that guides your decision making. These principles will help you prevent mistakes as you make day-to-day decisions like adding new WordPress users, plugins, and themes: Vulnerabilities are often introduced by WordPress users. Vanilla WordPress that is kept up to date and uses strong passwords is relatively secure. It’s often the decisions made by WordPress users that create weaknesses that hackers exploit. This is why articles like this one are so important. It’s up to you to be educated on, and consistently follow, the WordPress security best practices outlined here. Minimize plugins and themes. New WordPress users are often overjoyed by the extensive ecosystem of plugins and themes available for WordPress. This can lead to indiscriminate installation of plugins. But, each new plugin or theme adds code to your site that, potentially, adds new vulnerabilities. By minimizing the plugins and themes installed, you also minimize the amount of code your site uses, and, by extension, the number of potential security vulnerabilities. In general, if you can solve a problem without installing a plugin, that’s the best option. Install updates as soon as possible. Updates to the WordPress core and updates to plugins and themes often contain critical security updates. They should be installed as quickly as possible. If you have a good back up strategy in place, you can roll back to a previous version in the event the update causes issues. Follow the principle of least privilege. This is a core principle of cybersecurity in general and is not unique to WordPress. This is a fancy way of saying, “don’t give a user more privileges than they need because those extra privileges give hackers more power and access than they’d otherwise have if they compromise that account.” Attacks can still happen. You can try as hard as you can to cover all the bases and still fall victim to an attack. This is why regular, automated backups are critical. Do not ignore this advice. A hacked site can be disruptive but can generally be fixed with minimal cost and disruption, a hacked site without a backup to roll back to can be severely disruptive. You are never finished with security. Having a 100% secure WordPress site is an impossible task. You can’t accomplish complete risk elimination, so aim instead for ongoing risk reduction. This “risk reduction” mindset prompts you to continue taking steps to improve your security as part of an ongoing, never-ending initiative. The most common WordPress attack vectors Understanding the most common methods hackers use to exploit WordPress will help you understand how to address them and why the steps recommended later in this article are necessary: Brute Force Attack A cyber criminal uses trial and error to identify a password or pin. They use combinations of common usernames and passwords until they find the right one. It’s the equivalent of trying every key on a key ring to find the one that works. This is all done using a computer script so they can run thousands of combinations with very little effort. Given enough time, any account is hackable but strong passwords thwart this kind of attack. SQL Injection Malicious SQL code is injected into a database to gain access to database information that was never intended to be displayed. Depending on the hackers goals, this can lead to your database being deleted, customer information being stolen, or sensitive company information being accessed. Malware A virus or spyware is inserted using an expired theme or plugin. The attacker can gain access to your data, insert pages into your site for black hat SEO, and perform a number of other nefarious activities using your site. Cross-site scripting Javascript code is inserted which then collects data commonly used to exploit WordPress plugins. This can be used to redirect your site visitors to malicious content. also known as an “XSS attack.” DDoS Attack A Distributed Denial of Service (DDoS) attack floods a website with traffic which overwhelms server resources causing it to fail. Multiple machines send frequent requests to the server using malware installed on those machines for that purpose. The distributed nature of the attack can make it difficult to identify and block the sources of the traffic. Now that you understand how hackers will attempt to breach your site security, let’s look at how we can block and prevent these attacks… Steps to secure your WordPress site In spite of the many ways your site can be compromised, it is possible to mitigate these risks and prevent many attacks. Here’s a list of recommended steps to protect your WordPress site from security attacks: 1. Force Strong Passwords “81% of attacks are based on insecure or stolen passwords” “It only takes about 10 minutes to crack a lowercase password that is 6 characters long.” These two facts taken together make the case that you must use strong passwords for all WordPress users. Strong passwords are long and use a combination of upper and lower case letters, numbers, and symbols. Longer is better but 20-characters is probably plenty. Strong passwords are difficult to memorize, especially if you’re using unique passwords for each site (you should be!). This means a password manager, such as LastPass or Dashlane, is a critical tool. These apps make creating strong passwords easy, store them in a central location, and make logging into your websites easy by autofilling your passwords. Here’s how to make sure all your WordPress users are using strong passwords. 2. Turn on automatic WordPress Core updates One of the advantages of using a popular CMS like WordPress is that there are many people with a vested interest in keeping it secure. Thousands of people are contributing to WordPress security by reporting vulnerabilities to the WordPress team. This widespread collaboration means most holes are patched relatively quickly. But, if the updates that contain those fixes are not applied, you leave your site vulnerable to attack. The best way to ensure your WordPress core updates happen quickly is to turn on automatic updates. This way your WordPress site will be kept up-to-date without you having to do anything. Here’s how to turn on automatic core updates by modifying your config.php file. 3. Stay on top of plugin and theme updates You absolutely must keep your plugins and themes up-to-date. The importance of this cannot be overstated. You’ll also want to be careful to use plugins and themes that are updated often. If you’re using a plugin or theme that has not received an update in months, it’s a good idea to check in with the developer or find a more frequently updated plugin that accomplishes the same goal. When you search for a plugin in the WordPress plugin database, this information is provided in the sidebar: 4. Use Two-Factor Authentication (2FA) Two-factor authentication adds a layer of protection to your WordPress site by making it nearly impossible for a hacker to log in to your site — even if they know your username and password. You should set up 2FA for all WordPress users. 2FA can be set up quickly with simple, free plugins. Here’s a list of available 2FA plugin solutions for WordPress. 5. Brute Force protection Even with 2FA and strong passwords, it is good to setup brute force protection to help with overall performance on the server by reducing the amount of work PHP has to do. Here’s how to protect your site from brute force attacks. 6. Create automated, scheduled Backups In the event of an issue, there should always be recent database and file backups available. You should also create a backup before making any major changes to your site, such as installing plugin and theme updates. Many of the popular backup solutions take care of this for you. Here’s a list of backup solutions for your WordPress site 7. Change your login pages The default login pages for all WordPress sites are sitename.com/wp-login.php and sitename.com/wp-admin.php. Using these default login page URLs makes it easy for hackers to begin a brute force attack by trying combinations of usernames and passwords. By using a login URL that is difficult to guess, it makes it more difficult for hackers to begin the brute force attack because they don’t know where the login form lives. Here’s how to change your login page URLs. 8. Use SSL Secure Sockets Layer (SSL) encrypts all data sent from your website to the visitors browser obscuring potentially sensitive data. Using SSL has many benefits in addition to security. Google may rank your site higher in the search results and many browsers indicate whether a site is secured by SSL which can reassure them your site is trustworthy. Here’s a tutorial on setting up SSL for your WordPress site 9. Don’t use the default database prefix Using the default “wp_” database prefix makes it easier for a hacker to insert code into your database (SQL injection). Here’s how to change the default database prefix for a new site and an existing site. 10. Check your folder and file permissions File permissions define what actions can be applied to the files on your server. You should never set any WordPress file or directory to 777 permissions. Instead, make sure your permission scheme is as follows: Folders – 755 Files – 644 Here’s a guide to checking and fixing the permissions of your WordPress files and folders. 11. Disable pingbacks WordPress pingbacks are enabled by default. But for most sites, they offer little benefit. But, they can be used to turn your WordPress site into an unwilling participant in a DDoS botnet. To turn off pingbacks, you can go to “Settings –> Discussion” and uncheck the “Attempt to notify any blogs linked to from the article” box. It’s also a good idea to uncheck the “Allow link notifications from other blogs (pingbacks and trackbacks) on new articles” box: 12. Hide your WordPress version number One of the ways attackers gain access to a site is by exploiting known vulnerabilities in outdated versions of WordPress. Hackers can scan your site and easily find out what version of WordPress you’re using. If that version has a known vulnerability then the hacker has a good idea of how to proceed. The best way to prevent this is to keep WordPress up to date. However, you can also prevent a hacker from finding out what version of WordPress you’re running. Here’s how to hide your WordPress version number. 13. Don’t use the admin username Hackers can safely assume that a WordPress site is using the default “admin” username and that username will give them admin privileges so all they need to do is figure out the password. This gives them a direct path to gaining admin access to your site with a good probability of success. Eliminating the admin username makes it significantly more difficult to attack your site this way. If you’re already using the admin username, that’s okay, you can change it now. Here’s how to change the admin username. 14. Use a secure Managed WordPress Host A host that supports all the major CMSs will have difficulty staying on top of WordPress security. By specializing in the WordPress CMS alone, a WordPress hosting provider can devote the resources necessary to prevent many attacks. A reputable Managed WordPress Host will have a security team dedicated to shielding your site from threats. They’ll handle many of the concerns raised above like taking care of WordPress updates, creating backups, and more. Here at Pagely we have a comprehensive suite of security features called PressArmor that handles both WordPress application security and server security. Security questions to ask a potential managed WordPress host: Is your hosting environment chrooted? If your host has multiple domains on the same server, check with them to ensure they use chroot to isolate each WordPress app. If one app is hacked, this would help prevent access to other apps on the server. Is SSL included and easy to set up? A good WordPress hosting provider will provide SSL free of charge using a service such as Let’s Encrypt. Do you actively monitor my site specifically for WordPress vulnerabilities? If you detect a vulnerability on my site, how will you inform me? A good WordPress host will stay on top of the latest threats to WordPress sites and constantly scan your site for those threats. If they find a vulnerability, they will work with you to address it. Are you using a web application firewall (WAF) to protect my site? A WAF block malicious traffic before it reaches your site and can help prevent XSS attacks and SQL injections. Here’s a list of important considerations for choosing a Managed WordPress Host. Conclusion WordPress security cannot be taken lightly and you must take steps to secure your site. Using a Managed WordPress Hosting Provider like Pagely is one of the best ways to improve your security because you will have an experienced team dedicated to protecting you. Whether you choose to handle WordPress security yourself or leverage a host that specializes in WordPress, it’s important to treat WordPress security as an ongoing effort. You are never done with security but if you’ve taken the above steps you’ve protected yourself from many of the most common threats.
Since this is the internet – and the rules of the internet clearly state everyone gets an opinion, I’d like to share one of mine around website hosting billing plans. Quick backstory: 10+ years ago when we launched Pagely we did so with a simple line on our pricing page denoting a rough estimate of the expected capabilities of that plan ie: Plan – 1 was suitable for ~1 million pageviews. Along came the next several providers who did something similar with one important difference. They actually attempted to measure and cap pageviews per hosting plan, bracketing their plans by this new billing metric. In my opinion Pageviews used as a billing item is a predatory and anti-consumer practice and you should be very wary of working with any company that applies this #successtax to your monthly bill. Definition of anti-consumer : not favorable to consumers: improperly favoring the interests of businesses over the interests of consumers Hi, I’m Joshua Strebel, Co-founder and CEO of Pagely – A leading Managed WordPress hosting company – Thank you for attending my TED Talk. What are you buying when you are buying “hosting”? To host a WordPress site you need a few key components. A server (a computer) connected to the internet with software installed to process requests and responses for your application. Storage / Disk space attached to that webserver to save your files to. Data Transfer / Bandwidth. This is the pipe the information flows through. That’s basically it. Hosting providers typically lease/sell you packaged fragments of these resources for a monthly fee. Plan A, Plan B, Plan C. etc. Of course there are other items that may be line-itemed such as included support levels, CDN GB’s per month, managed services, etc. Plan A has X amount of consumables for Z price. It’s all fairly straightforward as most consumers understand what a Gigabyte of Disk space is and can at least grasp that more CPU/RAM offered should equate to more potential performance. “Pageviews” does not fit this model well – as the definition of a pageview is amorphous and subject to exploitation. Oh, and spoiler alert, PHP workers is not a valid billing metric for WordPress hosts either. What does an automobile lease have to do with hosting plans? Pageview limits on hosting plans are akin to annual mileage limits on auto leases. It’s a cap on the use of an asset you already purchased. In an automobile lease context a mileage cap at least has some merit as being a form of controlling the depreciation of the vehicle – you are essentially financing the deprecation of the automobile asset with a lease – and the lease company expects to sell that car (New retail value – Depreciation) when you return it. If the depreciation is too high, they lose money on that transaction as they have to sell it for less than they calculated. Your hosting plan is not a depreciating asset though – the hosting company is going to sell the same resources to the next customer when you are done for the same or likely higher fee. Therefore in my humble opinion: Pageviews are just an arbitrary anti-consumer fee – a penalty tax for using the service you already paid for. A Pageview is (depending on who you ask) a wrapper around these items: A measurable amount of Data Transfer in and out A measurable amount of CPU resources to process the request and render the response A measurable amount of Disk and Database activity Are you not already paying for these items as part of your hosting plan? Hint: Yes you are. But wait, there’s more – and my colleague will dig into these more in a future post. This pageview billing model is so poorly defined by the hosts that use it – it is ripe for abuse. It’s a scheme to generate revenue for the hosting company and unfairly penalizes the consumer. Hint: You already “paid” for the sum of the parts of a “pageview”. No two pages are the same. A cached page even with a few images can be served a million times a month with ease, and yet a badly coded membership-site page may tax the hardware it runs on each time it loads. They have very different cost profiles to the host – yet both are treated equally under this model. If you invested the time to optimize your site, get it caching well and then blow it up with viral traffic.. That is a GOOD day for you and costs your host pennies of the monthly fee you are already paying them – yet when you get the overage bill for exceeding your pageview cap at the end of the month, are you going to enjoy that tax on your success? If you want to keep paying twice for the same resources you are welcome to. I simply do not think that is fair. Our friends down in Austin have made millions on charging their customers overage fees for exceeding their monthly pageview cap – even to the point having to publicly respond to criticism – only to keep the practice in place. Reminds me of airline baggage fees and fuel surcharges. and An “online payment convenience fee” when they only accept payments online. and JetPack being “free”. Happy WordPress’ing – Joshua Strebel
These monthly reports are provided for the WordPress community at large from Pagely’s head of security, Robert Rowley. Rowley and the entire security team keep their finger on the pulse of any potential vulnerabilities that might affect our customers, as well as any WordPress user. We sincerely hope these efforts help any and all that could use information from the experts on monthly security issues. We commend the researches and developers that help to identify and patch these issues in a timely fashion. WordPress Core WordPress 5.4.2 Security Release https://wordpress.org/news/2020/06/wordpress-5-4-2-security-and-maintenance-release/ A WordPress Security release (5.4.2) was made available on June 10th. This release addresses the following 6 vulnerabilities: Authenticated XSS in the block editor Authenticated XSS in media files Authenticated XSS in theme uploads Privilege escalation in set-screen-option() Open redirect in wp_validate_redirect() Information leak allowing comments to be read from password-protected posts and pages. Plugin/Theme Vulnerabilities of Note Removed from Repo WordPress website owners who have the following plugins installed are strongly encouraged to remove them from their websites or find a replacement as soon as possible. These plugins were removed from the WP.org plugin repository due to inaction of the developer to patch one or more security flaws: wp-pro-quiz delete-all-comments-easily High Severity Vulnerabilities ACF to REST API https://wpvulndb.com/vulnerabilities/10284 The acf-to-rest-api plugin versions before 3.3.0 are affected by a vulnerability which would disclose the values of the wp_options table to attackers. This vulnerability has varying severity based on what data is contained in a site’s wp_options table. KingComposer https://wpvulndb.com/vulnerabilities/10270 The kingcomposer plugin versions before 2.9.4 lack proper access controls for ajax endpoints, many of these ajax endpoints also include vulnerabilities which users with a valid accounts could target to change WordPress option values, inject content, store XSS code, delete files on the site or execute arbitrary code. wpDiscuz https://wpvulndb.com/vulnerabilities/10273 The wpdiscuz plugin versions before 5.3.6 are affected by an unauthenticated SQL injection vulnerability. This plugin is currently on release 7.0.3, and the plugin author is making 5.3.6 available as a back port for site owners not ready for version 7. Brizy – Page Builder https://wpvulndb.com/vulnerabilities/10261 Brizy Page Builder before version 1.0.126 is susceptible to an access control vulnerability via AJAX calls which allows a user with minimal privileges the ability to access editor functions. JobSearch https://wpvulndb.com/vulnerabilities/10255 The Jobsearch premium plugin before version 1.5.1 is affected by an unauthenticated reflected cross-site scripting vulnerability. The Proof of Concept is provided within the link below and is easily replicated: https://github.com/vladvector/vladvector.github.io/blob/master/exploit/2020-07-03-jobsearch-wp-job-board-wordpress-plugin-v1-5-1.txt See previous months’ WordPress security updates from April and May.
This article covers our public notifications related to major security issues our clients and the WordPress community should know about. We are always focused on prevention and the mitigation of risk to our clients, and keeping you updated here is part of that process. WordPress 5.4.2 Security Release June 11th, 2020 WordPress site users We trust them within reason. And patch, to be sure. The WordPress security team has released WordPress 5.4.2. This security release addresses 6 security vulnerabilities. There are numerous cross site scripting vulnerabilities addressed in this release however each required an authenticated user to execute the attack. There also includes one privilege escalation attack. If there were a theme in this release, it serves as a reminder to be sure you trust who you give accounts to on your WordPress site. The Pagely team has already begun rolling out this patch for all customers. If you have a version hold request on file, we will patch your site while keeping it on the same major branch version. WordPress 5.4.1 Security Release April 29th, 2020 You are safe at home, while we are patching your sites. Stay Safe. Stay Secure. The WordPress security team has released WordPress 5.4.1. This security release addresses 7 security vulnerabilities and includes 17 bug fixes. There are numerous cross site scripting vulnerabilities addressed in this release, so it is recommended site owner update right away (if you’re a Pagely customer we are already working on this for you.) The Pagely team will be rolling out this patch for all customers shortly. If you have a version hold request on file, we will patch your site while keeping it on the same major branch version. WordPress 5.3.1 Security Release December 13th, 2019 A vuln is a vuln, until a patch is released. Now it is secure. The WordPress core team has released WordPress 5.3.1, which addresses 3 security vulnerabilities and includes 1 security hardening measure. The higher risk vulnerabilities include XSS (Cross Site Scripting) in some unlikely situations, as well a vulnerability which could allow someone to mark a post “sticky” on the site, without the need for authentication. Pagely has tested this version and has the patch available for all customers running any WordPress version. Due to the weekend being upon us, we will begin upgrading sites on Monday December 16th. Any customers who would like the upgrade to be performed over the weekend can reach out to our support staff and they will be glad to help. PHP-FPM+Nginx Remote Code Execution (CVE-2019-11043) October 29th, 2019 Hasty vuln released. We checked immediately; Our servers are safe. On October 22nd, 2019 a security researcher released their findings related to a remote code execution in PHP-FPM, which was present on hosts with specific nginx configurations using fastcgi_split_path_info. Pagely’s stack does use the fastcgi_split_path_info directive within our nginx configurations, and our staff investigated the vulnerability on the 22nd the day of the relase. We identified we were already properly using the recommended remediation of try_files to ensure the file being requested actually exists on the website. Pagely’s default nginx configuration is not vulnerable. On October 24th the PHP dev team released the official patch version to address this vulnerability. Our staff have already started applying this patch to all customer servers. WordPress 5.2.4 Security Release October 15th, 2019 Secure WordPress Fast Six Vulnerabilities Secured by this Patch. The WordPress.org core team has released WordPress 5.2.4, a security release addressing six vulnerabilities from XSS to viewing unauthorized posts. Pagely staff have already begun applying patches to our customer’s WordPress websites. Customers with version holds will only receive the patch for the branch they are currently running. WordPress 5.1.1 Security Release Addresses XSS March 15th, 2019 Comment filter for Cross Site Scripting prevention; Helps secure WordPress. The WordPress.org core team has released WordPress 5.1.1 which is a security release to address two vulnerabilities related to improper filtering of comments on WordPress sites. Pagely staff have already begun applying the patch for each of our customer’s WordPress version, and will keep customers on their current branch version if they have requested a version hold. WordPress 5.0.1 (and 4.9.9) Security Release December 13th, 2018 WordPress new release Patches seven vulns in all. Handled by our team. The WordPress.org core team has released WordPress 5.0.1 which is a security release to address a number of vulnerabilities found in WordPress versions 5.0, 4.9.8 and older. The core team has also provided security releases for WordPress versions 4.9.x, 4.8.x, etc.. which addresses the same vulnerabilities for that WordPress branch release. Pagely staff will apply the appropriate patch for each of our customer’s WordPress version, and will keep customers on their current branch version. This means, if you’re running 5.0, we will apply the 5.0.1 patch, if you’re running 4.9 then we will apply the 4.9.9 patch, and so on with 4.8 and etc… This patching will be completed by the end of the week. WordPress 4.9.7 Security Release Addresses Arbitrary File Delete (CVE-2018-12895) July 5th, 2018 We patched this last week. This security release is safe to wait for. The WordPress.org core team has released WordPress 4.9.7 which adds some functionality and includes a security patch for the previously reported “Arbitrary File Delete” vulnerability (CVE-2018-12895) which we addressed last week Pagely implemented a patch to address this vulnerability on all customer websites, as there was no WordPress.org patch available when the vulnerability was publicly disclosed. Pagely customers can request to be upgraded to patched versions of WordPress over the weekend, all customer sites will be upgraded by early next week. WordPress Author Arbitrary File Delete (CVE-2018-12895) We trust our authors, to not delete files, but let’s not allow it. RIPSTech researchers Slavco Mihajloski and Karim El Ouerghemmi reported yesterday of a vulnerability in WordPress core which would allow users on a WordPress site with Author level access or higher the ability to delete and/or re-upload any file writable by the PHP process WordPress runs under. The limitation of this vulnerability hinges on the fact a malicious user must also be someone a site owner trusted with having author level access already (or a compromised author user account could be abused) The consequence of this vulnerability would be that an attacker or malicious user could potentially remove files on the server, which may disable protections (such as .htaccess files, or security plugins), or allow them to re-write a site’s wp-config.php (to point your site at the attacker’s database, or install their own credentials/secret keys.) Our infrastructure configuration does not allow PHP processes to be able to modify any WordPress core files, however the risk of modifications to plugins, .htaccess files or other user uploaded files remains. To address this we have implemented a recommended hotfix which sanitizes the file path in the attachment delete/modification function used by WordPress core. The patch implemented has been tested and verified as safe and will be pushed out to our customer servers this week. If for any reason this hotfix causes issues with your site user’s ability to remove or edit media on your blog, please let our support staff know and we can help sort out the problem. PHPMyAdmin File Inclusion and Remote Code Execution (CVE-2018-12613) (PMASA-2018-4) Admin your DB with php, securely. We did the upgrade Pagely customers who have phpMyAdmin configured on their servers can rest assured we have taken steps to upgrade all of our customer’s phpMyAdmin installations to address multiple vulnerabilities recently reported. TLS 1.0 Retirement It’s been a long time coming, so break out the gold watch and cake. TLS 1.0 is finally being retired across the web thanks to the push by PCI-DSS. Pagely is updating our customer websites this week to address this and will be supporting TLS 1.1 or higher by default on our servers this week. By default, customer websites will only communicate over HTTP using the more secure TLS 1.1 and 1.2 protocol versions, and TLS 1.0 will no longer be an option. The reason for the change has been a long time coming. There are multiple browser based vulnerabilities in TLS 1.0, and the protocol version has been depreciated for years. However, the big deadline is that PCI-DSS counsel has set a hard deadline for June 30th, 2018 as the final day that sites will no longer be able to pass PCI scans if they have TLS 1.0 enabled in any manner. The impact of requiring TLS 1.1 or higher, is almost certainly going to be negligible. Every major browser supports TLS 1.1 and 1.2, rough estimates put less than 4% of the global internet traffic as using a browser that only support TLS 1.0, this is mostly composed of old mobile devices. So, sorry everyone on a dated iPad or Android tablet/phone, it’s not safe for you to transmit data over HTTPS and hasn’t been for a long time! Luckily, this number continues to drop every year, as these old devices eventually get replaced or taken out of service. Pagely Login Page Updates Pagely customers will notice something new when accessing their Pagely administration panel https://atomic.pagely.com on May 31st 2018. Our new login portal! Don’t worry, this change is expected as we are rolling out some improvements to our administration panel and preparing for it’s replacement. When you visit https://atomic.pagely.com your browser will automatically be redirected to our new version of Atomic. You may see the words “BETA” here and there, and some customers (those already upgraded to ARES) will have new features available as well. There is nothing you need to do on your end at this time, your login will function as normal and the new atomic panel has all the same basic features as the old one — If you’re feeling a little nostalgic, you can still switch back to the old Atomic panel by hitting the “Atomic (Legacy)” button found in the panel. In the near future we will be offering a new 2FA feature to give our customers a better experience with their 2FA management, but this first login portal change on 2018-05-31 will not affect your existing login credentials. PHP Security Patch (CVE-2018-10546 CVE-2018-10547 CVE-2018-10548 CVE-2018-10549) You need a null byte; Or you get heap overflows! MakerNote take Note. PHP has released a security patch which addresses four security vulnerabilities, the worst of which is a heap overflow from uploaded images which lack null bytes or corrupted EXIF data in MakerNote files. Further details available in the PHP 7.0 Changelog and PHP 5.6 Changelog. Pagely has begun upgrading customer servers and all PHP versions will be on patched in the next few days, if not already. WordPress 4.9.5 Release Secure hardening in the four nine five release; Other bugs fixed too. WordPress version 4.9.5 has been released and is considered a security and maintenance release. The WP core team addressed 3 security related bugs which are not critical security bugs, but improve the code’s overall security. You can read more about the release here. Pagely will begin updating customer sites to 4.9.5 shortly. POP-ping WordPress Object Injection? DNS must be trusted. Or else, oh no! Hacks! Researcher Nick Bloor (@nickstadb) recently released a report on object inject+DNS vulnerabilities in WordPress which could lead to remote code execution/arbitrary file uploads to sites. Nick explains that if attackers control the name servers the website uses to lookup domains, then it’s possible to “spoof” being the WP update server due to WordPress defaulting to HTTP communications when HTTPS fails during updates. This report outline that if attackers were able to take control of a DNS server, they could pivot that access to then also take over WordPress website via the WordPress auto-updater as well as exposes a PHP Object injection as well. Pagely customers are not affected by this vulnerability, as we are a managed host and do not allow modifications to what name servers our customer’s servers utilize. Secondarily, our server permissions would not allow WordPress auto-updater to function on it’s own (we handle upgrades for customers), this is identified in the “caveats” section of the vulnerability disclosure page as a preventative measure. WordPress load-scripts.php DoS (CVE-2018-6389) Feb. 6, 2018 Loading all the scripts, leads to long web responses. Rate limiting, Win. We are aware of the reported Denial of Service (DoS) affecting WordPress’s /wp-admin/load-scripts.php; Assessing the risk we believe our caching system dramatically reduces any DoS threat targeting a single URL with scripts like this. We are implementing a fix which is currently in testing, it will limit the number of requests people can make to this file before being throttled and subsequently blocked. This fix will be available for all customers, including those on the new ARES platform. WordPress Security and Maintenance Release: 4.9.2 Jan. 16, 2018 Other people’s code How did it get on your site? Sad emoji face. WordPress version 4.9.2 has been released and it contains an update to address an insecurity in the Media Elements library, which is included in WordPress core. The patch addresses a cross site scripting (XSS) vulnerability, which could allow remote attackers to inject their own HTML onto your site. Pagely will be patching customer sites immediately, and should be finished shortly. If you would like to read more about this release please see the WordPress blog announcement here. Spectre and Meltdown Jan. 5, 2018 Reading memory, outside of your privilege. Time to patch kernels. [Update: Feb 2, 2018 CST] Our kernel hotpatch provider has released a working patch for Meltdown as well, and it has been applied to all customer servers. [Update: Jan 18, 2018 09:00 CST] Spectre: Patched without the need for a reboot Meltdown: Patch available if you request a reboot, we are still waiting on the no-reboot patch which is close to being tested as safe to apply. If you are concerned about the risks associated with Meltdown, contact support to request a server reboot. Or wait until our no-reboot patch has been tested and is working safely. Risk associated with Meltdown: There are still no PHP based proof of concepts, therefor we consider it a low-likelyhood that anyone (aside from someone with SSH access to your server) would be able to perform this attack on your site/server. If you disagree with this risk assessment, then please contact support and we will schedule a reboot to apply the patch for Meltdown ASAP. [Update: Jan 11, 2018 11:30 CST] Our kernel patch provider has released a working patch for Spectre, but not Meltdown. We will be applying the Spectre patch to all servers before the end of the week, and will be awaiting their patch for Meltdown when it becomes available. If you would like to hasten the patch time, we can apply the kernel patch from Ubuntu (released yesterday) however this will require a schedule reboot for the change to take affect. If you would like to schedule a reboot of your server, please contact our support staff from your account’s primary contact email address (or via our administration panel) These patches are known to cause a negligible performance hit on servers when applied. It’s likely you will not notice this performance hit on your site unless your code does a large amount of system calls and/or you are already close to needing an upgrade. Our engineers are working on a solution to this issue and we may be able to work with customers impacted to entirely remove this performance hit or actually come out ahead. [Update: Jan 9, 2018 09:00 CST] At this time (Tuesday January 9th) we do not yet have a stable patch to apply to customer’s servers. The patch plan for early this week was not met. This was due to the complicated nature of this patch, and ensuring a stable patch is what is pushed out to servers. It’s been identified by multiple sources that this patch is not the simplest, concerns of stability and CPU overhead come up and this has delayed the patch from either Ubuntu (our operating system) or KernelCare (our kernel patch provider). Risk assessment: The existing proof of concepts for these vulnerabilities are not executable against our customer’s sites due to how our PHP is configuration (we restrict/ban any exec/shell calls) which reduces the risk of this vulnerability. Only customers with compromised SSH accounts would be vulnerable (and if there does exist a PHP PoC in the future, only customers with compromised sites would be exposed.) We are delaying the patching process. This decision is made under the consideration that many people are reporting issues with the patches available, and the lower risk this vulnerability has at exploiting WordPress sites on our network. Tentative timeline: We expect patches from one of the upstream providers (Either KernelCare or Ubuntu) tomorrow, Wednesday Jan 10th, however this may be delayed. When a patch is available, if it is Kernel Care, no reboot will be required. If it is Ubuntu, then we will need to reboot your server for the change to take affect. We will begin applying patches for customers this weekend or next week (a few days after the patches are released so we have time to test the patch sets.) We will contact customers via email to schedule a reboot, if it will be required to apply this patch. [Original post] Pagely is aware of the multiple related vulnerabilities in Intel (and other) CPUs known as “meltdown” or “spectre” and has been working on patching affected servers. This vulnerability is a bit different than most, as it requires patching done on the bare-metal server as well as a second round of patching on our virtual instances for Pagely customers. Our data center provider notified us regarding what servers were affected by a security concern and needed reboots to apply a patch. We have already been working with the affected customers on and scheduled reboots to address this security concern. It’s likely that these CPU architecture vulnerabilities were likely the cause for the scheduled reboots in December. At least check, we have address almost all of these (and the last few are scheduled with the respective customers to happen shortly.) All remaining EC2 instances are on bare-metal servers which likely have been patched without the need for a reboot (however this may change). If you did not receive an email related to scheduling reboots on your site/server, then the patch for this vulnerability did not require a reboot to take affect. If this changes, we will be on contact with any customers who need to schedule a reboot. That only leaves the linux kernel on each of our EC2 instances as a remaining concern. Luckily we now utilize a new technology in the linux kernel which allows for live-patching the kernel without the need for a reboot. This patch will be applied to all of our customers as soon as the kernel patch is officially out and properly tested. The tentative timeline for this should be this weekend or early next week (and require no reboot of the server, it should be applied seamlessly.) PHPMyAdmin CSRF Jan. 5, 2018 Click this link my friend Cross-Site Request Forgery! But not with Pagely. Over the holiday break there was a CSRF vulnerability reported with PHPMyAdmin, this class of vulnerability would allow an attacker to send malicious links to users with browser’s already authenticated in PHPMyAdmin to perform actions as the logged in user. A patch was applied in 4.7.7 to address this issue, and all PHPMyAdmin installations Pagley has have been updated. WordPress Security and Maintenance Release: 4.9.1 Nov. 20, 2017 Holidays are for: Family, eating too much, and security. Don’t worry you can stay distraction free when dining with friends and family this holiday season, knowing that we have handled this WordPress security release update for you and your sites. Instead of worrying if your site has been patched, you can be the one to bring it up at social gatherings and watch as your friends or family with WordPress sites become uncomfortable not knowing if their sites are secure or not. Pagely customers will receive the WordPress 4.9.1 security release update this week. This security and maintenance release includes patches for multiple vulnerabilities including a cross-site scripting (XSS) and XML eXternal Entity (XXE) issues. This will also officially bring all customers up to the 4.9 branch from 4.8.3, unless you’ve previously written in requesting an upgrade to 4.9 in the last few weeks. You can read more about this security release and specific details on what it includes here on the WordPress news blog, as well as more details on how we handle major WordPress releases (like 4.9) on our blog here: WordPress 4.9 Release. WordPress 4.8.3 Oct. 31, 2017 WordPress Halloween. We patch the tricks, 4 8 3 You get the treats. Boo! There is nothing spookier than a WordPress security release, the 4.8.3 patch addresses an SQL injection vulnerability in WordPress core which could be exposed by insecure coding practices found in some plugins. This release hardens the WP Core code to protect the sites who may harbor an insecure SQL query that trusts user input, sanitizing the input before it’s passed along to the database server. More information on this release can be found on the WordPress blog, details on the changes and how it modifies the return value of of esc_sql() have been posted by Gary Pendergast on the Make WordPress Core developers blog. Thanks goes out to the reporter of the vulnerability (Anthony Ferrara) for working with the WordPress security team. And a special acknowledgement to our own Arman Zakaryan for the Haiku this time around. OptionsBleed Sept. 21, 2017 Memory Leaking over OPTIONS requests sent. This patch stops the leak. The vuln-du-jour is called OptionsBleed and affects Apache2 web servers. It was caused by a programming oversight in the Apache2 server project which allowed small amounts of memory to be leaked when an OPTIONS request is sent to the web server. This bug only affects sites that are configured with a LIMIT directive which attempts to filter nonexistent HTTP methods, which is extremely rare but does exist in just under 500 of the Alexa top 1 million websites. A more detailed write up about this can be found here. The Apache2 dev team wasted no time in providing a patch. Which we have already begun applying to customer servers. We are rolling this patch out slower than a normal security patch because it’s so rare for this misconfiguration to exist and initial reviews of customer sites shows no Pagely customers have misconfigured LIMIT directives which would put them at risk. That said, the patch will be applied in a safe manner over the next week as to minimize any risk of downtime on customer sites related to the upgrade. WordPress 4.8.2 Sept. 19, 2017 Within this release, Nine security patches. Sites are now secure This week brings a security update to WordPress core. The security patches include multiple serious vulnerabilities and we are applying patches as soon as possible for customers. The WordPress core and security team have also released version to address any of the patched vulnerabilities for the following versions: 4.8.2, 4.7.6, 4.6.7, 4.5.10, 4.4.11, 4.3.12, 4.2.16, 4.1.19, 4.0.19, 3.9.20, 3.8.22, and 3.7.22. Any customer of Pagely running older branches of WordPress will also be brought up to date with these security patches. Malicious Code in Display Widgets Sept. 13, 2017 We coined a new term: “plugin identity theft”. Let it not catch on. A popular plugin in the WordPress.org repository has been “hijacked” (for lack of a better term) by a developer with suspicious intent. The popular plugin “Display Widgets” is described as “Adds checkboxes to each widget to show or hide on site pages“, yet in the last few releases there have been some unexpected new features added: such as adding posts directly to the site and tracking site visitors. Wordfence, a security plugin, wrote a full explanation on how this might have happened, it’s worth a read here. For our customer’s safety, we have banned the plugin from our customer sites. If your site hosted with Pagely was affected we have already reaching out directly to help you with the concern. More information about the issue at hand with this plugin can be found on WPVULNDB and in the plugin’s support forum . Update: The plugin team at WordPress.org have released a patched version of Display Widgets which reverts it back to the last known safe version, but there appears to be no author to continue maintenance on the plugin. The plugin will remained banned on our network until a time that we see someone has taken responsibility for the plugin and the future of patching it’s code. Which plugins and themes aside from display-widgets should you avoid? See our full list here. WordPress 4.7.5 Release May 17, 2017 Patchy patchy patch I love patches for WordPress Here come the patches Pagely customer sites are being updated to address 6 vulnerabilities. The ExploitBox Unauthenticated Password Reset Vulnerability has still not yet been addressed; Pagely customers are still not affected. Further details on this release can be found here: wordpress.org ExploitBox’s CVE-2017-8295 May 5, 2017 Return to sender sending to the wrong domain read from HOST header. There was a recently released authentication bypass vulnerability that affects WordPress before and including 4.7.4, with specific server configurations. The attack requires a request to a WordPress site via it’s IP address, while the attacker sets the HTTP request header to their own HOST value. Pagely does not allow direct access to WordPress sites via IP address and requires the HOST field sent in the headers to be the actual site being requested, thus a request with a HOST value controlled by an attacker will not be directed to a WordPress installation at Pagely. Bonus Haiku: Pagely hosted sites are not affected by this reported exploit. For more details on the vulnerability and how it works, please read: https://exploitbox.io/vuln/WordPress-Exploit-4-7-Unauth-Password-Reset-0day-CVE-2017-8295.html WordPress 4.7.3 Security Release Mar. 6, 2017 XSS and more bugs get patched in this release. The update is done Customer sites are being updated to address 6 security related issues. Further details on the release can be found here: wordpress.org CloudBleed, Shattered, CVE-2017-6074 Feb. 28, 2017 SHA One Collision CloudFlare Leaking Memory and Kernel Patching Normally these Haiku’s are short and sweet, but it was a busy week for security in the headlines last week so I took a little more time to compile the following information for you: The CloudFlare Bug (A.k.a. “let’s not call it CloudBleed”) A security researcher working for Google’s Project Zero disclosed information on a bug identified in CloudFlare’s services. The bug was in CloudFlare’s services, and in some cases resulted in a trace amount of the contents of the CloudFlare’s servers memory being leaked. This could have had major repercussions as the contents of these servers may contain sensitive information being sent to or from the web server behind CloudFlare’s services (such as passwords, encryption keys, or other sensitive data.) Many news outlets reported this as a catastrophe, however CloudFlare patched it’s server’s before the announcement and there have been no reports of this being attacked in the wild before the report by the Project Zero researcher. Key points include that the data being leaked was not controllable by the attacker (it was always random, including no ability for an attacker to target a specific site’s data). The data was also limited to small chunks. The leaks however, have likely been happening for a while, no one knows how much data has been leaked to people looking for it or if any widespread attacks could have gleaned any usable data from the memory leaks. Ultimately, while it’s possible every password, SSL cert, and secret keys were pulled from CloudFlare server’s using this attack, it’s not likely to be the case. Most probably: the researchers at Google’s Project Zero were the first to be aware of the problem and reported it responsibly to CloudFlare. However, it is still yet to be seen if anyone reports malicious activity caused by these leaks in the weeks and months to come. How could this affect you? If you utilize CloudFlare on your site (or utilized a service that used CloudFlare) and wish to be absolutely sure your private data (such as a password) is safe then you may want to be pro-active and change that password or other secret data. The SHA-1 Collision: (A.k.a. “Shattered”) A collision in the SHA-1 algorithm was reported by a different team at Google. SHA-1 is a cryptographic hashing algorithm, commonly used to validate the integrity of data being sent. The collision released by the team at Google showed that they were able to send two different messages but they both validated with the same SHA-1 value; ultimately meaning that data signed or verified using a SHA-1 algorithm can no longer be trusted. There is some good news however, this attack is fairly expensive to execute (over $100k) and SHA-1 has been on it’s way out for the better part of a decade. SHA-256 has already been established as the replacement and most people have already migrated to the more secure algorithm. How could this affect you? If your site has SSL/HTTPS, then that certificate might be signed using SHA-1 , but it is probably already signed using SHA-256 (as of 2015) if you would like to double check you can always utilize a utility like ssllabs.com to look up your site’s SSL certificate and see what method is used to fingerprint it. If you find you are using SHA-1 only, then the fix is to get a new certificate (most likely whomever you purchased the certificate from will issue you a new one using SHA-256 without much hassle.) Secondarily, if you developed your site’s code explicitly using the sha1 function, then you may wish to swap that sha1 function with the sha256 function. CVE-2017-6074 While CVE-2017-6074 did not have a cool name or website or lots of media coverage; it was a more serious threat. This flaw could allow anyone with access to a Linux server to escalate their privileges from a normal user to root on the server. Linux servers running up to date kernels (such as ours) were affected and we were very concerned about getting this patched for our customers. Luckily we have been updating our infrastructure and these kernel based vulnerabilities no longer require reboots to apply new patches. We applied a patch to address this vulnerability on the same day it was made available and noted no issue with the new kernel code running. WordPress 4.7.2 Security Release Jan. 26, 2017 Sites updating now we handle the patch. So you focus on your site. Customer sites are being updated to address 3 security related issues. Further details on the release can be found here: wordpress.org CVE-2016-5195 “Dirty COW” Oct. 26, 2016 We have sent many email notifications about the reboot. Kernel patches have been applied on our servers, however a restart is required for it to take affect. Scheduled reboot notification emails have been sent out and reboots will take place the week of October 31st. More information on the vulnerability can be found here: dirtycow.ninja WordPress 4.6.1 Security Release Sept. 12, 2016 The update happened faster than I could write this haiku about it. All sites have been updated to address 2 security related issues. Further details on the release can be found here: wordpress.org httPoxy Jul. 20, 2016 A pox on proxy headers; that are misused by some developers. Updates to our server configs are being pushed out that remove any “Proxy:” values attempted to be set by a request header. More details here: httpoxy.org And see also: Pagely’s Reverse Proxy WordPress Hosting WordPress 4.5.3 Security Release Jun. 21, 2016 WordPress 4.5.3 Several security issues are addressed. We are currently testing and rolling out this security update. Further details on the release can be found here: wordpress.org WordPress 4.5.2 Security Release May 9, 2016 4 point 5 point 2; Patch vulnerabilities in cross site scripting Updates on our platform are finishing up today. Further details on the release can be found here: wordpress.org CVE-2016–3714 “ImageTragick” May 9, 2016 Image conversion tragedy; is currently patched by policy. Further details: ImageTragick.com CVE-2016-2107 CVE-2016-2108 May 3, 2016 High Severity Vuln? We patched openssl, so you don’t have to. Security Haiku: CVE-2015-7547 Feb. 19, 2016 Host lookup dangers? No worry, we already patched glibc Which plugins and themes aside from display-widgets should you avoid? See our full list here.
These monthly reports are provided for the WordPress community at large from Pagely’s head of security, Robert Rowley. Rowley and the entire security team keep their finger on the pulse of any potential vulnerabilities that might affect our customers, as well as any WordPress user. We sincerely hope these efforts help any and all that could use information from the experts on monthly security issues. We commend the researches and developers that help to identify and patch these issues in a timely fashion. WordPress Core No notable WordPress core security releases. Plugin/Theme Vulnerabilities of Note bbPress By The bbPress Contributors https://wpvulndb.com/vulnerabilities/10242 https://wpvulndb.com/vulnerabilities/10243 https://wpvulndb.com/vulnerabilities/10244 https://bbpress.org/blog/2020/05/bbpress-2-6-5-is-out/ bbPress version 2.6.5 was released on May 28th. This security release addresses multiple vulnerabilities including one which affects sites with New User Registration enabled, allowing privilege escalation on newly created accounts. WooCommerce By Automattic https://wpvulndb.com/vulnerabilities/10220 There exists a vulnerability within WooCommerce, which would allow users with access to modify and duplicate products to upload arbitrary PHP code to the website, then execute it. This is an authenticated vulnerability (requiring a user account), and high risk as it would allow attackers to execute code on the server itself. Note: This vulnerability is a Remote Code Execution (RCE) based on our review of mslavco’s findings. Page Builder by SiteOrigin https://wpvulndb.com/vulnerabilities/10219 The page-builder plugin before version 2.10.16 has a CSRF (Cross-Site Request Forgery) to Reflected XSS (Cross-Site Scripting) vulnerability. Attackers could utilize this attack to target site administrators to execute code within the administrator’s browser within wp-admin. The attack targets the live editor and action_builder_content functions of the plugins. Elementor Pro https://wpvulndb.com/vulnerabilities/10214 There is a critical vulnerability in Elementor Pro versions before 2.9.4 which allows any logged-in user the ability to upload and execute PHP scripts. This vulnerability is actively being utilized with a registration bypass vulnerability which affects Ultimate Addons for Elementor (described next), allowing for subscriber registration even if registration is disabled. Ultimate Addons for Elementor https://wpvulndb.com/vulnerabilities/10215 The Ultimate-Elementor plugin before versions 1.24.2 allows attackers to create subscriber-level users, even if registration is disabled on a WordPress site. As noted, this vulnerability is being combined with the Elementor Pro vulnerability described above which may lead to remote code execution on sites with registration open and both Elementor plugins installed. Photo Gallery By 10Web https://wpvulndb.com/vulnerabilities/10227 An unauthenticated SQL injection can be executed on this plugin and it looks to target the gallery_type area of the plugin specifically. Site owners have until June 5th to update to version 1.5.55 or higher before the vulnerability details will be made publicly available. Form Maker By 10Web https://wpvulndb.com/vulnerabilities/10237 A vulnerability in this plugin allows an administrator or higher-level user to perform a SQL injection via Form Maker. Site owners should update to version 1.13.35 or higher as soon as possible, as the security researchers have stated some details regarding how to exploit this vulnerability have already been released publically. Official MailerLite Sign Up Forms By MailerGroup (x2) https://wpvulndb.com/vulnerabilities/10235 https://wpvulndb.com/vulnerabilities/10236 The official-mailerlite-sign-up-forms plugin has two vulnerabilities that have recently been reported. The first deals with the MailerLite plugin not sanitizing user input data which leaves a site vulnerable to SQL injection, this vulnerability was fixed in version 1.4.4. The second vulnerability addresses CSRF issues and was patched in version 1.4.5 of this plugin. WP Product Review Lite By ThemeIsle https://wpvulndb.com/vulnerabilities/10226 The wp-product-review plugin before version 3.7.6 is susceptible to an Unauthenticated Stored XSS attack which bypasses built-in protections allowing malicious HTML or Javascript to be stored and injected on all the site’s product pages. See previous months’ WordPress security updates from April and March.
