Brian Feeley Title: WordPress Support Engineer Who am I? In 1996, I started a high school class doing web design hosted on Geocities. I spent many years as a Business Solutions Analyst doing contract work. Then, I evolved back into web design and large scale hosting support. I’ve always had a passion for PHP and WordPress, so I decided a few years ago to specialize in that field. I ended up at Pagely in my search for the best managed WordPress host. What I do at Pagely My job consists of providing chat and ticket support. This often includes onboarding customers, conducting security assessments, repairing email and ensuring that each site meets the right requirements for success. I also like to dabble in the customer experience and quality assurance whenever new items are released by our amazing development team. When working in support and site optimization, it’s important that we collaborate with the customer or their developer to find an efficient resolution. Once we isolate an issue, we work with the full team at Pagely to achieve the best solution, whether it be custom configuration to NGINX, or adding additional object cache. One constant thought on my mind is how to limit the risk of having a web presence. A lot of time and money is involved in your little bit of digital real estate, and the last thing you want is something destroying your credibility. We spend many hours of research discovering the best solutions to common problems, and all of that information gets translated into our knowledge base. If you have a question that needs solving, spend a little time on the Pagely Support page and see if you can find your solution. Here, you’ll find everything from getting started in Atomic to how to achieve successful onboarding, staging and testing environments. If something is not covered in the knowledge base, we want to know. Send what we’re missing to support@pagely.com, and we’ll continue creating helpful articles that help each site reach its full potential.
From famous cases of forgery to instances of accidental self-plagiarism, anyone can become a victim of content theft in one way or another. Anytime you publish original content online, you become vulnerable to the threat of being plagiarized. You also increase the risk of unknowingly plagiarizing someone else. To protect yourself and your brand from the consequences of plagiarism, it’s important to do your part to prevent it. If you’re working with multiple website contributors or authors, these measures are especially important for ensuring the authenticity of your website’s content. Here, we’ll outline some of the best plagiarism checker tools — and a few essential tips for preventing plagiarizers from targeting your website. Free Anti-Plagiarism Tools for WordPress There are a number of anti-plagiarism options in the WordPress plugin directory. After testing out the most popular options, these are the ones which stand out the most. Copyfight With protection for shortcode, posts, and pages, Copyfight provides an exceptional defense against plagiarism. The plugin also prevents people from thieving email addresses, which is a unique feature among other anti-plagiarism plugins. Copyfight can be easily accessed from the WordPress dashboard and provides a seamless experience for keeping your content safe. Free Online Plagiarism Checker One downside of plagiarism is that it leads to duplicate content, which can cause decreased search engine rankings due to Google penalties. This straightforward, yet powerful app reduces this risk by making checking for plagiarism a breeze. Free Online Plagiarism Checker works directly with drafted posts in WordPress, so you can scan each post before it goes live. DMCA Protection Badge The DMCA protection badge is a great way to ward off potential thieves. Once you sign up for a free account and place the badge on your website pages, you’ll also get access to a secure portal where you can view the status of your pages. If you do identify an instance of plagiarism, DMCA offers an affordable takedown service that can eliminate the content quickly. The DMCA tool can also protect imagery and videos, making it a smart precaution for content-rich sites. Plagiarism Checkers Outside of WordPress Having a plagiarism checker within your WordPress site is an easy, efficient way to check for authenticity. But if you want to be comprehensive in your plagiarism precautions, you’ll want to have plagiarism checkers handy for everything you write. Grammarly One of the best digital writing tools to date, Grammarly provides support with everything from grammar to plagiarism. To check how your writing compares to other publicly available websites, simply sign up for a free Grammarly account and paste your content into the Grammarly Editor. Then, click the circle on the left-hand navigation bar. This will tell you if there are any other websites featuring the content you’ve pasted. While this option is only available to Premium users, it’s certainly worth the investment if you’ll be checking large quantities of content often. Copyscape Copyscape offers a free plagiarism checker that makes it easy to scan for copy theft on the web. Rather than copying and pasting specific pieces of content, Copyscape scans your entire website using just the URL. Copyscape provides additional free plagiarism resources, such as a tool that compares two blog posts or web pages for similarities. They also offer a helpful guide on how to understand your digital rights and manage online plagiarism. Final Thoughts None of these methods is foolproof, and those committed to stealing your content can always find a way to do so. However, taking measures to protect yourself is better than doing nothing. And when you use multiple tools to safeguard your site, you’ll reduce the odds of getting mixed up in plagiarism fiasco. If you have any tips for dealing with plagiarism, please share them in the comments below.
From forums and chat rooms to blog posts and conferences, the amount of WordPress support available truly is infinite; but, with so many resources at our fingertips, how does one find the answer to a simple WordPress question? To sort through all the information, it’s important to know where you can go to ask for WordPress help. This post is filled with resources on all aspects of WordPress support, ranging from the deeply technical to the inspiring and educational. The Right Host for WordPress Help What’s the first step in getting proper WordPress help? Choosing the right host. With three kinds of WordPress hosting available — single, VPS, and managed — it’s important to know exactly what you’re signing up for. Single and VPS Hosting Single and VPS-hosted sites allow for more autonomy in WordPress development and maintenance. They also require much greater independence when it comes to troubleshooting. This ends up putting the user in charge of updates, security, and other support aspects. Managed Hosting If you’re not keen on the idea of solving every WordPress problem on your own, consider the benefits of managed WordPress. Essentially, managed WordPress is a service that maintains all technical aspects of maintaining a WordPress website. Managed hosts handle important details, like security enforcement, malware scanning, and instant software updates. They also improve site reliability, increase speed, conduct daily backups, and monitor downtime. Most managed hosts also offer technical support, so no need to worry about getting your questions answered. Managed WordPress provides the most balance in terms of both customization and support. How? Because delegating these essential, yet time-consuming tasks allows you to get more involved in the WordPress community. Ask questions, generate discussions, and learn more about the ins and outs of the world’s favorite CMS. Unless you’re skilled in technical support, it’s in your best interest to adopt managed WordPress and let experts work for you. WordPress Technical Support To get started with technical support, you can check out the two main forums on wordpress.org. Browse the main support page or you can head to the how-to and troubleshooting page for problems after setting up WordPress. WordPress.org also has its own requests and feedback forum where you can see similar questions, or ask your own. To make sure you ask questions that solicit helpful answers, check out this article on how to write a great WordPress support request. If you’re looking for a quick answer to an error message, this Codex page shows users how to search by keywords in a WordPress error message for more effective search engine searches. Additionally, WordPress.tv has a number of great support videos on a wide range of topics designed for both novice and expert WordPress users. In this video, Justin Ferriman shows how to get support for premium themes and plugins. Plugins are another factor to consider when it comes to technical WordPress help. Installing the right plugin might be the answer to your problem. For example, you might wonder how can you reduce server load to make yo ht be the answer to your problem. For example, you might wonder how can you reduce server load to make your website faster? You will find the answer to this, as well as many others challenges, in the expansive WordPress plugin gallery. To narrow your plugin search, here’s a roundup of WordPress plugins for business websites, and 37 essential WordPress plugins you should know. Also, this impressive list of 200 plugins, curated by 40 global WordPress experts, will get the job done. WordPress Design and UX Support If you’re new to WordPress, the level of visual customization available will suprise you. This also is a little overwhelming. These resources will help you solve issues that may arise while editing visual elements of your site, such as your theme, logo, and photos. For some initial inspiration, you might want to check out the Awwwards website. Awwwards has a panel of web design experts who judge and curate website submissions from around the world. The Awwwards WordPress page has over 1,900 websites that can inspire your new design. Each submission is tagged with different keywords, so you can filter through the submissions based on a certain design element or theme that’s relevant to your project. The next step after choosing a theme is learning how to customize that theme the right way. Even if you’ve got a firm grasp on HTML and CSS for theme customization, there’s always more to learn. This guide on how to customize a WordPress theme is a comprehensive place to brush up on theme questions. It also has a special page dedicated to rookie mistakes, which is definitely worth checking out no matter how advanced you are. Help From The WordPress Community One of the biggest benefits of WordPress is its amazing, worldwide community eager to answer questions and offer support. The official forum is a wonderful resource and many questions that you have will already have answers. If you want a more casual environment, the Facebook group “WordPress, SEO and Internet Questions” is a great resource. With over 16,000 members and a well-defined set of guidelines for interaction, your questions will get answered promptly and honestly. If you’d simply like to expand your knowledge on how to make the most of WordPress, check out Post Status. The website is full of podcasts and articles covering all things WordPress, ranging from insightful expert interviews to helpful posts on choosing plugin libraries and frameworks. WP Tavern is a community website that seeks to leverage the best of the WordPress community in order to generate riveting conversations about WordPress news. One of the ways we stay up-to-date with WordPress is to sign up to the WpMail newsletter, a weekly roundup of WordPress news, tutorials, videos and more. Creating a Recovery Plan Whether your website goes down, you fall victim to a hacker, or any other disaster scenario, it’s important to have a plan in place. Adopting a managed WordPress host is the best possible way to avoid these issues; however, it’s important to have a step-by-step action plan if any problem arises, with or without a managed host. This disaster recovery plan for WordPress has great tips for identifying and solving problems quickly. With the resources mentioned above and help from the WordPress community, WordPress support is never far from reach.
Higher domain authority. Improved brand visibility. Increased traffic and conversion rates. You understand the benefits of a WordPress content marketing plan, but where do you start? You could just create whatever content you feel like without a strategy, but that’s a dangerous playing field. To create a content marketing program that’s truly successful, it’s important to have a strategic plan. Devising this plan starts by knowing about the features, tools, and plugins designed specifically to help people like you excel at content marketing. Follow these four steps to plan, execute, and track a successful content strategy, plus learn the best tools, tips, and tricks for generating more leads through your content. 1. Determine your Content Marketing Goals The first step in creating a successful content marketing campaign is determining what you want to accomplish. The topics you cover and the types of content you create will all be determined by your end goal. If you want to capture more email leads, for example, you’ll want to create more long form content that you can gate behind an email opt-in page. If you want to simply generate more shares and increase brand awareness, you might test catchy blog headlines and focus more on visual content that’s easily shareable on social media. To show you how to set and achieve a business goal through WordPress content marketing, we’re going to choose one of the most common business goals as an example. Since all businesses require more sales to survive, we’re going to focus our example on attracting prospective customers, or qualified leads. To attract potential customers to our site, we’ll need to create informative, SEO-optimized blog posts, plus drive interest using social media. Once we attract potential customers, we’ll want to capture contact information for potential leads. To do this, you need to create an opt-in form, or squeeze page, that entices people to provide their contact information. Now that we understand our main goals — and how we’ll achieve them through specific types of content — it’s time for some research. 2. Conduct Keyword Research When you’re creating a WordPress content marketing strategy, it’s important to use keyword research both for post ideation and content theme creation. WordPress makes it easy to create categories, which help organize content for the reader and diversify your blog’s content. To create categories and content that attract people’s attention, you need to learn which topics, ideas, and questions are most prevalent in your industry. What terms are potential customers searching for? What questions are your target market asking? To answer these questions, you need to develop a keyword research strategy. We’ve already written about how to conduct keyword research using Google Keyword Planner and Market Samurai. You can also conduct keyword research without leaving WordPress at all. RB keyword research is a plugin that leverages Google’s autocomplete functionality. This plugin shows you which phrases are most commonly typed into Google using a given keyword, so you can discover new keywords related to the ones that are already on your radar. Once you’ve installed and tested a combination of keyword tools, it’s a good idea to set up at least 4-6 categories for each post to be filed under (remember: you can always add more later). 3. Devise Content Ideas Brainstorming content can be a daunting and inefficient process. Refer to the content brainstorming key, or try using Buzzsumo, one of the best tools for understanding which topics are gaining the most traction at any given time. Simply search for a topic and you’ll see what was most shared, who shared it, and what medium they shared it on. Another handy ideation tool comes from CoSchedule — we’ll go into more detail about CoSchedule’s content scheduling tool below — but for now let’s take a look at the headline analyzer. This free headline analyzer for WordPress provides a succinct analysis of your proposed headline’s structure, grammar, and readability. It shows you exactly how to improve your headline for greater click-throughs, and it can be a great way to tweak new content ideas to improve their success rate. If your WordPress content marketing strategy is going to involve an opt-in form for long form content, brainstorm eBook and whitepaper ideas that might entice your audience, based on the keyword research you’ve already conducted. If you’re not going to include long form content but you’re still focused on generating new leads, try brainstorming email newsletter ideas based on the topics your target audience is interested in. It’s a smart idea to install an opt-in plugin before you start publishing, so you can capture all potential leads from the very start. SumoMe and Optinmonster are two of the most popular WordPress plugins for opt-in boxes, and both can be customized to meet your needs. 4. Schedule and Track Once you’ve developed at least a dozen content ideas, you need to determine when they’ll be posted. This may require some guesswork at first, and it’s a good idea to test out different posting times on different days of the week to see which times your audience prefers. To keep your content consistent and well-varied, use CoSchedule’s editorial calendar. The tool allows multiple teams to collaborate in the same calendar, and it also has capabilities for social sharing, so you can manage all of your publishing and social sharing directly from the WordPress platform. While scheduling your content and planning its promotion, remember to maximize the ROI of a single content piece through strategic repurposing. This is a great way to drive revenue with the resources you have available, especially when you’re just starting out in the world of content marketing. After your posts have been written and scheduled, the last thing you need to do is track your content. The free version of Google analytics is perhaps the best place to start for tracking events, analyzing your content, and assessing specific areas of improvement in your content marketing plan.
There’s no denying that WordPress is one of the most powerful website hosting platforms on the market today. It offers extensive SEO capabilities, robust security, and all the customization features a website owner might need. WordPress also has a worldwide community of developers, bloggers, and experts dedicated to growing and improving the open-source platform. However, businesses looking to adopt WordPress should first distinguish the difference between managed WordPress hosting and unmanaged, or shared, WordPress hosting. Understanding the nuanced benefits of managed WordPress hosting can help you make the best choice for your business website. What is Managed WordPress Hosting? Managed WordPress hosting is a professional service that controls and maintains the technical elements of a WordPress website. Managed WordPress hosts are a more sophisticated option for businesses and institutions in all industries, offering invaluable advantages, such as cutting-edge security, superior customer support, optimal site speed, improved performance, and a variety of other benefits. Unmanaged vs. Managed Hosting While unmanaged hosting is traditionally less expensive than managed WordPress hosting, unmanaged sites often offer minimal features and require much more work to create and maintain. The minimal nature of unmanaged WordPress hosts can be a great option for individuals, bloggers, or independent contractors looking to create a personal website or establish an online presence. It can also help engineers and other individuals who want to learn more about WordPress development and customization. For businesses trying to grow their brand and expand their audience reach, however, managed WordPress is a much more effective and reliable option. Why? Because managed WordPress hosts like Pagely oversee the more challenging and technical aspects of a WordPress business site. For example, managed hosts conduct routine backups, monitor site downtime, and ensure speed and reliability. Managed WordPress sites almost always guarantee faster site speeds, despite the amount of traffic your website receives. And with automatic updates, you’ll always have the most up-to-date version of WordPress — without having to spend time checking for updates and waiting for downloads. With the specific knowledge and skills required to manage such technical elements, managed WordPress hosts provide business owners with a hassle-free experience and piece of mind. As a result, investing in managed WordPress frees up resources that website owners can dedicate to other key areas of business development. What are the benefits of managed WordPress hosting? The number of sites relying on managed WordPress has grown rapidly in the last seven years, and it has become a dominant content management system for companies of all sizes and industries. And if you’re considering a managed WordPress host for your company, it’s important to understand the main differences between managed hosting and unmanaged hosting. Here’s a more detailed look into four key benefits of managed WordPress hosting. Site Security One of the most beneficial aspects of managed WordPress hosting is that it offers unparalleled security. With an unmanaged WordPress site, for example, you’re responsible for finding the right tools, scans, and updates you need to keep your site secure. This might work if you’re a one person team who has experience in malware and file scanning and DDoS mitigation. If not, no problem. Managed sites implement the highest level of security on your site, plus they’ll conduct daily backups, malware scans and frequent updates that prevent hackers from disturbing your website. Uptime Monitoring The speed and performance of your WordPress site has a direct impact on your search engine rankings and your user experience. So when your website experiences slow speed, downtime, or other performance issues, it’s important to identify and remedy these issues promptly. Most managed WordPress hosts offer 24/7 website monitoring, so business owners don’t have to worry about checking their site’s performance at every waking moment. For busy business owners who want to maintain a strong reputation and customer experience, performance monitoring is a huge plus of Managed WordPress. Customer Support When you invest in managed WordPress hosting, you’re paying for highly-skilled support agents that can assist with all your needs 24/7. Managed WordPress hosts train support technicians who can understand the technical nuances of WordPress, helping to solve both common and complex problems. For example, Pagely equips every member of its support team with a comprehensive skill set and contextual client knowledge. Every person who calls Pagely support receives consistent, high-quality support tailored to their website’s specific needs. This is just one example of how technical support differs between managed and unmanaged WordPress. Customizable Hosting Solutions Most managed WordPress hosts have the customization capacity to support all industries, from higher education, to eCommerce companies, and everything in between. If you’re in the healthcare industry, for example, Pagely supports regulatory compliance statues like HIPAA. If you’re an online retailer, you can protect cardholder security through PCI DSS support. Additionally, managed WordPress sites can be a great solution for agencies. By managing critical site elements like server management, speed tuning and caching, agencies can launch creative work confidently and securely. Choosing a Managed WordPress Host Once you’ve decided that managed WordPress hosting is right for you, it’s time to choose the right provider. And while many managed WordPress hosts are designed to support a variety of industries, every website’s needs are unique and some hosts may meet your needs better than others. This article features reviews of managed WordPress hosts, and it’ll provide you with some industry-specific details. If you’re new to managed WordPress hosting, this is a great place to start learning about the marketplace.
Generate qualified leads. Increase conversions. Drive revenue. These three initiatives are at the top of every digital marketer’s to-do list. They’re also incredibly difficult to achieve. Generating leads is so difficult, in fact, that 65% of marketers say its the single biggest challenge they face (according to HubSpot’s 2016 report). If you’re like these marketers and you’re discouraged with your lead generation struggles, don’t give up just yet. We’re here to explain how you can increase qualified leads with squeeze pages–a type of landing page specifically designed to capture customer information for the purpose of lead generation. Here are 4 steps to planning, designing, launching, and tracking effective squeeze pages. 1. Campaigns That Provide Value Many marketers see squeeze pages as an opportunity to promote their product. This is an ineffective approach because it fails to provide value. And if people don’t see any value in what you’re offering them, why would they provide their contact information? To craft a campaign that’s perceived as valuable, you must consider your buyer personas. What are their implicit motivations for buying your product? Maybe they want to improve their performance at work, or maybe they’re motivated by something more personal. Understanding these types of personal motivations and desires is essential for connecting with your audience on an emotional level. These same considerations are important for helping you decide what type of content you gate behind your squeeze page. Whether it’s an eBook, a white paper or a case study, allow the needs and desires of your audience to guide you. 2. Your Audience’s Pain Points The most effective squeeze pages guide visitors through a three-part sequence: pain, understanding, and solution. To see how these three parts work together in action, take a look at how Oz Content targets its audience’s pain points. On the squeeze page for its eBook “The Content Gate Debate,” Oz Content attracts the reader by relating to a pain point in the very first line: “Many marketers don’t know when to gate content and how to best capture leads.” This relates to Oz Content’s target audience (marketing professionals) in a simple, yet powerful way. Next, Oz Content generates intrigue and excitement by planting a seed in the reader’s head: what if we reframed this age-old question? Lastly, a squeeze page has to provide a tangible solution to the audience’s pain. As an InVision article suggests: “Show them how much better life could be if that pain were fixed. See them out of the nightmare and into the dream.” Oz Content shows its audience out of their nightmare (confusion about gated content) with this powerful line: “It’s not about whether to gate content, but rather, where, when, and how to gate content for maximum lead capture and B2B lead nurturing.” Intriguing, right? This sequence is followed by a summary of the piece’s key takeaways. Bullet points are a great way to help viewers quickly grasp what the content has to offer. And while you do want the reader to understand why they need the offer, you don’t want to give away so much information on the landing page that the offer isn’t helpful. Effective squeeze pages balance informative statements with points of intrigue, leaving the content to reveal a few golden nuggets that delight the reader. 3. The Use of Minimal Design Getting people to your landing page is an incredible feat, but it’s only half the battle. For visitors to give up their contact information, it’s key to minimize distractions. Be sure to eliminate all extra links, buttons, and navigation capabilities that can lead your audience astray. Just take a look at this landing page example from life coach Marie Forleo. This landing page promotes Forleo’s award-winning audio training with a crisp gray background and clean, modern design. As you can see, visitors only have two choices here: to fill out the form or exit the window. Reducing the number of choices is a great strategy for increasing signup numbers. Forleo’s minimally designed page also raises a common industry question: how many form fields do effective squeeze pages have? Rather than relying on a magic number to answer this, consider the main goals you’re trying to achieve. For companies who want to increase lead quantity, it’s a good idea to stick with just one or two form fields. Companies who prefer quality over quantity may want to include more details, like company name and job role. 4. Testing and Tracking for Optimization After you’ve assembled your page with effective copy and compelling design, it’s important to check for consistency across language, design, and visual elements. Is your body copy aligned with your headline and CTA? Do your visual elements align with the piece of content being offered? If your squeeze page is tied to an email or social media campaign, be sure to check for consistency there as well. After evaluating your squeeze page for consistency, it’s critical to test your page elements for optimal conversion. There are many A/B testing tools for WordPress that make it easy to evaluate different elements on your site. If you’re new to landing page testing, consider these three areas: Headline Create a handful of varying headline options to see which language best resonates with your audience. Also, try different combinations of font colors and sizes to determine if that has an impact on conversions. CTA Copy Try testing different actionable phrases like “Get started!” and “Get my free eBook!” to get a feel for what language your audience prefers. CTA Style Whether your squeeze page has 3 calls to action or just one, it’s important to test their visual appeal. Implement different shapes and button colors in individual tests to see how they perform. If you’re new to A/B testing, remember that many tools offer advanced analytics functionality, such as heat mapping and custom reporting, which simplify the process considerably. If you enjoyed this post on creating effective squeeze pages, check out our three-part series on content marketing strategy.
From generating qualified leads to boosting SERP rankings, a successful enterprise WordPress site must achieve a balance between driving sales and generating brand awareness. For corporations that want to take advantage of all WordPress has to offer, there are a handful of questions that typically come to mind. Will WordPress scale to meet our needs? Is WordPress secure enough for our brand? How do we incorporate marketing efforts into our WordPress site? If your team is asking questions like these, it’s important to understand what capabilities and features WordPress offers specifically for large corporations. Let’s take a look at the 5 elements of every successful enterprise WordPress site: speed, uptime, security, conversion, and marketing. 1. Speed Website speed and bounce rates are directly correlated: the longer a website takes to load, the more likely it is to have high rates of page abandonment. A slow website turns away potential customers and signifies a poor user experience, which causes Google and other search engines to rank that site below competitors with more nimble loading times. You understand that speed affects your SERP ranking, but how can you create a faster website? One feature that’s considered a must amongst enterprise WordPress users is page caching. Caching essentially speeds up your website to a global audience by reducing the amount of information that needs to be processed between the website’s server and the end user. While there are a handful of great plugins for improving caching on a small scale, large companies with high-traffic websites require more complex server caching systems. Some managed website hosts offer geo-caching and geo-replication mechanisms, which are designed specifically to speed up WordPress sites for a more efficient user experience. Pagely uses NGINX full-page caching to accelerate the front end and Redis object caching to accelerate backend database access. Contact sales to learn about what we can do in terms of setting up shared geocache nodes to give your global visitors a faster user experience. 2. Uptime Unplanned website downtime is one of the most frustrating things that can happen for a high-traffic business website. But since downtime is bound to happen at some point or another, it’s important to be prepared for when it does happen. The best way to prepare for downtime is to adopt a form of uptime monitoring that minimizes the extent of downtime periods. Choosing the right uptime monitor for your business depends on how much traffic your website receives daily. While basic tools check your website’s uptime every 5 minutes, for example, you probably want advanced functionality that will monitor your website 24/7. Many tools are also equipped with automatic alerts, which is the most efficient way your team can learn about downtime (and the quickest way you can get your site up and running before angering more customers). Some uptime monitoring tools on WordPress also provide businesses with critical insights into how their website’s user experience is impacting conversions. For example, you may learn that a shopping cart is malfunctioning, or that there’s a problem with your opt-in form. This is especially important for websites with global audiences, because it sheds light on how user experience translates into different languages. 3. Security Security is perhaps the biggest concern of large corporations using WordPress, and rightfully so. One thing to keep in mind is that WordPress is constantly reforming its security features. It’s important to update WordPress every time a new version is available, as this will ensure that your site has state-of-the-art protection at all times. Pagely keeps the entire software stack updated from the machine kernel up through all core services to the plugins and wp core files. Corporations with hundreds of internal users will want to take a preventative approach to securing user accounts. One way to prevent security threats on WordPress is to adopt multi-factor authentication, also known as MFA or 2-factor authentication. This system prompts all of your website’s users to enter an additional verification code every time they log in. This safely verifies everyone’s identity and helps prevent hackers from breaking into your website. Google Authenticator is one commonly used tool that sends a unique verification code to each user through a mobile app. We offer 2fa as an option for all users on their Pagely admin. Another way to make your WordPress site more secure is to use a web application firewall. Industry standard firewall mod_security uses a set of rules to prevent common threats like code injection attacks. Large corporations should consider the benefit of managed WordPress hosts, which offer built-in security features that conduct all security measures, including screening for malware, conducting bot scans, preventing brute force attempts, and more. At Pagely we’re constantly monitoring new exploits and baking rules into our software firewall as well as our malware scanning process so that you’re protected and benefiting from the collective intelligence and surface area of thousands of customers. 4. Conversion Your corporation’s website is an extension of your sales team, and it should succeed at creating memorable brand experiences and generating leads. To understand how your marketing efforts impact conversion rates, it’s essential to take advantage of conversion tracking. This offers detailed insights into what steps a visitor takes on your website, from the first time they land on your homepage until they take a specific action. The key here is to focus on a specific conversion feature and then track it to better understand user behavior. For example, you might want to use tags to determine how often a certain link is clicked, which CTA buttons get the most hits, and whether or not people are using your social share buttons. When you have access to this information, you’ll be able to optimize your site for more effective conversions. Before the conversion though you ideally want to be tracking all the lead sources you control via UTM parameters. If you’re not familiar with this practice see this primer we wrote on using UTM parameters to track attribution. It’s also helpful to combine your conversion tracking and analytics data in the same dashboard. This is not only easier for everyone, but also more secure. Automatic tag managers like Google Tag Manager allow developers and marketers to create, edit, and delete conversion tags from a single location, without having to access or edit code. Keeping your code secure enables marketers to focus on conversion tagging strategies without compromising security. 5. Marketing After gaining information about how visitors interact with your site, it’s important to offer content that provides value and converts customers. Generating qualified leads starts with an effective marketing lifecycle — the ability to create valuable top-of-funnel, middle-of-funnel, and bottom-of-funnel content is key. WordPress makes this easy by offering customizable features and plugins for every stage of the buyer journey. To generate awareness from your blog, for example, you can implement a scroll-triggered opt-in form that encourages users to sign up for your newsletter. One free plugin that allows you to create a lightbox pop-up is called Pop-Up CC. WordPress also offers many plugins for creating landing pages, such as Unbounce, LeadPages, Thrive Landing Pages, and Optimize Press. Here, you can host informational middle-of-funnel content like eBooks and white papers behind a gated page that captures visitor information. When it comes to bottom-of-funnel content, you can use the conversion tracking tips listed in tip 4 to test the effectiveness of a “get demo” or “contact sales” page. To learn more about hosting your corporation’s website with Pagely, visit our page on enterprise WordPress hosting solutions today.
This article covers our public notifications related to major security issues our clients and the WordPress community should know about. We are always focused on prevention and the mitigation of risk to our clients, and keeping you updated here is part of that process. List of Vulnerable Plugins During This Month Plugins Removed From the Repository WordPress security team decides to close a plugin when a security issue is found and the developer doesn’t release a patch in a timely manner. You can read more about this here. If you are using one or more of the above plugins we recommend deactivating them until the developer releases a patch for the mentioned vulnerability or consider a more reliable alternative. Relevant Vulnerabilities Ti-woocommerce-wishlist : Authenticated WP Options Change A critical vulnerability was found in this plugin that when exploited allows an attacker to: Change the site options Create malicious redirects Escalate privileges (login as an administrator) This issue was resolved in the free version 1.21.12 on October 16, however when checking the premium version we noticed it was still vulnerable and was finally resolved on October 28 after we reported it. More details here. WPBakery Page Builder : Authenticated Stored XSS WPbakery Page Builder former Visual Composer had a medium vulnerability in versions before 6.4.1 that was only exploitable by high privilege users. Nevertheless we recommend all its users to update to the latest version. Loginizer : Unauthenticated SQL Injection Loginizer had an unauthenticated SQL Injection in versions before 1.6.4 caused by a lack of filtering before executing a database query. An attacker just had to craft a request with a malicious username. More information here.
Pagely is thrilled to announce our partnership with Object Cache Pro. Utilizing state of the art compression technology, Object Cache Pro is now part of Pagely’s core offering, and available to all of our customers, platform wide. Offering major cost savings, access to some of the world’s best technology, and a dedicated DevOps team to personalize your setup, Pagely customers can look forward to continued scale and growth, with no hosting friction. A first of its kind partnership, Pagely is proud to help fund innovation in this WordPress space by investing part of our budget into working alongside the fantastic team at Object Cache Pro. We’ve already seen great gains with Object Cache Pro and our customers can look forward to more in the future! Why Object Cache Pro? Before Object Cache Pro, we faced two challenges with sites making use of an object cache – CPU overhead and network saturation. The underlying technologies in Object Cache Pro solved both of these problems for us, translating to less money spent on server hardware and fewer situations where the (quite generous) AWS network limits are reached. With Object Cache Pro’s state of the art technology utilizing the Zstandard compression library from Facebook, without a lot of CPU overhead, compression is now done at the extension level, talking to and from Redis. This means less hardware, lower costs, and a better experience for our customers. Aside from supporting an efficient compression algorithm (zstd), Object Cache Pro also uses the igbinary serializer which is a drop-in replacement for the standard serializer in PHP. This works about twice as fast at serializing and unserializing data. Additionally, the data footprint is smaller when using igbinary and that translates into less memory being used by the underlying Redis service. We also found an in-depth comparison on igbinary vs other serializers on Blobfolio that you may also enjoy reading if you’re into this kinda stuff: https://blobfolio.com/2017/03/benchmark-php7-serialization/ With a wide selection of Redis plugins available in the WordPress marketplace, Object Cache Pro was the obvious choice for us not only because of their forward-thinking tech but also because of the dependability we have come to expect and appreciate from their brilliant team. All of this aside, Object Cache Pro is unrivaled when it comes to bug fixing, an extent to which is a rarity across opensource software. There’s a saying in the opensource community that goes, “there’s a lot of eyes so all the bugs get fixed.” But, more what we see concentrated use of the software by lots of users leading to fewer bug fixes for fear of breaking one users’ site. That, and, no one owns the codebase, so less can get addressed in a timely manner. Similarly, we are continuously impressed by their coverage of testing, fully unit tested with 100% code coverage. Further, switching over to Object Cache Pro gives Pagely customers access to our commercial relationship with their team, which means any problems our customers see are fixed within a few days. You benefit from our relationship. Fewer bugs in the caching layer and full unit testing is a good thing, and that’s something we stand behind. So, What’s in it for the Pagely Customer? We are the first premium host to achieve this level of partnership with one of the best technology companies in WordPress. Through our relationship with Object Cache Pro, every single Pagely customer benefits from the work we’ve done to secure that. But real talk, what’s in it for you? Major cost savings. Even when it means less revenue for Pagely, we’re constantly looking out for cost savings for our customers. By decreasing our dependency on more hardware, you see the savings directly on your bill. Access to a premium partner. Since you’re at a premium hosting provider, you automatically get access to the partnerships we’ve developed. What’s more? You don’t pay an extra licensing fee. The best tech, baked into your Pagely account. We’re always on the hunt for the best and most innovative technology for you. With no effort on your part, we do the legwork of implementing this tech across our technology stack. All you do is benefit from it. Bigger performance wins possible with a little extra code work. WordPress has a feature called Transients. It’s a way to store the result of a complex query or a long-running remote API call temporarily in order to make subsequent lookups for that data return a lot faster without doing the same expensive operation again. Normally without any object cache, transients are stored in the WordPress database’s wp_options table. When using an object cache, it is stored in memory. Adding a few extra lines to your code allows you to tap into the power of this API for incredible performance gains. Having an efficient object cache utilizing fast compression and serialization only increases those gains. A dedicated DevOps team. While others might catch on and jump on the bandwagon of partnerships like this, Pagely still stands above the rest in meaningful ways that translate to real gains for you, the customer. Our DevOps staff becomes your dedicated, in-house team. Our engineers handle all the setup and optimization to make sure your usage of Redis is optimized specifically based on your exact circumstances and needs. Other hosts don’t do that! When you partner with Pagely for your WordPress hosting at scale, you know you have selected the most forward-looking host driven by advances in technology, cost savings for you, and tangible outcomes that help your business thrive. Object Cache Pro Helped FanSided Scale So let’s get to a real-life example here. One of the first Pagely customers we switched over to Object Cache Pro was FanSided. Here you can see a dramatic decrease in network utilization on the Amazon Aurora RDS instance after implementing Object Cache Pro along with custom Transients Caching, which dropped usage from 1 Gigabit per second to 400 Megabit per second; and yielded even lower usage after some more optimizations were made. FanSided comprises a massive network of over 300 active websites and needed a fast solution to maxing out servers and using way too much CPU. Pagely found that solution in Object Cache Pro and implemented it with no effort on FanSided’s part to completely eliminate those issues. Here you can see how memory is no longer being maxed out after the date we turned on Object Cache Pro for FanSided. The proof is in the data, and here you can see dramatic drops in CPU usage after Object Cache Pro was implemented, as well as servers being maxed-out-no-more after the switch. Dramatic drops in CPU usage after implementing Object Cache Pro for FanSided. Read the full FanSided + Object Cache Pro case study here, and take it from our CEO: “In the vacuum of 1 website, a small performance gain is useful. At our scale of hosting, processing hundreds of billions of requests per month across thousands of AWS EC2 instances, a small performance gain to each site means a real and quantifiable benefit to our customers and our bottom line. Now what if that performance gain was not so small, but major. We sought out and partnered with Object Cache Pro after seeing the dramatic results in terms of performance and resource usage when testing. We have thus deployed their Enterprise solution fleet wide and the results speak for themselves.” – Joshua Strebel, CEO of Pagely
Catch up on the conversation. This piece comes as a followup to our CEO Joshua Strebel’s recent piece on why you should never pay your WordPress host for pageviews. Managed WordPress hosting has exploded across the hosting industry since Pagely created it way back in 2006. Overall, the level of innovation that the mainstream has brought to WordPress is amazing. Unfortunately, this sometimes comes with negative side-effects. As investors demand higher profits, many of these managed WordPress hosts are looking for ways to gain a quick and easy boost to their margins. Like we mentioned in our definitive guide to PHP workers, there are a few different metrics that are often misinterpreted, whether intentionally or not. Today, we’re going to talk about pageviews and their role in the managed WordPress hosting world. What Counts as a Pageview? Many hosts cite pageviews as a billing metric with vague term descriptions, if any exist at all. Even with clarified definitions, pageviews tend to mutate on a host-by-host basis with a dizzying array of buzzwords. Although individual managed WordPress hosts vary on what they consider a “pageview”, most define it like this: pageviews are the number of unique IP addresses that access pages on your WordPress site per day, excluding known bots. (Yeah, I know. The term is more like “the number of unique request sources per day, based on predefined catch-all filters.” But I wasn’t the one that made this up, so bear with me here.) Pageviews as a Billing Metric Before we dig in any deeper into the details, let’s think about the definition that I mentioned. Considering that narrative, which of these sites would be more expensive to host? A directory website that houses billions of pages, showing 1,000 entries at a time. A personal blog who’s majority of traffic is to single posts. A documentation site where visitors typically access multiple pages per day. A simple informational website for a local restaurant. An online shop that sells small-batch artisanal snake oil. An API that uses headless WordPress to dynamically fetch content. If you guessed that they represent the same metrics in the eyes of pageview-based billing, your logic prevails! Assuming that they all experience the same number of unique visitors, they’re all treated the same way, regardless of how resource-intensive the site is or how many pages each visitor accesses. Of course, it would be silly to treat all of these sites the same way. Some pages might have large amounts of fully dynamic content, while others might be eternally served from cache. Using an umbrella term like pageviews as a billing metric causes several different issues, based on the site being hosted. Setting Realistic Expectations The first issue that pageview-based billing causes is an unrealistic expectation for low-performance, unoptimized sites. If you’re not familiar with how WordPress sites perform on the server side, you might think that these limits matter exclusively and use them to determine what capabilities you need from a hosting provider. If you’re evaluating your hosting options purely based on a pageview limit, you’re ignoring critical factors that can dramatically impact your WordPress site. Performance-Based Punishment What if you’ve put hard work into optimizing your site? Well, now you’re wasting money on a billing metric that doesn’t matter. If your site is highly cacheable, you’re feeling the impacts even further. When serving content from cache, it’s practically free from a hosting perspective. You’re being nickel-and-dimed for something that is entirely outside of your control. Knowledge is Power As you scale, knowing what you’re paying for can quickly become a critical part of maintaining a healthy, cost-effective site. Coupled with the fact that the same people who are charging for pageviews tend to hide their underlying infrastructure behind the curtains, there’s no way to verify or manipulate what’s being counted. While many claim that they exclude the known IP addresses and user agents of known bots from counting towards your monthly pageview bill, what’s their motivation for even bothering? After all, more pageviews mean more money in their pockets. Pageviews Are Still Helpful Many of our prospective customers ask, “How many pageviews can ‘x’ plan handle?” Like we mentioned earlier, the impact of each pageview dramatically varies based on the type of content viewed and how your site was developed. Every WordPress site is different. It would be impossible to accurately estimate the ideal hosting environment without a complete understanding of what your site’s usage looks like. Although pageviews are a faulty metric as far as billing is concerned, they can still be useful as part of a larger dataset. Whether you’re scaling, optimizing for better performance, or shopping for a new hosting provider, pageview data plays a role in getting a full picture of your site. For example, if you were running benchmarks to determine your server’s capacity, pageview data could be used to identify what a typical day looks like. Let’s say your site looks something like this: 10% of traffic is on the home page. 30% of traffic is to various landing pages. 30% of traffic is to different blog posts. 20% of traffic is to your product’s pricing page. 10% of traffic is on account-related pages. Using that traffic data, you could then estimate what types of content have the most significant impact on server resources. You may find that some pages underperform and could use some optimization, while other highly-cacheable content, like blog posts or landing pages, remain essentially free. If 90% of your traffic goes to fully-cached content, increases in traffic have a trivial impact on your bottom line, if any. Closing Remarks Operating a WordPress site at scale is all about a delicate balance of performance and cost. At Pagely, we partner with our clients to help them achieve those goals. While shopping for a new hosting provider, be on the lookout for hosts that impose false barriers, such as PHP worker limits and pageview counts. Those vague limitations are a red flag that they’re going to try to upsell you later. (These limitations are also a sign that they’re trying to sell you on shared hosting resources too, but that’s a topic for another discussion entirely.) We hope that you’ve learned more about the impact of pageviews (or lack thereof) and why it’s not an appropriate billing metric. Do you have any experiences with pageview-based billing that you’d like to share? Is there something we missed? Let us know in the comments below.
This monthly report is provided for the WordPress community at large from Pagely’s head of security, Robert Rowley. Rowley and the entire security team keep their finger on the pulse of any potential vulnerabilities that might affect our customers, as well as any WordPress user. We sincerely hope these efforts help any and all that could use information from the experts on monthly security issues. We commend the researches and developers that help to identify and patch these issues in a timely fashion. WordPress Core No notable WordPress core security releases. Plugin/Theme Vulnerabilities of Note Security & Malware scan by CleanTalk https://wpvulndb.com/vulnerabilities/10292 This vulnerability within CleanTalk allows an authenticated user, such as an editor or subscriber, to make unauthorized Ajax calls which could lead to file deletion or downloads and also potentially function calls. Adning Advertising https://wpvulndb.com/vulnerabilities/10293 The Adning Advertising plugin has a vulnerability in versions lower than 1.5.6 which allows unauthenticated requests to upload or delete files, leading to an RCE attack, which can then lead to full site takeover. Wise Chat https://wpvulndb.com/vulnerabilities/10299 Wise Chat versions lower than 2.8.4 are susceptible to a CSV injection via a command sent in chat messages by an unauthenticated user that is included in an exported CSV file, which then could potentially lead to an RCE attack. Email Verification for WooCommerce https://wpvulndb.com/vulnerabilities/10318 The Email Verification for Woocommerce plugin prior to version 1.8.2 is affected by a loose comparison issue. This could potentially lead to any user (authenticated or non-authenticated), to log into the WordPress site. SRS Simple Hits Counter https://wpvulndb.com/vulnerabilities/10316 The SRS Simple Hits counter plugin is currently vulnerable to an unauthenticated blind SQL injection vulnerability. The responsible reporting parties at Tenable ( https://www.tenable.com/security/research/tra-2020-42 ) are working with the developer to write a more comprehensive patch to address this vulnerability, and will not release more details on the attack until they know a patch has been released. Site owners using SRS Simple Hits Counter plugin on their sites should keep an eye out daily for the patch to be released. Payment Form For Paypal Pro https://wpvulndb.com/vulnerabilities/10287 The Payment Form for Paypal Pro plugin versions before 1.1.65 are vulnerable to an unauthenticated SQL injection attack. The attack is a trivial single request which can expose the contents of your database (which includes user passwords and potentially other secrets) to the attack. This is a high risk vulnerability and site owners should patch immediately. WooCommerce Subscriptions https://wpvulndb.com/vulnerabilities/10330 The WooCommerce Subscription plugin is vulnerable to an unauthenticated stored cross site scripting (XSS) attack in the subscription billing process. Attackers can submit their XSS attack payload to during the billing step in the signup process, and later that payload will be executed on the browser of the administrator/user who reviews the attacker’s account. Site owners should update WooCommerce Subscriptions plugin to version 2.6.3 and not check any new user account information until that update is performed. TC Custom JavaScript https://wpvulndb.com/vulnerabilities/10325 The TC Custom Javascript plugin is vulnerable to an unauthenticated stored cross site scripting attack. Sites running versions before 1.2.2 should update immediately, attackers can add their own javascript or HTML to the footer of all pages loaded by WordPress with a few basic requests. This vulnerability is likely to be targeted by SEO spam bots. KingComposer https://wpvulndb.com/vulnerabilities/10297 The KingComposer plugin is vulnerable to a reflected cross site scripting vulnerability in versions before 2.9.5 This means the attacker’s malicious HTML/javascript will only be available to the browser making this request. This still poses a high risk if an attacker can trick an already logged in user to click on a malicious link/form to the website, potentially exposing secrets viewable by the user giving them to the attacker. JobSearch https://wpvulndb.com/vulnerabilities/10328 The JobSearch plugin versions before 1.5.6 are vulnerable to a reflected cross site scripting vulnerability. Much like the KingComposer vulnerability above it is a high risk if logged in users to be targeted. The proof of concept for this vulnerability will be released on August 6th, 2020, site owners should patch before this date. See previous months’ WordPress security updates from May and June.
The benefits of this WordPress security guide are two fold: Learn exactly what you need to know about WordPress security in 2020. Understanding WordPress security helps you adopt a security-oriented mindset that will help you prevent and mitigate risks as you make day-to-day decisions. Get actionable, step-by-step instructions for securing your WordPress site. The steps you need to take aren’t particularly time-consuming, don’t require advanced technical knowledge, and the linked guides are vetted for clarity and completeness. Of course, it’s impossible to cover every possible vulnerability and scenario. That’s why we also include the overarching “principles of WordPress security.” If you can follow these broad principles many of the minute details that are difficult to address in this type of post will take care of themselves. Why is WordPress security critical? It’s important you understand how big an issue WordPress security is so you give it the time and attention it deserves. Here are some sobering statistics: Google blacklists 10k sites a day for malware and another 50k for phishing each week. A blacklist from Google kills that source of traffic which can be highly disruptive to a business’s revenue. Fixing and removing a blacklist can be a hassle, particularly if your server was used to send SPAM emails. A blacklist from email service providers harms your deliverability rate which undermines the effectiveness of your email marketing. In 2018, 90% of CMS hacks were WordPress. Granted, WordPress is the world’s most popular CMS with 34% of the web powered by WordPress, but this is still a disproportionate amount of hacks. For a variety of reasons, WordPress sites are targeted and exploited more than any other CMS. 60% of attacks target small businesses. You may think that hackers won’t bother with your site because you’re a small fish but “security through obscurity” does not exist on the web. No one is too small to be a victim of an attack. WordFence reports that there are over 97,978 attacks happening per minute. This is not a small, isolated problem. Large swaths of WordPress sites are being probed for weaknesses at any given time. Will you be ready if your site is targeted? While these stats paint an intimidating picture of what you’re up against, it’s important you confront the realities of managing a WordPress site in 2020. If your business relies on WordPress, security is not something you can afford to ignore. If you haven’t taken steps to secure your site, you’re vulnerable to attack. It could be only a matter of time until your site becomes compromised. This is one area where “an ounce of prevention is worth a pound of cure.” The principles of WordPress security Securing WordPress is more than checking off a list of boxes, it requires you to adopt a security-oriented mindset that guides your decision making. These principles will help you prevent mistakes as you make day-to-day decisions like adding new WordPress users, plugins, and themes: Vulnerabilities are often introduced by WordPress users. Vanilla WordPress that is kept up to date and uses strong passwords is relatively secure. It’s often the decisions made by WordPress users that create weaknesses that hackers exploit. This is why articles like this one are so important. It’s up to you to be educated on, and consistently follow, the WordPress security best practices outlined here. Minimize plugins and themes. New WordPress users are often overjoyed by the extensive ecosystem of plugins and themes available for WordPress. This can lead to indiscriminate installation of plugins. But, each new plugin or theme adds code to your site that, potentially, adds new vulnerabilities. By minimizing the plugins and themes installed, you also minimize the amount of code your site uses, and, by extension, the number of potential security vulnerabilities. In general, if you can solve a problem without installing a plugin, that’s the best option. Install updates as soon as possible. Updates to the WordPress core and updates to plugins and themes often contain critical security updates. They should be installed as quickly as possible. If you have a good back up strategy in place, you can roll back to a previous version in the event the update causes issues. Follow the principle of least privilege. This is a core principle of cybersecurity in general and is not unique to WordPress. This is a fancy way of saying, “don’t give a user more privileges than they need because those extra privileges give hackers more power and access than they’d otherwise have if they compromise that account.” Attacks can still happen. You can try as hard as you can to cover all the bases and still fall victim to an attack. This is why regular, automated backups are critical. Do not ignore this advice. A hacked site can be disruptive but can generally be fixed with minimal cost and disruption, a hacked site without a backup to roll back to can be severely disruptive. You are never finished with security. Having a 100% secure WordPress site is an impossible task. You can’t accomplish complete risk elimination, so aim instead for ongoing risk reduction. This “risk reduction” mindset prompts you to continue taking steps to improve your security as part of an ongoing, never-ending initiative. The most common WordPress attack vectors Understanding the most common methods hackers use to exploit WordPress will help you understand how to address them and why the steps recommended later in this article are necessary: Brute Force Attack A cyber criminal uses trial and error to identify a password or pin. They use combinations of common usernames and passwords until they find the right one. It’s the equivalent of trying every key on a key ring to find the one that works. This is all done using a computer script so they can run thousands of combinations with very little effort. Given enough time, any account is hackable but strong passwords thwart this kind of attack. SQL Injection Malicious SQL code is injected into a database to gain access to database information that was never intended to be displayed. Depending on the hackers goals, this can lead to your database being deleted, customer information being stolen, or sensitive company information being accessed. Malware A virus or spyware is inserted using an expired theme or plugin. The attacker can gain access to your data, insert pages into your site for black hat SEO, and perform a number of other nefarious activities using your site. Cross-site scripting Javascript code is inserted which then collects data commonly used to exploit WordPress plugins. This can be used to redirect your site visitors to malicious content. also known as an “XSS attack.” DDoS Attack A Distributed Denial of Service (DDoS) attack floods a website with traffic which overwhelms server resources causing it to fail. Multiple machines send frequent requests to the server using malware installed on those machines for that purpose. The distributed nature of the attack can make it difficult to identify and block the sources of the traffic. Now that you understand how hackers will attempt to breach your site security, let’s look at how we can block and prevent these attacks… Steps to secure your WordPress site In spite of the many ways your site can be compromised, it is possible to mitigate these risks and prevent many attacks. Here’s a list of recommended steps to protect your WordPress site from security attacks: 1. Force Strong Passwords “81% of attacks are based on insecure or stolen passwords” “It only takes about 10 minutes to crack a lowercase password that is 6 characters long.” These two facts taken together make the case that you must use strong passwords for all WordPress users. Strong passwords are long and use a combination of upper and lower case letters, numbers, and symbols. Longer is better but 20-characters is probably plenty. Strong passwords are difficult to memorize, especially if you’re using unique passwords for each site (you should be!). This means a password manager, such as LastPass or Dashlane, is a critical tool. These apps make creating strong passwords easy, store them in a central location, and make logging into your websites easy by autofilling your passwords. Here’s how to make sure all your WordPress users are using strong passwords. 2. Turn on automatic WordPress Core updates One of the advantages of using a popular CMS like WordPress is that there are many people with a vested interest in keeping it secure. Thousands of people are contributing to WordPress security by reporting vulnerabilities to the WordPress team. This widespread collaboration means most holes are patched relatively quickly. But, if the updates that contain those fixes are not applied, you leave your site vulnerable to attack. The best way to ensure your WordPress core updates happen quickly is to turn on automatic updates. This way your WordPress site will be kept up-to-date without you having to do anything. Here’s how to turn on automatic core updates by modifying your config.php file. 3. Stay on top of plugin and theme updates You absolutely must keep your plugins and themes up-to-date. The importance of this cannot be overstated. You’ll also want to be careful to use plugins and themes that are updated often. If you’re using a plugin or theme that has not received an update in months, it’s a good idea to check in with the developer or find a more frequently updated plugin that accomplishes the same goal. When you search for a plugin in the WordPress plugin database, this information is provided in the sidebar: 4. Use Two-Factor Authentication (2FA) Two-factor authentication adds a layer of protection to your WordPress site by making it nearly impossible for a hacker to log in to your site — even if they know your username and password. You should set up 2FA for all WordPress users. 2FA can be set up quickly with simple, free plugins. Here’s a list of available 2FA plugin solutions for WordPress. 5. Brute Force protection Even with 2FA and strong passwords, it is good to setup brute force protection to help with overall performance on the server by reducing the amount of work PHP has to do. Here’s how to protect your site from brute force attacks. 6. Create automated, scheduled Backups In the event of an issue, there should always be recent database and file backups available. You should also create a backup before making any major changes to your site, such as installing plugin and theme updates. Many of the popular backup solutions take care of this for you. Here’s a list of backup solutions for your WordPress site 7. Change your login pages The default login pages for all WordPress sites are sitename.com/wp-login.php and sitename.com/wp-admin.php. Using these default login page URLs makes it easy for hackers to begin a brute force attack by trying combinations of usernames and passwords. By using a login URL that is difficult to guess, it makes it more difficult for hackers to begin the brute force attack because they don’t know where the login form lives. Here’s how to change your login page URLs. 8. Use SSL Secure Sockets Layer (SSL) encrypts all data sent from your website to the visitors browser obscuring potentially sensitive data. Using SSL has many benefits in addition to security. Google may rank your site higher in the search results and many browsers indicate whether a site is secured by SSL which can reassure them your site is trustworthy. Here’s a tutorial on setting up SSL for your WordPress site 9. Don’t use the default database prefix Using the default “wp_” database prefix makes it easier for a hacker to insert code into your database (SQL injection). Here’s how to change the default database prefix for a new site and an existing site. 10. Check your folder and file permissions File permissions define what actions can be applied to the files on your server. You should never set any WordPress file or directory to 777 permissions. Instead, make sure your permission scheme is as follows: Folders – 755 Files – 644 Here’s a guide to checking and fixing the permissions of your WordPress files and folders. 11. Disable pingbacks WordPress pingbacks are enabled by default. But for most sites, they offer little benefit. But, they can be used to turn your WordPress site into an unwilling participant in a DDoS botnet. To turn off pingbacks, you can go to “Settings –> Discussion” and uncheck the “Attempt to notify any blogs linked to from the article” box. It’s also a good idea to uncheck the “Allow link notifications from other blogs (pingbacks and trackbacks) on new articles” box: 12. Hide your WordPress version number One of the ways attackers gain access to a site is by exploiting known vulnerabilities in outdated versions of WordPress. Hackers can scan your site and easily find out what version of WordPress you’re using. If that version has a known vulnerability then the hacker has a good idea of how to proceed. The best way to prevent this is to keep WordPress up to date. However, you can also prevent a hacker from finding out what version of WordPress you’re running. Here’s how to hide your WordPress version number. 13. Don’t use the admin username Hackers can safely assume that a WordPress site is using the default “admin” username and that username will give them admin privileges so all they need to do is figure out the password. This gives them a direct path to gaining admin access to your site with a good probability of success. Eliminating the admin username makes it significantly more difficult to attack your site this way. If you’re already using the admin username, that’s okay, you can change it now. Here’s how to change the admin username. 14. Use a secure Managed WordPress Host A host that supports all the major CMSs will have difficulty staying on top of WordPress security. By specializing in the WordPress CMS alone, a WordPress hosting provider can devote the resources necessary to prevent many attacks. A reputable Managed WordPress Host will have a security team dedicated to shielding your site from threats. They’ll handle many of the concerns raised above like taking care of WordPress updates, creating backups, and more. Here at Pagely we have a comprehensive suite of security features called PressArmor that handles both WordPress application security and server security. Security questions to ask a potential managed WordPress host: Is your hosting environment chrooted? If your host has multiple domains on the same server, check with them to ensure they use chroot to isolate each WordPress app. If one app is hacked, this would help prevent access to other apps on the server. Is SSL included and easy to set up? A good WordPress hosting provider will provide SSL free of charge using a service such as Let’s Encrypt. Do you actively monitor my site specifically for WordPress vulnerabilities? If you detect a vulnerability on my site, how will you inform me? A good WordPress host will stay on top of the latest threats to WordPress sites and constantly scan your site for those threats. If they find a vulnerability, they will work with you to address it. Are you using a web application firewall (WAF) to protect my site? A WAF block malicious traffic before it reaches your site and can help prevent XSS attacks and SQL injections. Here’s a list of important considerations for choosing a Managed WordPress Host. Conclusion WordPress security cannot be taken lightly and you must take steps to secure your site. Using a Managed WordPress Hosting Provider like Pagely is one of the best ways to improve your security because you will have an experienced team dedicated to protecting you. Whether you choose to handle WordPress security yourself or leverage a host that specializes in WordPress, it’s important to treat WordPress security as an ongoing effort. You are never done with security but if you’ve taken the above steps you’ve protected yourself from many of the most common threats.
Since this is the internet – and the rules of the internet clearly state everyone gets an opinion, I’d like to share one of mine around website hosting billing plans. Quick backstory: 10+ years ago when we launched Pagely we did so with a simple line on our pricing page denoting a rough estimate of the expected capabilities of that plan ie: Plan – 1 was suitable for ~1 million pageviews. Along came the next several providers who did something similar with one important difference. They actually attempted to measure and cap pageviews per hosting plan, bracketing their plans by this new billing metric. In my opinion Pageviews used as a billing item is a predatory and anti-consumer practice and you should be very wary of working with any company that applies this #successtax to your monthly bill. Definition of anti-consumer : not favorable to consumers: improperly favoring the interests of businesses over the interests of consumers Hi, I’m Joshua Strebel, Co-founder and CEO of Pagely – A leading Managed WordPress hosting company – Thank you for attending my TED Talk. What are you buying when you are buying “hosting”? To host a WordPress site you need a few key components. A server (a computer) connected to the internet with software installed to process requests and responses for your application. Storage / Disk space attached to that webserver to save your files to. Data Transfer / Bandwidth. This is the pipe the information flows through. That’s basically it. Hosting providers typically lease/sell you packaged fragments of these resources for a monthly fee. Plan A, Plan B, Plan C. etc. Of course there are other items that may be line-itemed such as included support levels, CDN GB’s per month, managed services, etc. Plan A has X amount of consumables for Z price. It’s all fairly straightforward as most consumers understand what a Gigabyte of Disk space is and can at least grasp that more CPU/RAM offered should equate to more potential performance. “Pageviews” does not fit this model well – as the definition of a pageview is amorphous and subject to exploitation. Oh, and spoiler alert, PHP workers is not a valid billing metric for WordPress hosts either. What does an automobile lease have to do with hosting plans? Pageview limits on hosting plans are akin to annual mileage limits on auto leases. It’s a cap on the use of an asset you already purchased. In an automobile lease context a mileage cap at least has some merit as being a form of controlling the depreciation of the vehicle – you are essentially financing the deprecation of the automobile asset with a lease – and the lease company expects to sell that car (New retail value – Depreciation) when you return it. If the depreciation is too high, they lose money on that transaction as they have to sell it for less than they calculated. Your hosting plan is not a depreciating asset though – the hosting company is going to sell the same resources to the next customer when you are done for the same or likely higher fee. Therefore in my humble opinion: Pageviews are just an arbitrary anti-consumer fee – a penalty tax for using the service you already paid for. A Pageview is (depending on who you ask) a wrapper around these items: A measurable amount of Data Transfer in and out A measurable amount of CPU resources to process the request and render the response A measurable amount of Disk and Database activity Are you not already paying for these items as part of your hosting plan? Hint: Yes you are. But wait, there’s more – and my colleague will dig into these more in a future post. This pageview billing model is so poorly defined by the hosts that use it – it is ripe for abuse. It’s a scheme to generate revenue for the hosting company and unfairly penalizes the consumer. Hint: You already “paid” for the sum of the parts of a “pageview”. No two pages are the same. A cached page even with a few images can be served a million times a month with ease, and yet a badly coded membership-site page may tax the hardware it runs on each time it loads. They have very different cost profiles to the host – yet both are treated equally under this model. If you invested the time to optimize your site, get it caching well and then blow it up with viral traffic.. That is a GOOD day for you and costs your host pennies of the monthly fee you are already paying them – yet when you get the overage bill for exceeding your pageview cap at the end of the month, are you going to enjoy that tax on your success? If you want to keep paying twice for the same resources you are welcome to. I simply do not think that is fair. Our friends down in Austin have made millions on charging their customers overage fees for exceeding their monthly pageview cap – even to the point having to publicly respond to criticism – only to keep the practice in place. Reminds me of airline baggage fees and fuel surcharges. and An “online payment convenience fee” when they only accept payments online. and JetPack being “free”. Happy WordPress’ing – Joshua Strebel
