Online shopping has made it super-convenient for online shoppers to hunt around for the best prices. With this in mind, customers are perhaps more sensitive to prices than at any other point in history. After all, why would you pay $500 for a product when the exact same model is available for $100 less? You don’t even have to traipse across town, either; you’re just a few mouse clicks away from the cheaper price. It’s a no-brainer, right? This has turned online customers into a group of serial bargain hunters. Today I want to help ensure that your eCommerce store appeals to online customers’ hunger for a bargain. Let me show you exactly how to run a pricing promotion using coupon codes with WooCommerce. Creating a Coupon Code with WooCommerce If you’re brand new to WooCommerce, you’ll need to install the WooCommerce plugin first, then add a few products to your store before creating a coupon code. That’s a tutorial for another day, though, as I want to focus this tutorial specifically on how to set up a coupon code with WooCommerce. With this in mind, I’m going to go ahead and assume you’ve already got a WooCommerce-powered shop up and running. To create a coupon, simply click WooCommerce > Coupons from within the WordPress dashboard. Go ahead and create your first coupon by selecting Add Coupon. Start by creating the code for your coupon at the top — this is the code customers will apply at the checkout to get their discount. It’s also worth adding a brief description below to help you remember what the coupon is for. The coupon page has three tabs on the left-hand side: General, Usage Restriction, and Usage Limits. General Coupon Tab Let’s start with the first tab, General. The General tab lets you specify what type of discount you’re offering. The out-the-box version of WooCommerce supports four discount types: Cart Discount — a fixed discount on your whole cart Cart % Discount — a percentage discount on your whole cart Product Discount — a fixed discount on a specific product/s Product % Discount — a percentage discount on a specific product/s For this tutorial, I’m going to be offering a fixed discount on a specific product — a PlayStation 4 — so I’ve selected the Product Discount option. Below, you must specify the Coupon amount. If you’ve picked one of the % options, the number used here will determine the % discount. If you picked a fixed discount, it will determine the amount off in dollar-terms — or your store’s default currency. I’ve gone ahead and added ‘25′ in this field, which means I’m offering a $25 discount on the regular price. Further down, you can offer free shipping with a valid code, simply by checking the Allow free shipping checkbox. At the bottom, you can set an expiry date for your coupon, which is useful when running timely promotions — Black Friday, anyone? The expiry date is selected from a drop-down calendar. Usage Restrictions Tab OK, with the General settings configured, let’s move onto the Usage Restrictions tab. This is the tab where you’ll configure your coupon’s specific requirements — in other words, how it’s activated. For example, you can set which minimum/maximum subtotals the coupon is valid between — great for ‘10% off orders over $100’ promotions. You can also check the checkboxes to restrict one coupon code per order and prevent the coupon being applied to sale items — both recommended. You can configure the code to apply to/exclude specific products and categories, too. This first option is relevant for the coupon I’m configuring, which is a $25 discount on a PlayStation 4. Obviously, I want a PlayStation 4 in my customer’s cart, otherwise, the coupon should be invalid. Fortunately, WooCommerce helps you find your products easily: You can either input the first three letters of your product name or the product ID. Setting Usage Restrictions is really straightforward, and WooCommerce includes a helpful tooltip for more information about each field. Usage Limits Tab The final tab is labelled Usage Limits. This tab lets you restrict how many times your coupon can be used — either per customer, or total uses. I want to restrict my coupon to the first 1,000 users — great for creating a sense of urgency — and limit it to one use per customer, and one PS4 per cart. With this tab configured, my coupon will expire either after my Usage limit or the specified Expiry date — whichever comes first. That’s all there is to it, so when you’re happy hit Publish. Final Thoughts Now when a customer uses my coupon code they will save $25 off the price of a PlayStation 4. Here’s my checkout page before the coupon is applied: And here it is after the coupon is applied, with $25 subtracted from the subtotal and free shipping applied. Awesome, right? As you’ve seen, WooCommerce makes it really easy to create coupons for your eCommerce store, making your prices more attractive to potential buyers. With your coupon created, it’s time to get out there and tell the world about your promotion, to help drive more sales for your online store. The current version of WooCommerce supports relatively basic coupon codes; if you want more advanced coupons, I highly recommending extending WooCommerce with the WooCommerce Dynamic Pricing and Discounts plugin, available for $20 from CodeCanyon. Looking for reliable WooCommerce hosting? Click Here
When I first started using WordPress several years ago, I remember a plugin asking me for a post ID. I thought I was picking up WordPress quite quickly, but this one had me stumped. I could see the name of my post, I could find the URL – but I had no idea how to find the post ID. If you’ve ever had this problem, you’re in luck: today, I’m going to show you exactly where to find the WordPress post ID. Now, many WordPress users don’t know how to find the post ID, and they get by just fine. So why might you need to know it? Usually, it’s a situation like the one above: because a plugin asks for it. But many themes will ask for post IDs during configuration, too. Either way, it’s a good thing to know how to do. How to Find a Post ID in WordPress For me, the quickest and easiest way to find a post ID is done from the All Posts screen — found by logging into the WordPress dashboard and clicking Posts > All Posts. From here, simply hover your mouse over the post you want to find the ID for. Now, take a look in the bottom left-hand corner of the screen. See that pop-up box? That contains the post ID. More specifically, the post ID is the number that comes after the “post=” and before the “&“. See what I mean in the above screenshot? In this instance, my post ID is 6706. You can also find the post ID in the WordPress editor, which you get to by clicking on the post you want. When done this way, the post ID is in the address bar. The URL shown will be exactly the same, and the post ID is again sandwiched between the “post=” and the “&.” Both ways are really easy to do, and it shouldn’t take more than a few seconds to find the post ID. Page, Category, Tag, Comment, and User IDs But it’s not just posts that are assigned a custom ID number that’s difficult to find. Every page, category, tag, comment, and user ID on your website will also have a unique ID number. You can find these ID numbers in exactly the same way that you found the Post ID numbers. In the case of category ID, simply click Posts > Categories from within the WordPress dashboard. When there, find and hover over the category you want, and you’ll see the URL you want in the bottom left corner, same as before. The category ID is found after “category&tag_ID=” and before “&” as seen in the screen grab above. Alternatively, you could click on the category and find the category ID from the URL. I’ve highlighted it for you in the address bar above. Final Thoughts If you’re struggling to configure a theme or use a plugin because you can’t find a post ID, I hope this short tutorial has helped you out. Although it’s really easy to do, most WordPress users won’t know how to find the post ID, simply because it’s so rarely needed. Remember how it’s done, so if you are ever asked for it, you won’t waste any time finding it. Do you have any questions about finding WordPress Post IDs? Fire away in the comments section below! We can help with flexible Managed WordPress Hosting.
Today we have another well-respected member of the WordPress community answering our questions. Step forward WebDevStudios CEO and co-founder, Brad Williams. You’ve probably heard of WebDevStudios already, right? They’re one of the best-known WordPress design and development companies, they’re heavily involved in the WordPress and BuddyPress core, and their team is behind some of the top-rated WordPress paperbacks — including Brad’s very own Professional WordPress series, aimed at design and plugin developers. In today’s interview, Brad talks openly about how he first became involved with WordPress, how the platform has changed during his time, and some common mistakes inexperienced WordPress users are making. A big thanks to Brad Williams for answering our questions. Here’s the interview in full. For readers less familiar with you, could you tell us a little about yourself and your WordPress background? My name is Brad Williams and I am the co-founder of WebDevStudios.com. I founded WebDevStudios back in 2008 and specialize in WordPress design and development. I am also the co-author of the Professional WordPress book series and the co-organizer of the Philadelphia WordPress Meetup and WordCamp Philly. More recently I co-founded a company called AppPresser, which is a mobile app building framework for WordPress. I also host a WordPress centric podcast called the DradCast. You’ve been in the WordPress community for several years now, but could you tell us how you first became involved with WordPress? My first exposure to WordPress was at the Search Engine Strategies (SES) conference at Chicago in December of 2006. During the conference I noticed everyone had a blog, except me. After the first day of the event I went back to my hotel room, ordered a burger and a beer, and setup WordPress to power my blog at StrangeWork.com. You have to remember back then WordPress was very much a blogging platform. At the time tags didn’t even exist in WordPress core. Even though 2006 was a long time ago, I was actually pretty behind in starting a blog. Blogging became fairly popular in the early 2000s, so I felt like I really missed the bus on starting a blog earlier. During your time in the community, what different areas have you been involved with? Over the years I’ve been involved in many different areas of the community. Starting out I was very active in the WordPress IRC channels. I learned a lot from the users who frequented those chat rooms and as I learned more was able to contribute back and help other users. I have also been very active in the WordPress podcast scene. I was an original panel member on the WordPress Weekly podcast at WPTavern.com. I also co-hosted a few podcasts including WP Late Night on WP Candy as well as my current podcast, the DradCast. In 2010 I moved to Philadelphia, Pennsylvania. I wanted to find a local WordPress community to join, but at the time there really wasn’t one in Philly. I decided to start the Philadelphia WordPress Meetup and help create one! Since then, we have grown to over 1,500 members and have hosted five WordCamp Philly events in our city! It just goes to show, if you can’t find a local WordPress community, get out there and help create one! What has been the best thing about working with WordPress for you? One of my favorite things about WordPress has always been the community. I’ve made many life-long friends in the WordPress world, including some that now work with me at WebDevStudios. The WordPress community, and open source in general, is a very open and helpful community. It’s all about giving back and helping others, and being a part of this community is the best thing about working with WordPress. How has the WordPress community changed since you started? The WordPress community was obviously much smaller back then. You could count the companies specializing in WordPress on one hand. There were no sites dedicated to WordPress news, no WordPress podcasts, and very few premium themes available. The WordPress world was in its infancy. Being a smaller community meant it was a much tighter community. The community has grown quite a bit since those days. Most people these days, whether in the technology field or not, have heard of WordPress. There are literally thousands (maybe millions!) of people making a living off of WordPress. From freelancers to agencies, the commercial WordPress space has exploded the past few years and is only continuing to grow. WordPress is no longer a blogging platform, it is a full-fledged CMS that is capable of powering any website imaginable. Being so flexible is the primary reason the popularity of WordPress, and the community, has grown so fast over the years. What advice would you give to anyone getting started with WordPress? Which direction would you yourself go if you were starting over again? The WordPress market is very saturated, and I’m not just talking about premium themes. There are thousands of development and design companies, freelancers, premium products, services, etc for WordPress. My advice would be to find a niche you specialize in and focus on that. Enjoy building websites for radio stations? Focus your business on building websites for radio stations. Focusing on a niche will help you stand out from the crowd and build a name for yourself and your company. It will also open up doors to expand in other niche markets as you grow. Contributing to WordPress is also a great way to get started in WordPress. What better way to learn a platform inside out than to help make it better? There are a number of different ways to contribute to WordPress, so it’s not just for developers. What do you think the biggest mistakes WordPress website owners are making? Many WordPress website owners assume WordPress is a set it and forget it platform. With any software, there are always ongoing maintenance requirements to keep your software updated and secure. WordPress is no different and needs to be updated when new versions are released to verify your website is as secure as it can be. You wouldn’t stop updating Windows when a security update is released, so why stop updating WordPress? I also think many website owners try to go cheap on a critical component of their website, which is hosting. Time and time again I see beautifully built websites hosted on a $5/month shared hosting plan. You spent your time and money to build a beautiful website, so why wouldn’t you want to also spend a little bit more to host with a solid hosting company, especially if that hosting company specializes in WordPress? Hosts like Pagely really take the guesswork out of hosting a WordPress website. Not only do they offer top of the line hosting and support, but they also help with keeping your WordPress website and plugins updated. Spend the money on a quality WordPress host and you will quickly see the ongoing benefits. What do you think the future of WordPress holds? What would you like to see? The future of WordPress is looking very exciting! I think we are going to start seeing more and more people using WordPress as an application framework. With the soon to be released REST API, the WordPress dashboard no longer has to be the standard management interface for WordPress. You will be able to easily integrate any system with WordPress, allowing WordPress to handle the display side, and your system of choice the administration side. It will be very fun to see what new concepts people come up with in the future. Final Thoughts A big thanks to Brad Williams for finding the time to answer Pagely’s questions. There’s some golden information in there! In my opinion, the biggest takeaway from today’s interview is Brad’s tip on specialization. These days, the WordPress market is saturated. Countless people make a living from the platform, and there are multiple solutions for just about everything WordPress-related. This makes it incredibly difficult for new developers to get established. If you try to be all things to all people, you’re going to face a long, hard slog if you want recognition as one of the leaders at what you do. If, however, you decide to specialize in a smaller section of the overall market, it’s much easier to make a name for yourself. Competition is still fierce, but you might be competing with a handful of competitors rather than thousands. And, once you have managed to establish yourself in your niche, you’ll find it much easier to make a splash in the wider marketplace, if that’s what you aspire to do. Just because you start small doesn’t mean you can’t grow into something much larger. And with that, let’s wrap up today’s interview. Before we finish, here are the all-important links again. Be sure to check out Brad’s WebDevStudios, AppPresser, and his personal blog — oh, and follow him on Twitter, too! Thanks for reading, see you again next week!
Welcome to another Pagely interview, and today we have the WP Mayor founder, Jean Galea, in the hot-seat. Jean is best known as the founder of the excellent WP Mayor resource. It’s one of the best places for WordPress tutorials, learning about the best plugins/themes, and also more general tips for aspiring webmasters. Jean also provides some awesome tips over on his personal blog and he’s well worth following on Twitter, @jeangalea. In today’s interview, we’ll tap into Jean’s years of WordPress knowledge and expertise. We’ll be talking about the best way for new WordPress users to get started, how to avoid common beginner pitfalls, and also some of the best things about working with WordPress. As always, we really appreciate Jean’s time. Read on for a really insightful set of answers! For readers less familiar with you, could you tell us a little about yourself and your WordPress background? I founded and currently run WP Mayor and WP RSS Aggregator. WP Mayor is a WordPress resource site and WP RSS Aggregator is a freemium plugin that lets you import RSS content from any type of website into WordPress. On both these projects I am lucky to count on a fantastic team that help me in making my vision a reality. You’ve been in the WordPress community for several years now, but could you tell us how you first became involved with WordPress? I stumbled on WordPress while still a student at University. I used to work as a freelance web developer on the side to help finance my education. After a brief stint with Joomla I switched to WordPress, attracted by its promise of an easy installation and straightforward theme customisations. Soon after graduating I teamed up with a friend of mine to form a WordPress agency in Malta which I ran successfully before moving on to blogging and product development. During your time in the community, what different areas have you been involved with? At WP Mayor I’ve acted as a WordPress evangelist by teaching people how to use WordPress as well as reviewing top plugins, themes and services. I’ve also had the pleasure of speaking at WordCamps and also mentoring other entrepreneurs who are building WordPress products. What has been the best thing about working with WordPress for you? Thanks to WordPress I have been able to build three profitable businesses and achieve my dreams of travelling around the world while working at the same time. I’m therefore very grateful for the opportunities that WordPress has opened up for me. Beyond giving me the ability to live the digital nomad lifestyle, however, I’d have to say the best thing about working with WordPress has been the community. I’ve made many long-lasting friendships through my involvement with WordPress, and I’m very thankful for such an open and friendly community. How has the WordPress community changed since you started? The most noticeable difference would definitely have to be the size of the community. In recent years WordPress has grown really rapidly. This increase in market share has been by and large a positive thing. It is now easier to find help with WordPress problems, and there are way more options when it comes to themes and plugins nowadays then there were when I started out. In my early days with WordPress I also had to work hard to convince prospective clients that they should trust WordPress and open source software in general. I believe WordPress development agencies nowadays have a much easier job as things have changed and business owners typically have already have heard of WordPress and its virtues. What advice would you give to anyone getting started with WordPress? My advice would be to start building something right away. You don’t need to read long user manuals or loads of tutorials before creating your own WordPress website. It’s best to learn by doing as it really is quite straightforward to get going. Nowadays there are learning resources in every form: video training, podcasts, blogs etc. Just choose your preferred way of learning and get going. The same applies for those developers who want to get started with themes and plugins. Since themes and plugins are open source, it’s very easy to dissect what the top developers are doing and learn from them. What do you think are the biggest mistakes WordPress website owners are making? The biggest mistake I see site owners making is not taking security seriously enough. Unfortunately many WordPress websites are hacked every year. By and large the fault doesn’t lie with WordPress core itself but rather one of the following facets of a site: plugins, themes or the hosting platform. Hence not being extra careful with any of those three aspects can be a very costly mistake. As a website owner, you should use well-coded plugins and themes and keep them updated. I recommend weekly updates, although monthly updates should also be sufficient. Moreover, choosing a top web host will ensure that your website performs at its best. Managed WordPress hosts are a fantastic option as they take care of caching, platform security and backups. Apart from that they also tend to offer the best customer support since they have working knowledge with WordPress, while other generic hosts might not have that expertise. What do you think the future of WordPress holds? What would you like to see? In the immediate future the REST API will change the way we think about building projects with WordPress. It will make WordPress a much more flexible platform that can power an even wider range of applications. I would like to see more people in the WordPress community look beyond the comfortable confines of WordPress. In practical terms this will involve using more modern development practices, attending international non-WordPress conferences, and becoming better entrepreneurs. This will ensure that WordPress will not lose its relevance in the grand scheme of things. We are already at a stage where we’re realising that young developers are being attracted to other more cutting edge technologies so we must make a conscious effort to modernise some aspects of the project and reach out to the general web development community. Final Thoughts Once again, a big thanks to Jean for taking time out to answer our questions. As Jean points out, WordPress is an easy platform to get started with. Don’t waste time dragging your heels: dive in, and be prepared to make mistakes — it’s the best way to learn the ins and outs of the platform. And, if you do get stuck, there’s an abundance of WordPress resources out there to help you find your bearings, and you can find tutorials in just about any format — including Jean’s very own WordPress resource, WP Mayor. Let’s wrap things up, as always, with those all-important links. Be sure to check out Jean’s two main businesses, WP Mayor and WP RSS Aggregator plugin. If you’re looking for a more personal flavor, check out his always-informative personal blog, and follow him on Twitter! That’s it for this week. Thanks for reading everyone!
In this week’s edition of 8 Questions, Pagely was fortunate enough to interview one of the most talented WordPress plugin developers around, Pippin Williamson. For those of you unfamiliar with Pippin, where have you been? Pippin is best known as the founder of Pippins Plugins, but he can reel off a huge list of well-respected plugins. These include all-in-one solutions for digital eCommerce (Easy Digital Downloads), membership sites (Restrict Content Pro), and affiliate scheme management (AffiliateWP). Despite his busy schedule, he also manages to stay active on Twitter — follow him @pippinsplugins. With this in mind, we’re very lucky to talk to him today, as Pippin gives advice to new WordPress users, helps you avoid common mistakes, and also shares how his own career has developed so far. An enormous thanks to Pippin for providing some of the most honest and insightful answers we’ve had so far. Here’s what he had to say. Full Disclosure. Pippin is a customer of Pagely and one of our featured Brand Ambassadors. For readers less familiar with you, could you tell us a little about yourself and your WordPress background? Computers and the internet have always been an active part of my life. My father has been a computer programmer for more than 30 years so we always had computers in the house. If I recall, we were one of the very first houses in our area to get dial up internet when it was first becoming available in the early 1990s. The prevalence of computers and other tech gadgets gave me an easy (and perhaps obvious) route into an internet-oriented career. I began programming in in my early teens and was working as a freelance web developer by 18 or 19. Some of my first programming experience came from a language called NCQ (Not Quite C) that was used for programming robots built with Lego Mindstorms. That led me into C, C++, and then on to web languages such as PHP, which came during my introduction into WordPress phase. As much as I’ve always been a tech fanboy, however, my heart and soul are really in the outdoors and working with my hands. There is a level of satisfaction that comes with crafting something with your own muscles and nerve endings that simply cannot be equaled in the digital world. You’ve been in the WordPress community for several years now, but could you tell us how you first became involved with WordPress? I began getting interested in WordPress around 2008 while building some of my first websites for clients. This was when I was in my first few years at the University of Kansas and web development served as an after-school side project for me. It mostly funded my coffee shelf. Over the course of perhaps six months, I slowly acquainted myself with plugin development and started building small plugins that I released both commercially and for free on WordPress.org. The first plugin I built became a very slippery slope for me. Today I’ve written over 200 distinct plugins and run three separate companies all funded entirely from commercial plugin sales. During your time in the community, what different areas have you been involved with? I began as a theme developer (terrifying thought considering my utter lack of any design skills). Mostly I built custom themes for client projects but I did at one point release a free theme that was available for a few years before being discontinued. After learning the ropes through theme development, I moved on to building plugins, which is where I have kept my focus ever since. As part of my plugin development focus, I also became involved with the plugin review team for WordPress.org, meaning I help manage the plugins that are submitted to the repository. Today there are nearly 40,000 plugins in the repository and somewhere between 20-50 new ones requested every single day. Outside of plugin development, I’m an active attendee, speaker, and sponsor at WordCamps around the country (going global in September!). While it does not happen as frequently as I would like, I also contribute to WordPress core by writing and testing patches for bugs and new improvements. What has been the best thing about working with WordPress for you? The opportunity to make lifelong friends with people around the world. There have been so many other great things but truly what matters is people. The people I’ve had the opportunity to connect with through working with WordPress is simply astounding. While we tend to focus more on the bad, ugly, and dramatic events, the relationships we build day to day are the ones that really shape our lives for years to come. I could choose to leave WordPress tomorrow, but I wouldn’t be leaving the people I’ve met along the way behind. How has the WordPress community changed since you started? It has matured a lot. Every community will have tough times and every community will have periods of strife, but in general I think we have grown substantially, in many ways. We have obviously grown in size as WordPress continues to eat up more and more of the web’s market share, but we have also developed into a more mature platform that people can feel safe building their businesses on. Three years ago, I would have been reluctant to hire a team of support technicians and developers to help me run my plugin company, but today that’s the reality, and it’s the reality for a lot of companies throughout the WordPress world. I believe we have also begun doing a much better job at branching outside of the WordPress community. Most days we live in a bubble–a comfortable one (usually), but a bubble nonetheless. There is still a long ways to go, but I do believe we are getting there. What advice would you give to anyone getting started with WordPress? Which direction would you yourself go if you were starting over again? It really depends on what area they’re going into, but the first piece that applies to everyone is to follow your own path. Just because one person says to do something one way does not mean you have to. Just because one team is successful on one way does not mean that you must follow their lead to also be successful. If I were to start over, I would try and hire team members sooner. I spent a year of my life really struggling to make it through each day because I was so overloaded with work. My business was thriving but my personal happiness and mental health were seriously deteriorating. Bringing on other people to help share the load is one of the best decisions I’ve ever made. What do you think the biggest mistakes WordPress website owners are making? I have a two part answer to this: Not updating WordPress and plugins on their site leaving them open to vulnerabilities and bugs. This is exacerbated anytime site owners experience upgrade problems due to poorly built plugin updates. Site owners have a fear of updating, but it’s not their fault. To alleviate update fears, plugin developers absolutely must take backwards compatibility as a critical objective. If plugin developers continue to push out updates to make breaking changes or cause problems with sites, the site owners will never, ever get comfortable enough to trust updates. What do you think the future of WordPress holds? What would you like to see? I expect we will see a much tighter integration with 3rd party services and even external devices. There is no reason WordPress should be confined to your computer’s web browser. Over the next few years, I fully expect to see a slew of mobile apps make their way into the WordPress ecosystem that bring an additional level of integration between the software that runs our websites and the devices we use to consume and produce information. Final Thoughts Once again, a big thank you to Pippin for providing us with a great set of answers. Pippin makes an interesting point about expanding your team. Although it’s normal to think that you can do everything yourself, beyond a certain point, working alone actually restricts your business’s growth — not to mention the side effects from working too hard. Remember: Expanding your team is a fundamental part of being in business. Relinquishing control is difficult, but with plenty of talented developers out there, your business will still be in good hands. If you feel like your business has plateaued, perhaps it’s time to inject some new blood into your business — it could be just what you need to take it to the next level. If you’ve enjoyed reading Pippin’s answers, be sure to check out his plugin collection — you can find links to all his plugins over on the PippinsPlugins website. I also recommend following him on Twitter, @PippinsPlugins. Thanks for reading, we’ll be back with another interview next week!
Nothing enhances a brand more than a great customer experience. There are many ways to achieve this: a great product and eye-catching website for starters, but also an impeccable customer service — something that’s often overlooked. But how do you provide great customer service on a website? A responsive email team, perhaps, but nothing beats a real-time conversation with a real human. I’m talking, of course, about live chat. Not only does adding live chat to your website increase sales — it’s the quickest way to neutralize buyer objections — but it also allows you to provide great aftercare, so users can get the most from your products and services. That means more satisfied customers and more glowing reviews, and this will boost sales down the line, too. By now, I hope you’re sold on the benefits of live chat. Today I want to show you how to add live chat to your website, using Pure Chat. Getting Started To install the Pure Chat plugin, navigate to Plugins > Add New. Search for ‘Pure Chat,’ then click Install Now on the first plugin returned. After installation, click to Activate Plugin. Next, head to the Pure Chat menu item, and click on the Pick a Widget button. Now you’ll need to sign up for a Pure Chat account. This is completely free of charge and should take no more than a minute. After signing up for Pure Chat, the live chat functionality will automatically activate on your website — access your website to test this out. The default Pure Chat window is stylish and commands attention, making it a great way to encourage visitors to interact with you. Now that you know everything is working, you can use Pure Chat to assist your visitors. Your conversations are handled from a dedicated dashboard — not from within the WordPress dashboard. The interface is really clean, however, and it’s really intuitive to use, so you should feel comfortable in a matter of minutes. Customizing Pure Chat You can customize your Pure Chat window by navigating to the Manage tab in the top-right corner, then clicking Chat Widgets > Customize. Here, you can customize the appearance of your chat window. Here are some of the customization options available to you: Two styles — minimal and classic Infinite colors Position on the screen Text Type — four types of chat window 26 animations 23 images — or upload your own Positioning of the image This means you can create very different looking chat windows. Try to create something that fits with your brand image. Using the many tabs at the top of the screen, you can also configure the appearance of the in chat window, which visitors will see during your virtual conversations. There’s also a Trigger tab, which lets you specify the criteria for a chat window to open automatically — you can select time-based triggers, or page-based triggers by specifying internal URLs. When you’re done, just click Save. The changes are applied to your website automatically. From within the Manage tab, you can also look at your live chat statistics, view transcripts, create new users, and create canned responses to often-asked questions. Live Chat Functionality You can chat with your customers from the Pure Chat dashboard. The live chat functionality is activated whenever a chat operator is available — to set your status as available, just click on the Unavailable button at the top of the screen. This will change your status to Available. Now when a visitor accesses your website, they can click on your chat window to communicate in real-time with you. When a message is received, Pure Chat will play a notification sound. Click on Incoming Chats to view your received messages. Now you can use the Pure Chat interface like an instant messaging service to talk directly to your visitors. This is what the chat looks like from your visitors’ perspective. Final Thoughts If you want to add live chat functionality to your WordPress website, Pure Chat is a great option. I’ve tested out a few different live chat plugins, and Pure Chat has been my favorite by far. The service is easy to use — on the front- and back-end — and the chat windows look really stylish, with lots of customization capabilities. If you want to test drive Pure Chat, you can use it for up to 15 chats per month free of charge — this might be enough for low-traffic websites. If you want an unlimited number of chats, Pure Chat is available from $4.99/month. Are you using Pure Chat? Share your experiences in the comments below!
Today we get another insight into the Argentinian WordPress community, courtesy of QuadroIdeas founder Javier Schvindlerman. As well as running his premium theme shop, Javier is also heavily involved in the WordPress community in Argentina, making the long-overdue Buenos Aires WordCamp a reality at the end of May. In today’s interview, Javier talks all things WordPress — his background, his involvement with the WordPress community, how the community has evolved, and the direction he thinks it’s headed. As always, I want to say a big “thanks” to Javier for finding the time to answer our questions. Let’s get on with the interview! For readers less familiar with you, could you tell us a little about yourself and your WordPress background? Sure! I’m a developer/stage manager/musician. I was born in Argentina, spent many years living in Israel, and I’m currently living in Buenos Aires again. I’ve always had many different occupations, but I spend most of my day involved with WordPress. Together with Mailen Knoblovits we co-founded and run QuadroIdeas, a little theme shop selling handcrafted, premium WordPress themes. You’ve been in the WordPress community for several years now, but could you tell us how you first became involved with WordPress? Well, I’ve always been involved with web technologies. I went to a technical high school and started programming on Pascal when I was 13 years old. I think you are very lucky when you get to be technically challenged from a young age, and you need to solve conflicts by means of tools you don’t really know how to use yet. By 2008, when dealing with a website for one of my (then) current projects, a web tutorial lead me to WordPress. I used it to build a site in a matter of minutes, and was completely sold. During your time in the community, what different areas have you been involved with? Since we create themes for a wide spectrum of people, I do a lot of user support. We deal with complex requirements from advanced developers that are trying to make super cool stuff with some part of a theme, and we also help customers that barely know what the Dashboard is and are struggling to create a menu. Also, these last two years we’ve been heavily involved in growing the WordPress community here in Argentina. We came to a WordPress-anniversary-meetup first, and immediately felt we needed to help there. The community has been growing beautifully with more and more people joining and sharing knowledge and experience. Last year we discussed the possibility of hosting a WordCamp in Buenos Aires after many years without one. And after a lot (a lot!) of work, it became real! We’ve spent the first half of this year co-organizing it, mostly, with the great folks at @NiceThemes. It was hard and exhausting, but extremely rewarding. 🙂 What has been the best thing about working with WordPress for you? For me, it has to be the way WordPress empowers people. Because having a web presence is so important, you need to be online and have a space of your own to make a lot of stuff happen. I’m not saying you absolutely need to have a website — we know that isn’t true. But having your own online real estate can make a difference. In that sense, WordPress can open doors for someone who otherwise wouldn’t have the means to. The ability to create an online display for your ideas, your products, or whatever you have to say, is huge. At the end, technologies aside, I think that’s what the whole WordPress ecosystem is contributing to. How has the WordPress community changed since you started? It has gotten bigger, for sure. And wider. I guess the wider it gets the more varied the needs of the community get, right? WordPress is far from being a “blog platform” today, and the users and developer communities behind it reflect it. What advice would you give to anyone getting started with WordPress? Which direction would you yourself go if you were starting over again? I don’t think I would do anything different. During my time working with WordPress, I’ve used it to run personal sites, I’ve developed client projects, and I’ve been building commercial themes for a while now. Whatever you can do to keep learning will help you enormously on the next part of the road. There’s definitely a learning curve when you begin, especially if you are not PHP oriented. But it’s an easy one. If you are just starting with WordPress, I’d try and think that everything you want to do with it is possible. You just need to find the right way to do it. There is an infinity of online forums, Facebook groups, blogs, etc. which can help you if you don’t have the answers yet. Just go ahead and try to do it. What do you think the biggest mistakes WordPress website owners are making? Can’t think of anything in particular right now. 🙂 What do you think the future of WordPress holds? What would you like to see? The future of WordPress is looking bright, that’s for sure. I’d like to see a more open discussion about what the current needs of the whole user spectrum are. Being a community mostly run by developers (top notch developers) that spend valuable time making the core what it is, I think that sometimes it’s easy to miss the big picture of what the end user is trying to do with it. Sure, educating users is fundamental, but a lot of times we on the other side can learn much more, as with any other case, just by listening and watching. Final Thoughts Once again, huge appreciation to Javier for answering our questions! As we discussed at the end of Juan’s interview, it’s great to see WordPress thriving in all corners of the globe. This doesn’t happen by accident — it’s reliant on individuals pulling together to grow their local WordPress community. Just because a WordCamp isn’t coming to a city near you doesn’t mean it has to be this way forever. As Javier and Juan have proved, if you work hard enough, you can make these events happen — it’s really inspiring stuff. Before we finish, I strongly recommend that you head over to QuadroIdeas to check out some of Javier’s beautiful, handcrafted themes! That’s all for now, though; thanks for reading, and I’ll see you again next week!
Over the last few years, the premium WordPress product market has gone from strength to strength. These days, it really is possible for top developers to earn six- or even seven-figures a year by selling their premium themes and plugins. This has led to a surge of new products hitting the market, with lots of new developers looking for their piece of the pie. Unfortunately, many of them are left disappointed, with sales falling well short of their expectations. What gives? Why are some developers super-successful while others struggle to earn a basic living? (Hint: it’s not just an issue of quality.) The problem is that many developers have no idea how to sell their products — if the community is unaware of your products, how do you expect to make any money? If this describes you, you’re in luck: today, I’ll be sharing four tips to help commercial WordPress developers sell their first 100 products. 1. Freemium Business Model If you’re launching your very first product, people have probably never heard of you. As you can imagine, this makes building momentum ten times more difficult! People are unlikely to drop big money on a product they’ve never heard of, built by an unknown developer — not unless the product is truly groundbreaking and exceptional. They are, however, likely to test out a product if it won’t cost them anything. Whether you’re selling themes or plugins, try to release a basic version of your product. Just remove one or two premium features, then submit it to the relevant WordPress directory — this one for themes, this one for plugins. Impress people with the ‘Lite’ version of your product, and they’re far more likely to shell out for the full version. 2. Sell on the Big Marketplaces If you sell your themes/plugins exclusively on your website, you have two obstacles to overcome: Attracting people to your website, and Convincing them to make the purchase. You can make your life much easier by going to a place where you know big groups of buyers congregate — namely, ThemeForest (themes) and CodeCanyon (plugins). It’s the same reason big manufacturers all sell their products on Amazon — there’s a ready-made customer base in place. Sure, you’ll still have to work hard to stand out from the competition, but it’s far easier to get noticed. After that, you can focus on perfecting your product page to generate conversions. This might not be the most popular point, as Envato take between 30% and 50% of an exclusive author’s earnings, depending on total sales. With such a large customer base, however, selling your products on the biggest WordPress marketplaces can still be very lucrative. In fact, CodeCanyon’s best-selling plugin, Visual Composer, has been bought nearly 80,000 times at $33 a pop — that’s around $2.6 million in revenue. On ThemeForest, the figures are even more impressive, with the best-selling theme, Avada, shipping over 145,000 themes at $58 — that’s nearly $8.5 million in revenue. Truly eye-watering statistics, right? But could these developers have earnt anything like those figures by going alone? Not a chance. Would you rather earn 100% of a smaller number (or zero), or 50%-70% of a much bigger number? That’s a decision that only you can make, but the Envato marketplaces certainly deserve consideration. 3. Start an Affiliate Program You might not be the best marketer in the world, so why not attract marketing talent to do the hard work for you? By launching a generous affiliate scheme, top marketers and blogs might pick up your products and advertise them for you — in return, they’ll receive a commission for each sale they drive. You’ll still have to put yourself out there to attract your first affiliates, but if you’ve got a product that’s proven to sell, this strategy can snowball. If you want to manage an affiliate program from within the WordPress dashboard, consider using a plugin like AffiliateWP — part of the Pippin’s Plugins family, which also includes Easy Digital Downloads. 4. Reach Out to WordPress Blogs and Bloggers Where do the people most likely to buy your themes/plugins already hang out? That’s right: the existing WordPress blogs. If you offer a review copy of your product, many top blogs will be happy to put you in the shop window by publishing an in-depth review. This is a great way to show potential buyers your product’s main features, as well as providing a demonstration of how to use the product. My advice is to contact every top WordPress blog you can think of, including the writers that regularly contribute to them. If you cast your net wide enough, you’re bound to get some interest, and this is often all it takes to start building some momentum. Final Thoughts The famous line from Field of Dreams — “if you build it, they will come” — just doesn’t apply to business in the real world. I’m sure there are many WordPress developers building exceptional themes and plugins that are earning nowhere near what their talent deserves. Remember: When it comes to business, a great product on its own isn’t enough. You also need an effective promotional strategy. Every developer will promote his/her products differently, but the four tips in today’s post are easy to implement and general enough to be a solid starting point for any developers looking to launch a commercial WordPress business. Now it’s over to you. Do you have any more tips you’d like to add? Then share your expertise in the comments section below! Featured image courtesy of GotCredit.
Welcome to another edition of Pagely’s 8 Question series. This week, we have Juan F. Aldasoro in the hotseat. Juan’s biggest contribution to the WordPress community is through his excellent theme shop, NiceThemes. Beyond this, he is heavily involved in the Argentinian WordPress community, helping to organize several important events. As always, be sure to follow him on Twitter, @juanfraa. The interview will follow the usual format, with eight questions relating to Juan’s WordPress background, how his involvement in the community has changed, and the direction he thinks WordPress is heading. A big thanks to Juan for answering our questions. This is what he had to say: For readers less familiar with you, could you tell us a little about yourself and your WordPress background? I was born in Argentina, three decades ago. In my teens I started experimenting with design and programming. In 2007 I started an intense romance with WordPress, and I have worked mostly with it ever since. Today, I create WordPress premium products at NiceThemes. I also co-organized the recent WordCamp in Buenos Aires with my friends at WP Argentina, where we try to run different events and organize the local community. You’ve been in the WordPress community for several years now, but could you tell us how you first became involved with WordPress? I first became involved online, in the forums, learning. Although Buenos Aires held 3 WordCamps prior to my first proper interaction with the community, by the time I wanted to attend a meetup or a WordCamp, the local community was nearly dead. My first proper interaction with the WordPress community was back in 2012 during WordCamp UK in Edinburgh. At that time I was traveling around Europe and thought it would be a great idea to attend an event of this sort. And I was right. After that day, I started dreaming about having something similar in my city. During your time in the community, what different areas have you been involved with? I’ve helped with Spanish translations, helped people around the dot org forums, contributed code, educated my customers, and created a plugin to help Latin American WordCamps to process their payments. I’ve also done public speaking, co-organized local meetups, and the recent WordCamp in Buenos Aires. What has been the best thing about working with WordPress for you? The best thing behind any community is the people in it. WordPress is not the exception. There’s a lot of nice and talented people, and you can learn new things every single day. The doors are open, so you can be part of the tool that is used by a quarter of the internet, too. How has the WordPress community changed since you started? It’s larger. There are more resources, information, events. There are more debates about the future. The market share has grown, a lot. As a result, there are more options when it comes to creating things on top. There’s a commercial ecosystem. I think the essence is still the same. I am of the idea that the main focus should be to maintain that essence. What advice would you give to anyone getting started with WordPress? Which direction would you yourself go if you were starting over again? It depends on the profile. I think a generic answer to this question would be: Try to get involved. If I were starting over again I would try to get involved more in core and the community. What do you think the biggest mistakes WordPress website owners are making? I think we’re not doing a good job educating website owners and newcomers. They are always looking for the ultimate solution, and there’s no such thing. We should try to spend some time explaining why is that there’s no ultimate solution. What do you think the future of WordPress holds? What would you like to see? I would like to continue seeing balance and debate around the community. I would also like to see the rise of strong regional communities outside mainstream. Internationalization will play a key role in the future of WordPress and its quest on gaining market share. Speaking of technical aspects, it’s pretty obvious that JavaScript and a strong mobile support will be part of the future. I also see more enterprise development/support outside the US and Europe. Final Thoughts Another big thanks to Juan for answering our questions! As always, they made a great read. It’s great to see the WordPress thriving all over the world. A quick look on the WordCamp website shows me that there are upcoming events in Brazil, Bulgaria, Denmark, South Korea, Czech Republic, Netherlands, and Peru. In other words, wherever you live, there’s a good chance there’s a WordCamp coming somewhere near you. This gives you the perfect opportunity to get out there, learn more about WordPress, and involve yourself in your local WordPress community. As Juan (and many of our other interviewees) have suggested, this is a great place to start. Before we finish, here are the all-important links to Juan’s theme shop, NiceThemes, and his Twitter profile. Thanks for reading everyone! We’ll be back with another interview next week!
Welcome to the latest Pagely 8 Questions interview! For this week’s edition, we’re lucky enough to have Tom McFarlin answering our questions. Before we start, be sure to follow Tom on Twitter, and also check out his latest WordPress thoughts, tips, and tutorials on his personal blog. Tom’s biggest claim to fame in the community, however, is his highly regarded custom WordPress development service, Pressware. In today’s interview, we’ll be talking all things WordPress with Tom — including his involvements in the WordPress community, his best experiences of working with WordPress, and the direction he thinks the platform is heading. As always, we’re hugely grateful that Tom was able to answer our questions. Here’s what he had to say. For readers less familiar with you, could you tell us a little about yourself and your WordPress background? I’m a self-employed WordPress developer who runs a small shop called Pressware. I focus primarily on custom solutions for clients — though I’ve dabbled in building products and selling them, I’ve always come back to contract work as I enjoy the challenge of solving problems unique to different industries. I also blog daily about a variety of things (though generally WordPress related), and you can typically find me throughout the day sharing random things on Twitter. You’ve been in the WordPress community for several years now, but could you tell us how you first became involved with WordPress? My first experience with WordPress was back in college. The school was looking for a couple of students to blog about their day-to-day life as a student at the school and so I opted to do so — I enjoyed writing, had maintained a blog back on BlogSpot (back when it was BlogSpot), and thought it sounded like something fun to do. I forget the exact version of WordPress that I used at the time, but it was back during the Kubrick days. My first experience with working with modifying the theme came in the form of basically messing around with the core theme files — I didn’t know anything about child themes at the time, so I just used what PHP I knew to make the theme do what I wanted. Once I graduated, I finished the blog and went to work for a major internet company, primarily working as a software engineer in .NET. During my free time, I still maintained a blog on WordPress, but it was generally treated as a public notebook of things that I was learning in my career. After I opted to go self-employed, I divided my time between Rails and WordPress and eventually went full on WordPress and that’s where I’ve been ever since. During your time in the community, what different areas have you been involved with? I’ve worked on everything from free themes, commercial themes, custom themes, free plugins, commercial plugins, custom plugins, and even building web applications on top of WordPress. I’ve attended meet ups, WordCamps, participated in podcasts, and have spoken on a variety of topics, and generally have tried to stay as involved in the community as possible given the demands of day-to-day life, as well. What has been the best thing about working with WordPress for you? For me, it’s really been the people with whom I’ve worked and the problems I’ve had the opportunity to solve. It’s really fun to learn different industries, their needs, and what they need as a solution, and be able to work with them to provide them with what they need in order to get the project done correctly. How has the WordPress community changed since you started? This is tough to say. I mean, I think people have consistently been opinionated about what they do and don’t like when it comes to WordPress and all things tertiary to it. That will probably always be the case, and as much fun — or not — as that can be, I think that it does help drive some of the decision making that goes into the core application. As far as the development community is concerned, more shops have popped up — some large, some small — and the general economy around the application has grown tremendously. What started off as a blogging platform has moved into something far more mature — we’re doing more with WordPress now than I think we would have ever thought possible just, say, eight years ago. What advice would you give to anyone getting started with WordPress? Which direction would you yourself go if you were starting over again? This is tough to say because I think it takes time to really find what your interests are. Is it design? Is it themes? Is it plugins? Is it code reviews? Is it building things? I mean, you really have to experience a plethora of what the application and the economy has to offer before settling on the aspects that cater to you and your customers most. And that’s probably the general advice I’d give to anyone — participate in a number of the available projects (after all, they’re all open source), blog about your experiences and try to get others to chime in with their experiences, advice, and so on, and then continue to repeat that until you find exactly what it is that sits as close to the intersection of what you love to do and what provides a living or side income (whatever your goal). What do you think the biggest mistakes WordPress website owners are making? That’s a tough call because I think that it requires me to make a generalization and I’m really not a fan of doing that. With that said, I’m a big proponent of keeping the presentation separate from the functionality, but that’s developer-speak. It’s jargon to everyone else. Therefore, the people who are buying these one-stop-do-all-the-things themes don’t really get the theme lock-in that they’re experiencing. Who knows how other plugins will play along with the theme they’re using and who knows how easy it will be to customize the theme to their liking once purchased. Often times, I think there is a disconnect between what the marketing of a theme offers and then what the customer experiences when they install and begin working with the theme. That’s our fault — that is, the developers and the designers. We’re showing what can be done with the theme but aren’t showing how it can be done with the theme. That’s a problem that we need to address sooner rather than later. Perhaps easier to access manuals, videos, and other educational material. Otherwise, someone purchases a theme and then they still have to go hire someone to help them get the theme to do what they want based on what they’ve seen. What a poor experience that creates. Anyway, I know I’ve not really answered your question because I don’t think it’s really the problem of the website owners, per se, it’s the solutions we’re marketing to the website owners and then they’re left with problems that they don’t know how to fix. And though that’s kind of a backwards answer, that’s the one I’m going to stick with because it’s something that I believe is so prevalent, and such a problem. What do you think the future of WordPress holds? What would you like to see? In short, the future of WordPress is really going to be paved with what’s possible with the REST API. I think seeing what we’re going to be able to do with “headless WordPress” or just being able to connect to WordPress and talk to it without having to actually work with the dashboard or the back-end (whatever term you prefer) is going to be really, really cool. In terms of what I’d like to see: I’d love to see more web applications built on top of WordPress – not just sites or themes or plugins. I’d like to see more full-fledged web apps built on top of the platform. And though that’s what I’d like to see, I think we’re still quite a while away from actually seeing that happen. It’s coming, though :). Final Thoughts Once again, an enormous thankyou to Tom for finding the time to answer our questions. I think that Tom’s point about the gap between theme marketing and actual user experience is a good one, and something that’s not often discussed. Aftercare is often just as important as the product itself, and thorough documentation is a great way for you to differentiate yourself, by helping your users get the most out of your products. With all the effort that goes into developing WordPress themes and plugins, it wouldn’t take much to produce video tutorials demonstrating all the main features — and that would mean more happy customers, more positive reviews, and more sales. Let’s wrap things up by sharing Tom’s links again. If you have a custom development project, I’m sure Tom’s highly regarded Pressware will be able to help. You should also check out his personal blog where he shares WordPress thoughts, tips, and tutorials on a daily basis. He’s also very active on Twitter, @tommcfarlin. I hope you enjoyed the interview, and I’ll see you again next week!
Pagely is thrilled to announce our partnership with Object Cache Pro. Utilizing state of the art compression technology, Object Cache Pro is now part of Pagely’s core offering, and available to all of our customers, platform wide. Offering major cost savings, access to some of the world’s best technology, and a dedicated DevOps team to personalize your setup, Pagely customers can look forward to continued scale and growth, with no hosting friction. A first of its kind partnership, Pagely is proud to help fund innovation in this WordPress space by investing part of our budget into working alongside the fantastic team at Object Cache Pro. We’ve already seen great gains with Object Cache Pro and our customers can look forward to more in the future! Why Object Cache Pro? Before Object Cache Pro, we faced two challenges with sites making use of an object cache – CPU overhead and network saturation. The underlying technologies in Object Cache Pro solved both of these problems for us, translating to less money spent on server hardware and fewer situations where the (quite generous) AWS network limits are reached. With Object Cache Pro’s state of the art technology utilizing the Zstandard compression library from Facebook, without a lot of CPU overhead, compression is now done at the extension level, talking to and from Redis. This means less hardware, lower costs, and a better experience for our customers. Aside from supporting an efficient compression algorithm (zstd), Object Cache Pro also uses the igbinary serializer which is a drop-in replacement for the standard serializer in PHP. This works about twice as fast at serializing and unserializing data. Additionally, the data footprint is smaller when using igbinary and that translates into less memory being used by the underlying Redis service. We also found an in-depth comparison on igbinary vs other serializers on Blobfolio that you may also enjoy reading if you’re into this kinda stuff: https://blobfolio.com/2017/03/benchmark-php7-serialization/ With a wide selection of Redis plugins available in the WordPress marketplace, Object Cache Pro was the obvious choice for us not only because of their forward-thinking tech but also because of the dependability we have come to expect and appreciate from their brilliant team. All of this aside, Object Cache Pro is unrivaled when it comes to bug fixing, an extent to which is a rarity across opensource software. There’s a saying in the opensource community that goes, “there’s a lot of eyes so all the bugs get fixed.” But, more what we see concentrated use of the software by lots of users leading to fewer bug fixes for fear of breaking one users’ site. That, and, no one owns the codebase, so less can get addressed in a timely manner. Similarly, we are continuously impressed by their coverage of testing, fully unit tested with 100% code coverage. Further, switching over to Object Cache Pro gives Pagely customers access to our commercial relationship with their team, which means any problems our customers see are fixed within a few days. You benefit from our relationship. Fewer bugs in the caching layer and full unit testing is a good thing, and that’s something we stand behind. So, What’s in it for the Pagely Customer? We are the first premium host to achieve this level of partnership with one of the best technology companies in WordPress. Through our relationship with Object Cache Pro, every single Pagely customer benefits from the work we’ve done to secure that. But real talk, what’s in it for you? Major cost savings. Even when it means less revenue for Pagely, we’re constantly looking out for cost savings for our customers. By decreasing our dependency on more hardware, you see the savings directly on your bill. Access to a premium partner. Since you’re at a premium hosting provider, you automatically get access to the partnerships we’ve developed. What’s more? You don’t pay an extra licensing fee. The best tech, baked into your Pagely account. We’re always on the hunt for the best and most innovative technology for you. With no effort on your part, we do the legwork of implementing this tech across our technology stack. All you do is benefit from it. Bigger performance wins possible with a little extra code work. WordPress has a feature called Transients. It’s a way to store the result of a complex query or a long-running remote API call temporarily in order to make subsequent lookups for that data return a lot faster without doing the same expensive operation again. Normally without any object cache, transients are stored in the WordPress database’s wp_options table. When using an object cache, it is stored in memory. Adding a few extra lines to your code allows you to tap into the power of this API for incredible performance gains. Having an efficient object cache utilizing fast compression and serialization only increases those gains. A dedicated DevOps team. While others might catch on and jump on the bandwagon of partnerships like this, Pagely still stands above the rest in meaningful ways that translate to real gains for you, the customer. Our DevOps staff becomes your dedicated, in-house team. Our engineers handle all the setup and optimization to make sure your usage of Redis is optimized specifically based on your exact circumstances and needs. Other hosts don’t do that! When you partner with Pagely for your WordPress hosting at scale, you know you have selected the most forward-looking host driven by advances in technology, cost savings for you, and tangible outcomes that help your business thrive. Object Cache Pro Helped FanSided Scale So let’s get to a real-life example here. One of the first Pagely customers we switched over to Object Cache Pro was FanSided. Here you can see a dramatic decrease in network utilization on the Amazon Aurora RDS instance after implementing Object Cache Pro along with custom Transients Caching, which dropped usage from 1 Gigabit per second to 400 Megabit per second; and yielded even lower usage after some more optimizations were made. FanSided comprises a massive network of over 300 active websites and needed a fast solution to maxing out servers and using way too much CPU. Pagely found that solution in Object Cache Pro and implemented it with no effort on FanSided’s part to completely eliminate those issues. Here you can see how memory is no longer being maxed out after the date we turned on Object Cache Pro for FanSided. The proof is in the data, and here you can see dramatic drops in CPU usage after Object Cache Pro was implemented, as well as servers being maxed-out-no-more after the switch. Dramatic drops in CPU usage after implementing Object Cache Pro for FanSided. Read the full FanSided + Object Cache Pro case study here, and take it from our CEO: “In the vacuum of 1 website, a small performance gain is useful. At our scale of hosting, processing hundreds of billions of requests per month across thousands of AWS EC2 instances, a small performance gain to each site means a real and quantifiable benefit to our customers and our bottom line. Now what if that performance gain was not so small, but major. We sought out and partnered with Object Cache Pro after seeing the dramatic results in terms of performance and resource usage when testing. We have thus deployed their Enterprise solution fleet wide and the results speak for themselves.” – Joshua Strebel, CEO of Pagely
Catch up on the conversation. This piece comes as a followup to our CEO Joshua Strebel’s recent piece on why you should never pay your WordPress host for pageviews. Managed WordPress hosting has exploded across the hosting industry since Pagely created it way back in 2006. Overall, the level of innovation that the mainstream has brought to WordPress is amazing. Unfortunately, this sometimes comes with negative side-effects. As investors demand higher profits, many of these managed WordPress hosts are looking for ways to gain a quick and easy boost to their margins. Like we mentioned in our definitive guide to PHP workers, there are a few different metrics that are often misinterpreted, whether intentionally or not. Today, we’re going to talk about pageviews and their role in the managed WordPress hosting world. What Counts as a Pageview? Many hosts cite pageviews as a billing metric with vague term descriptions, if any exist at all. Even with clarified definitions, pageviews tend to mutate on a host-by-host basis with a dizzying array of buzzwords. Although individual managed WordPress hosts vary on what they consider a “pageview”, most define it like this: pageviews are the number of unique IP addresses that access pages on your WordPress site per day, excluding known bots. (Yeah, I know. The term is more like “the number of unique request sources per day, based on predefined catch-all filters.” But I wasn’t the one that made this up, so bear with me here.) Pageviews as a Billing Metric Before we dig in any deeper into the details, let’s think about the definition that I mentioned. Considering that narrative, which of these sites would be more expensive to host? A directory website that houses billions of pages, showing 1,000 entries at a time. A personal blog who’s majority of traffic is to single posts. A documentation site where visitors typically access multiple pages per day. A simple informational website for a local restaurant. An online shop that sells small-batch artisanal snake oil. An API that uses headless WordPress to dynamically fetch content. If you guessed that they represent the same metrics in the eyes of pageview-based billing, your logic prevails! Assuming that they all experience the same number of unique visitors, they’re all treated the same way, regardless of how resource-intensive the site is or how many pages each visitor accesses. Of course, it would be silly to treat all of these sites the same way. Some pages might have large amounts of fully dynamic content, while others might be eternally served from cache. Using an umbrella term like pageviews as a billing metric causes several different issues, based on the site being hosted. Setting Realistic Expectations The first issue that pageview-based billing causes is an unrealistic expectation for low-performance, unoptimized sites. If you’re not familiar with how WordPress sites perform on the server side, you might think that these limits matter exclusively and use them to determine what capabilities you need from a hosting provider. If you’re evaluating your hosting options purely based on a pageview limit, you’re ignoring critical factors that can dramatically impact your WordPress site. Performance-Based Punishment What if you’ve put hard work into optimizing your site? Well, now you’re wasting money on a billing metric that doesn’t matter. If your site is highly cacheable, you’re feeling the impacts even further. When serving content from cache, it’s practically free from a hosting perspective. You’re being nickel-and-dimed for something that is entirely outside of your control. Knowledge is Power As you scale, knowing what you’re paying for can quickly become a critical part of maintaining a healthy, cost-effective site. Coupled with the fact that the same people who are charging for pageviews tend to hide their underlying infrastructure behind the curtains, there’s no way to verify or manipulate what’s being counted. While many claim that they exclude the known IP addresses and user agents of known bots from counting towards your monthly pageview bill, what’s their motivation for even bothering? After all, more pageviews mean more money in their pockets. Pageviews Are Still Helpful Many of our prospective customers ask, “How many pageviews can ‘x’ plan handle?” Like we mentioned earlier, the impact of each pageview dramatically varies based on the type of content viewed and how your site was developed. Every WordPress site is different. It would be impossible to accurately estimate the ideal hosting environment without a complete understanding of what your site’s usage looks like. Although pageviews are a faulty metric as far as billing is concerned, they can still be useful as part of a larger dataset. Whether you’re scaling, optimizing for better performance, or shopping for a new hosting provider, pageview data plays a role in getting a full picture of your site. For example, if you were running benchmarks to determine your server’s capacity, pageview data could be used to identify what a typical day looks like. Let’s say your site looks something like this: 10% of traffic is on the home page. 30% of traffic is to various landing pages. 30% of traffic is to different blog posts. 20% of traffic is to your product’s pricing page. 10% of traffic is on account-related pages. Using that traffic data, you could then estimate what types of content have the most significant impact on server resources. You may find that some pages underperform and could use some optimization, while other highly-cacheable content, like blog posts or landing pages, remain essentially free. If 90% of your traffic goes to fully-cached content, increases in traffic have a trivial impact on your bottom line, if any. Closing Remarks Operating a WordPress site at scale is all about a delicate balance of performance and cost. At Pagely, we partner with our clients to help them achieve those goals. While shopping for a new hosting provider, be on the lookout for hosts that impose false barriers, such as PHP worker limits and pageview counts. Those vague limitations are a red flag that they’re going to try to upsell you later. (These limitations are also a sign that they’re trying to sell you on shared hosting resources too, but that’s a topic for another discussion entirely.) We hope that you’ve learned more about the impact of pageviews (or lack thereof) and why it’s not an appropriate billing metric. Do you have any experiences with pageview-based billing that you’d like to share? Is there something we missed? Let us know in the comments below.
This monthly report is provided for the WordPress community at large from Pagely’s head of security, Robert Rowley. Rowley and the entire security team keep their finger on the pulse of any potential vulnerabilities that might affect our customers, as well as any WordPress user. We sincerely hope these efforts help any and all that could use information from the experts on monthly security issues. We commend the researches and developers that help to identify and patch these issues in a timely fashion. WordPress Core No notable WordPress core security releases. Plugin/Theme Vulnerabilities of Note Security & Malware scan by CleanTalk https://wpvulndb.com/vulnerabilities/10292 This vulnerability within CleanTalk allows an authenticated user, such as an editor or subscriber, to make unauthorized Ajax calls which could lead to file deletion or downloads and also potentially function calls. Adning Advertising https://wpvulndb.com/vulnerabilities/10293 The Adning Advertising plugin has a vulnerability in versions lower than 1.5.6 which allows unauthenticated requests to upload or delete files, leading to an RCE attack, which can then lead to full site takeover. Wise Chat https://wpvulndb.com/vulnerabilities/10299 Wise Chat versions lower than 2.8.4 are susceptible to a CSV injection via a command sent in chat messages by an unauthenticated user that is included in an exported CSV file, which then could potentially lead to an RCE attack. Email Verification for WooCommerce https://wpvulndb.com/vulnerabilities/10318 The Email Verification for Woocommerce plugin prior to version 1.8.2 is affected by a loose comparison issue. This could potentially lead to any user (authenticated or non-authenticated), to log into the WordPress site. SRS Simple Hits Counter https://wpvulndb.com/vulnerabilities/10316 The SRS Simple Hits counter plugin is currently vulnerable to an unauthenticated blind SQL injection vulnerability. The responsible reporting parties at Tenable ( https://www.tenable.com/security/research/tra-2020-42 ) are working with the developer to write a more comprehensive patch to address this vulnerability, and will not release more details on the attack until they know a patch has been released. Site owners using SRS Simple Hits Counter plugin on their sites should keep an eye out daily for the patch to be released. Payment Form For Paypal Pro https://wpvulndb.com/vulnerabilities/10287 The Payment Form for Paypal Pro plugin versions before 1.1.65 are vulnerable to an unauthenticated SQL injection attack. The attack is a trivial single request which can expose the contents of your database (which includes user passwords and potentially other secrets) to the attack. This is a high risk vulnerability and site owners should patch immediately. WooCommerce Subscriptions https://wpvulndb.com/vulnerabilities/10330 The WooCommerce Subscription plugin is vulnerable to an unauthenticated stored cross site scripting (XSS) attack in the subscription billing process. Attackers can submit their XSS attack payload to during the billing step in the signup process, and later that payload will be executed on the browser of the administrator/user who reviews the attacker’s account. Site owners should update WooCommerce Subscriptions plugin to version 2.6.3 and not check any new user account information until that update is performed. TC Custom JavaScript https://wpvulndb.com/vulnerabilities/10325 The TC Custom Javascript plugin is vulnerable to an unauthenticated stored cross site scripting attack. Sites running versions before 1.2.2 should update immediately, attackers can add their own javascript or HTML to the footer of all pages loaded by WordPress with a few basic requests. This vulnerability is likely to be targeted by SEO spam bots. KingComposer https://wpvulndb.com/vulnerabilities/10297 The KingComposer plugin is vulnerable to a reflected cross site scripting vulnerability in versions before 2.9.5 This means the attacker’s malicious HTML/javascript will only be available to the browser making this request. This still poses a high risk if an attacker can trick an already logged in user to click on a malicious link/form to the website, potentially exposing secrets viewable by the user giving them to the attacker. JobSearch https://wpvulndb.com/vulnerabilities/10328 The JobSearch plugin versions before 1.5.6 are vulnerable to a reflected cross site scripting vulnerability. Much like the KingComposer vulnerability above it is a high risk if logged in users to be targeted. The proof of concept for this vulnerability will be released on August 6th, 2020, site owners should patch before this date. See previous months’ WordPress security updates from May and June.
The benefits of this WordPress security guide are two fold: Learn exactly what you need to know about WordPress security in 2020. Understanding WordPress security helps you adopt a security-oriented mindset that will help you prevent and mitigate risks as you make day-to-day decisions. Get actionable, step-by-step instructions for securing your WordPress site. The steps you need to take aren’t particularly time-consuming, don’t require advanced technical knowledge, and the linked guides are vetted for clarity and completeness. Of course, it’s impossible to cover every possible vulnerability and scenario. That’s why we also include the overarching “principles of WordPress security.” If you can follow these broad principles many of the minute details that are difficult to address in this type of post will take care of themselves. Why is WordPress security critical? It’s important you understand how big an issue WordPress security is so you give it the time and attention it deserves. Here are some sobering statistics: Google blacklists 10k sites a day for malware and another 50k for phishing each week. A blacklist from Google kills that source of traffic which can be highly disruptive to a business’s revenue. Fixing and removing a blacklist can be a hassle, particularly if your server was used to send SPAM emails. A blacklist from email service providers harms your deliverability rate which undermines the effectiveness of your email marketing. In 2018, 90% of CMS hacks were WordPress. Granted, WordPress is the world’s most popular CMS with 34% of the web powered by WordPress, but this is still a disproportionate amount of hacks. For a variety of reasons, WordPress sites are targeted and exploited more than any other CMS. 60% of attacks target small businesses. You may think that hackers won’t bother with your site because you’re a small fish but “security through obscurity” does not exist on the web. No one is too small to be a victim of an attack. WordFence reports that there are over 97,978 attacks happening per minute. This is not a small, isolated problem. Large swaths of WordPress sites are being probed for weaknesses at any given time. Will you be ready if your site is targeted? While these stats paint an intimidating picture of what you’re up against, it’s important you confront the realities of managing a WordPress site in 2020. If your business relies on WordPress, security is not something you can afford to ignore. If you haven’t taken steps to secure your site, you’re vulnerable to attack. It could be only a matter of time until your site becomes compromised. This is one area where “an ounce of prevention is worth a pound of cure.” The principles of WordPress security Securing WordPress is more than checking off a list of boxes, it requires you to adopt a security-oriented mindset that guides your decision making. These principles will help you prevent mistakes as you make day-to-day decisions like adding new WordPress users, plugins, and themes: Vulnerabilities are often introduced by WordPress users. Vanilla WordPress that is kept up to date and uses strong passwords is relatively secure. It’s often the decisions made by WordPress users that create weaknesses that hackers exploit. This is why articles like this one are so important. It’s up to you to be educated on, and consistently follow, the WordPress security best practices outlined here. Minimize plugins and themes. New WordPress users are often overjoyed by the extensive ecosystem of plugins and themes available for WordPress. This can lead to indiscriminate installation of plugins. But, each new plugin or theme adds code to your site that, potentially, adds new vulnerabilities. By minimizing the plugins and themes installed, you also minimize the amount of code your site uses, and, by extension, the number of potential security vulnerabilities. In general, if you can solve a problem without installing a plugin, that’s the best option. Install updates as soon as possible. Updates to the WordPress core and updates to plugins and themes often contain critical security updates. They should be installed as quickly as possible. If you have a good back up strategy in place, you can roll back to a previous version in the event the update causes issues. Follow the principle of least privilege. This is a core principle of cybersecurity in general and is not unique to WordPress. This is a fancy way of saying, “don’t give a user more privileges than they need because those extra privileges give hackers more power and access than they’d otherwise have if they compromise that account.” Attacks can still happen. You can try as hard as you can to cover all the bases and still fall victim to an attack. This is why regular, automated backups are critical. Do not ignore this advice. A hacked site can be disruptive but can generally be fixed with minimal cost and disruption, a hacked site without a backup to roll back to can be severely disruptive. You are never finished with security. Having a 100% secure WordPress site is an impossible task. You can’t accomplish complete risk elimination, so aim instead for ongoing risk reduction. This “risk reduction” mindset prompts you to continue taking steps to improve your security as part of an ongoing, never-ending initiative. The most common WordPress attack vectors Understanding the most common methods hackers use to exploit WordPress will help you understand how to address them and why the steps recommended later in this article are necessary: Brute Force Attack A cyber criminal uses trial and error to identify a password or pin. They use combinations of common usernames and passwords until they find the right one. It’s the equivalent of trying every key on a key ring to find the one that works. This is all done using a computer script so they can run thousands of combinations with very little effort. Given enough time, any account is hackable but strong passwords thwart this kind of attack. SQL Injection Malicious SQL code is injected into a database to gain access to database information that was never intended to be displayed. Depending on the hackers goals, this can lead to your database being deleted, customer information being stolen, or sensitive company information being accessed. Malware A virus or spyware is inserted using an expired theme or plugin. The attacker can gain access to your data, insert pages into your site for black hat SEO, and perform a number of other nefarious activities using your site. Cross-site scripting Javascript code is inserted which then collects data commonly used to exploit WordPress plugins. This can be used to redirect your site visitors to malicious content. also known as an “XSS attack.” DDoS Attack A Distributed Denial of Service (DDoS) attack floods a website with traffic which overwhelms server resources causing it to fail. Multiple machines send frequent requests to the server using malware installed on those machines for that purpose. The distributed nature of the attack can make it difficult to identify and block the sources of the traffic. Now that you understand how hackers will attempt to breach your site security, let’s look at how we can block and prevent these attacks… Steps to secure your WordPress site In spite of the many ways your site can be compromised, it is possible to mitigate these risks and prevent many attacks. Here’s a list of recommended steps to protect your WordPress site from security attacks: 1. Force Strong Passwords “81% of attacks are based on insecure or stolen passwords” “It only takes about 10 minutes to crack a lowercase password that is 6 characters long.” These two facts taken together make the case that you must use strong passwords for all WordPress users. Strong passwords are long and use a combination of upper and lower case letters, numbers, and symbols. Longer is better but 20-characters is probably plenty. Strong passwords are difficult to memorize, especially if you’re using unique passwords for each site (you should be!). This means a password manager, such as LastPass or Dashlane, is a critical tool. These apps make creating strong passwords easy, store them in a central location, and make logging into your websites easy by autofilling your passwords. Here’s how to make sure all your WordPress users are using strong passwords. 2. Turn on automatic WordPress Core updates One of the advantages of using a popular CMS like WordPress is that there are many people with a vested interest in keeping it secure. Thousands of people are contributing to WordPress security by reporting vulnerabilities to the WordPress team. This widespread collaboration means most holes are patched relatively quickly. But, if the updates that contain those fixes are not applied, you leave your site vulnerable to attack. The best way to ensure your WordPress core updates happen quickly is to turn on automatic updates. This way your WordPress site will be kept up-to-date without you having to do anything. Here’s how to turn on automatic core updates by modifying your config.php file. 3. Stay on top of plugin and theme updates You absolutely must keep your plugins and themes up-to-date. The importance of this cannot be overstated. You’ll also want to be careful to use plugins and themes that are updated often. If you’re using a plugin or theme that has not received an update in months, it’s a good idea to check in with the developer or find a more frequently updated plugin that accomplishes the same goal. When you search for a plugin in the WordPress plugin database, this information is provided in the sidebar: 4. Use Two-Factor Authentication (2FA) Two-factor authentication adds a layer of protection to your WordPress site by making it nearly impossible for a hacker to log in to your site — even if they know your username and password. You should set up 2FA for all WordPress users. 2FA can be set up quickly with simple, free plugins. Here’s a list of available 2FA plugin solutions for WordPress. 5. Brute Force protection Even with 2FA and strong passwords, it is good to setup brute force protection to help with overall performance on the server by reducing the amount of work PHP has to do. Here’s how to protect your site from brute force attacks. 6. Create automated, scheduled Backups In the event of an issue, there should always be recent database and file backups available. You should also create a backup before making any major changes to your site, such as installing plugin and theme updates. Many of the popular backup solutions take care of this for you. Here’s a list of backup solutions for your WordPress site 7. Change your login pages The default login pages for all WordPress sites are sitename.com/wp-login.php and sitename.com/wp-admin.php. Using these default login page URLs makes it easy for hackers to begin a brute force attack by trying combinations of usernames and passwords. By using a login URL that is difficult to guess, it makes it more difficult for hackers to begin the brute force attack because they don’t know where the login form lives. Here’s how to change your login page URLs. 8. Use SSL Secure Sockets Layer (SSL) encrypts all data sent from your website to the visitors browser obscuring potentially sensitive data. Using SSL has many benefits in addition to security. Google may rank your site higher in the search results and many browsers indicate whether a site is secured by SSL which can reassure them your site is trustworthy. Here’s a tutorial on setting up SSL for your WordPress site 9. Don’t use the default database prefix Using the default “wp_” database prefix makes it easier for a hacker to insert code into your database (SQL injection). Here’s how to change the default database prefix for a new site and an existing site. 10. Check your folder and file permissions File permissions define what actions can be applied to the files on your server. You should never set any WordPress file or directory to 777 permissions. Instead, make sure your permission scheme is as follows: Folders – 755 Files – 644 Here’s a guide to checking and fixing the permissions of your WordPress files and folders. 11. Disable pingbacks WordPress pingbacks are enabled by default. But for most sites, they offer little benefit. But, they can be used to turn your WordPress site into an unwilling participant in a DDoS botnet. To turn off pingbacks, you can go to “Settings –> Discussion” and uncheck the “Attempt to notify any blogs linked to from the article” box. It’s also a good idea to uncheck the “Allow link notifications from other blogs (pingbacks and trackbacks) on new articles” box: 12. Hide your WordPress version number One of the ways attackers gain access to a site is by exploiting known vulnerabilities in outdated versions of WordPress. Hackers can scan your site and easily find out what version of WordPress you’re using. If that version has a known vulnerability then the hacker has a good idea of how to proceed. The best way to prevent this is to keep WordPress up to date. However, you can also prevent a hacker from finding out what version of WordPress you’re running. Here’s how to hide your WordPress version number. 13. Don’t use the admin username Hackers can safely assume that a WordPress site is using the default “admin” username and that username will give them admin privileges so all they need to do is figure out the password. This gives them a direct path to gaining admin access to your site with a good probability of success. Eliminating the admin username makes it significantly more difficult to attack your site this way. If you’re already using the admin username, that’s okay, you can change it now. Here’s how to change the admin username. 14. Use a secure Managed WordPress Host A host that supports all the major CMSs will have difficulty staying on top of WordPress security. By specializing in the WordPress CMS alone, a WordPress hosting provider can devote the resources necessary to prevent many attacks. A reputable Managed WordPress Host will have a security team dedicated to shielding your site from threats. They’ll handle many of the concerns raised above like taking care of WordPress updates, creating backups, and more. Here at Pagely we have a comprehensive suite of security features called PressArmor that handles both WordPress application security and server security. Security questions to ask a potential managed WordPress host: Is your hosting environment chrooted? If your host has multiple domains on the same server, check with them to ensure they use chroot to isolate each WordPress app. If one app is hacked, this would help prevent access to other apps on the server. Is SSL included and easy to set up? A good WordPress hosting provider will provide SSL free of charge using a service such as Let’s Encrypt. Do you actively monitor my site specifically for WordPress vulnerabilities? If you detect a vulnerability on my site, how will you inform me? A good WordPress host will stay on top of the latest threats to WordPress sites and constantly scan your site for those threats. If they find a vulnerability, they will work with you to address it. Are you using a web application firewall (WAF) to protect my site? A WAF block malicious traffic before it reaches your site and can help prevent XSS attacks and SQL injections. Here’s a list of important considerations for choosing a Managed WordPress Host. Conclusion WordPress security cannot be taken lightly and you must take steps to secure your site. Using a Managed WordPress Hosting Provider like Pagely is one of the best ways to improve your security because you will have an experienced team dedicated to protecting you. Whether you choose to handle WordPress security yourself or leverage a host that specializes in WordPress, it’s important to treat WordPress security as an ongoing effort. You are never done with security but if you’ve taken the above steps you’ve protected yourself from many of the most common threats.
Since this is the internet – and the rules of the internet clearly state everyone gets an opinion, I’d like to share one of mine around website hosting billing plans. Quick backstory: 10+ years ago when we launched Pagely we did so with a simple line on our pricing page denoting a rough estimate of the expected capabilities of that plan ie: Plan – 1 was suitable for ~1 million pageviews. Along came the next several providers who did something similar with one important difference. They actually attempted to measure and cap pageviews per hosting plan, bracketing their plans by this new billing metric. In my opinion Pageviews used as a billing item is a predatory and anti-consumer practice and you should be very wary of working with any company that applies this #successtax to your monthly bill. Definition of anti-consumer : not favorable to consumers: improperly favoring the interests of businesses over the interests of consumers Hi, I’m Joshua Strebel, Co-founder and CEO of Pagely – A leading Managed WordPress hosting company – Thank you for attending my TED Talk. What are you buying when you are buying “hosting”? To host a WordPress site you need a few key components. A server (a computer) connected to the internet with software installed to process requests and responses for your application. Storage / Disk space attached to that webserver to save your files to. Data Transfer / Bandwidth. This is the pipe the information flows through. That’s basically it. Hosting providers typically lease/sell you packaged fragments of these resources for a monthly fee. Plan A, Plan B, Plan C. etc. Of course there are other items that may be line-itemed such as included support levels, CDN GB’s per month, managed services, etc. Plan A has X amount of consumables for Z price. It’s all fairly straightforward as most consumers understand what a Gigabyte of Disk space is and can at least grasp that more CPU/RAM offered should equate to more potential performance. “Pageviews” does not fit this model well – as the definition of a pageview is amorphous and subject to exploitation. Oh, and spoiler alert, PHP workers is not a valid billing metric for WordPress hosts either. What does an automobile lease have to do with hosting plans? Pageview limits on hosting plans are akin to annual mileage limits on auto leases. It’s a cap on the use of an asset you already purchased. In an automobile lease context a mileage cap at least has some merit as being a form of controlling the depreciation of the vehicle – you are essentially financing the deprecation of the automobile asset with a lease – and the lease company expects to sell that car (New retail value – Depreciation) when you return it. If the depreciation is too high, they lose money on that transaction as they have to sell it for less than they calculated. Your hosting plan is not a depreciating asset though – the hosting company is going to sell the same resources to the next customer when you are done for the same or likely higher fee. Therefore in my humble opinion: Pageviews are just an arbitrary anti-consumer fee – a penalty tax for using the service you already paid for. A Pageview is (depending on who you ask) a wrapper around these items: A measurable amount of Data Transfer in and out A measurable amount of CPU resources to process the request and render the response A measurable amount of Disk and Database activity Are you not already paying for these items as part of your hosting plan? Hint: Yes you are. But wait, there’s more – and my colleague will dig into these more in a future post. This pageview billing model is so poorly defined by the hosts that use it – it is ripe for abuse. It’s a scheme to generate revenue for the hosting company and unfairly penalizes the consumer. Hint: You already “paid” for the sum of the parts of a “pageview”. No two pages are the same. A cached page even with a few images can be served a million times a month with ease, and yet a badly coded membership-site page may tax the hardware it runs on each time it loads. They have very different cost profiles to the host – yet both are treated equally under this model. If you invested the time to optimize your site, get it caching well and then blow it up with viral traffic.. That is a GOOD day for you and costs your host pennies of the monthly fee you are already paying them – yet when you get the overage bill for exceeding your pageview cap at the end of the month, are you going to enjoy that tax on your success? If you want to keep paying twice for the same resources you are welcome to. I simply do not think that is fair. Our friends down in Austin have made millions on charging their customers overage fees for exceeding their monthly pageview cap – even to the point having to publicly respond to criticism – only to keep the practice in place. Reminds me of airline baggage fees and fuel surcharges. and An “online payment convenience fee” when they only accept payments online. and JetPack being “free”. Happy WordPress’ing – Joshua Strebel
These monthly reports are provided for the WordPress community at large from Pagely’s head of security, Robert Rowley. Rowley and the entire security team keep their finger on the pulse of any potential vulnerabilities that might affect our customers, as well as any WordPress user. We sincerely hope these efforts help any and all that could use information from the experts on monthly security issues. We commend the researches and developers that help to identify and patch these issues in a timely fashion. WordPress Core WordPress 5.4.2 Security Release https://wordpress.org/news/2020/06/wordpress-5-4-2-security-and-maintenance-release/ A WordPress Security release (5.4.2) was made available on June 10th. This release addresses the following 6 vulnerabilities: Authenticated XSS in the block editor Authenticated XSS in media files Authenticated XSS in theme uploads Privilege escalation in set-screen-option() Open redirect in wp_validate_redirect() Information leak allowing comments to be read from password-protected posts and pages. Plugin/Theme Vulnerabilities of Note Removed from Repo WordPress website owners who have the following plugins installed are strongly encouraged to remove them from their websites or find a replacement as soon as possible. These plugins were removed from the WP.org plugin repository due to inaction of the developer to patch one or more security flaws: wp-pro-quiz delete-all-comments-easily High Severity Vulnerabilities ACF to REST API https://wpvulndb.com/vulnerabilities/10284 The acf-to-rest-api plugin versions before 3.3.0 are affected by a vulnerability which would disclose the values of the wp_options table to attackers. This vulnerability has varying severity based on what data is contained in a site’s wp_options table. KingComposer https://wpvulndb.com/vulnerabilities/10270 The kingcomposer plugin versions before 2.9.4 lack proper access controls for ajax endpoints, many of these ajax endpoints also include vulnerabilities which users with a valid accounts could target to change WordPress option values, inject content, store XSS code, delete files on the site or execute arbitrary code. wpDiscuz https://wpvulndb.com/vulnerabilities/10273 The wpdiscuz plugin versions before 5.3.6 are affected by an unauthenticated SQL injection vulnerability. This plugin is currently on release 7.0.3, and the plugin author is making 5.3.6 available as a back port for site owners not ready for version 7. Brizy – Page Builder https://wpvulndb.com/vulnerabilities/10261 Brizy Page Builder before version 1.0.126 is susceptible to an access control vulnerability via AJAX calls which allows a user with minimal privileges the ability to access editor functions. JobSearch https://wpvulndb.com/vulnerabilities/10255 The Jobsearch premium plugin before version 1.5.1 is affected by an unauthenticated reflected cross-site scripting vulnerability. The Proof of Concept is provided within the link below and is easily replicated: https://github.com/vladvector/vladvector.github.io/blob/master/exploit/2020-07-03-jobsearch-wp-job-board-wordpress-plugin-v1-5-1.txt See previous months’ WordPress security updates from April and May.
This article covers our public notifications related to major security issues our clients and the WordPress community should know about. We are always focused on prevention and the mitigation of risk to our clients, and keeping you updated here is part of that process. WordPress 5.4.2 Security Release June 11th, 2020 WordPress site users We trust them within reason. And patch, to be sure. The WordPress security team has released WordPress 5.4.2. This security release addresses 6 security vulnerabilities. There are numerous cross site scripting vulnerabilities addressed in this release however each required an authenticated user to execute the attack. There also includes one privilege escalation attack. If there were a theme in this release, it serves as a reminder to be sure you trust who you give accounts to on your WordPress site. The Pagely team has already begun rolling out this patch for all customers. If you have a version hold request on file, we will patch your site while keeping it on the same major branch version. WordPress 5.4.1 Security Release April 29th, 2020 You are safe at home, while we are patching your sites. Stay Safe. Stay Secure. The WordPress security team has released WordPress 5.4.1. This security release addresses 7 security vulnerabilities and includes 17 bug fixes. There are numerous cross site scripting vulnerabilities addressed in this release, so it is recommended site owner update right away (if you’re a Pagely customer we are already working on this for you.) The Pagely team will be rolling out this patch for all customers shortly. If you have a version hold request on file, we will patch your site while keeping it on the same major branch version. WordPress 5.3.1 Security Release December 13th, 2019 A vuln is a vuln, until a patch is released. Now it is secure. The WordPress core team has released WordPress 5.3.1, which addresses 3 security vulnerabilities and includes 1 security hardening measure. The higher risk vulnerabilities include XSS (Cross Site Scripting) in some unlikely situations, as well a vulnerability which could allow someone to mark a post “sticky” on the site, without the need for authentication. Pagely has tested this version and has the patch available for all customers running any WordPress version. Due to the weekend being upon us, we will begin upgrading sites on Monday December 16th. Any customers who would like the upgrade to be performed over the weekend can reach out to our support staff and they will be glad to help. PHP-FPM+Nginx Remote Code Execution (CVE-2019-11043) October 29th, 2019 Hasty vuln released. We checked immediately; Our servers are safe. On October 22nd, 2019 a security researcher released their findings related to a remote code execution in PHP-FPM, which was present on hosts with specific nginx configurations using fastcgi_split_path_info. Pagely’s stack does use the fastcgi_split_path_info directive within our nginx configurations, and our staff investigated the vulnerability on the 22nd the day of the relase. We identified we were already properly using the recommended remediation of try_files to ensure the file being requested actually exists on the website. Pagely’s default nginx configuration is not vulnerable. On October 24th the PHP dev team released the official patch version to address this vulnerability. Our staff have already started applying this patch to all customer servers. WordPress 5.2.4 Security Release October 15th, 2019 Secure WordPress Fast Six Vulnerabilities Secured by this Patch. The WordPress.org core team has released WordPress 5.2.4, a security release addressing six vulnerabilities from XSS to viewing unauthorized posts. Pagely staff have already begun applying patches to our customer’s WordPress websites. Customers with version holds will only receive the patch for the branch they are currently running. WordPress 5.1.1 Security Release Addresses XSS March 15th, 2019 Comment filter for Cross Site Scripting prevention; Helps secure WordPress. The WordPress.org core team has released WordPress 5.1.1 which is a security release to address two vulnerabilities related to improper filtering of comments on WordPress sites. Pagely staff have already begun applying the patch for each of our customer’s WordPress version, and will keep customers on their current branch version if they have requested a version hold. WordPress 5.0.1 (and 4.9.9) Security Release December 13th, 2018 WordPress new release Patches seven vulns in all. Handled by our team. The WordPress.org core team has released WordPress 5.0.1 which is a security release to address a number of vulnerabilities found in WordPress versions 5.0, 4.9.8 and older. The core team has also provided security releases for WordPress versions 4.9.x, 4.8.x, etc.. which addresses the same vulnerabilities for that WordPress branch release. Pagely staff will apply the appropriate patch for each of our customer’s WordPress version, and will keep customers on their current branch version. This means, if you’re running 5.0, we will apply the 5.0.1 patch, if you’re running 4.9 then we will apply the 4.9.9 patch, and so on with 4.8 and etc… This patching will be completed by the end of the week. WordPress 4.9.7 Security Release Addresses Arbitrary File Delete (CVE-2018-12895) July 5th, 2018 We patched this last week. This security release is safe to wait for. The WordPress.org core team has released WordPress 4.9.7 which adds some functionality and includes a security patch for the previously reported “Arbitrary File Delete” vulnerability (CVE-2018-12895) which we addressed last week Pagely implemented a patch to address this vulnerability on all customer websites, as there was no WordPress.org patch available when the vulnerability was publicly disclosed. Pagely customers can request to be upgraded to patched versions of WordPress over the weekend, all customer sites will be upgraded by early next week. WordPress Author Arbitrary File Delete (CVE-2018-12895) We trust our authors, to not delete files, but let’s not allow it. RIPSTech researchers Slavco Mihajloski and Karim El Ouerghemmi reported yesterday of a vulnerability in WordPress core which would allow users on a WordPress site with Author level access or higher the ability to delete and/or re-upload any file writable by the PHP process WordPress runs under. The limitation of this vulnerability hinges on the fact a malicious user must also be someone a site owner trusted with having author level access already (or a compromised author user account could be abused) The consequence of this vulnerability would be that an attacker or malicious user could potentially remove files on the server, which may disable protections (such as .htaccess files, or security plugins), or allow them to re-write a site’s wp-config.php (to point your site at the attacker’s database, or install their own credentials/secret keys.) Our infrastructure configuration does not allow PHP processes to be able to modify any WordPress core files, however the risk of modifications to plugins, .htaccess files or other user uploaded files remains. To address this we have implemented a recommended hotfix which sanitizes the file path in the attachment delete/modification function used by WordPress core. The patch implemented has been tested and verified as safe and will be pushed out to our customer servers this week. If for any reason this hotfix causes issues with your site user’s ability to remove or edit media on your blog, please let our support staff know and we can help sort out the problem. PHPMyAdmin File Inclusion and Remote Code Execution (CVE-2018-12613) (PMASA-2018-4) Admin your DB with php, securely. We did the upgrade Pagely customers who have phpMyAdmin configured on their servers can rest assured we have taken steps to upgrade all of our customer’s phpMyAdmin installations to address multiple vulnerabilities recently reported. TLS 1.0 Retirement It’s been a long time coming, so break out the gold watch and cake. TLS 1.0 is finally being retired across the web thanks to the push by PCI-DSS. Pagely is updating our customer websites this week to address this and will be supporting TLS 1.1 or higher by default on our servers this week. By default, customer websites will only communicate over HTTP using the more secure TLS 1.1 and 1.2 protocol versions, and TLS 1.0 will no longer be an option. The reason for the change has been a long time coming. There are multiple browser based vulnerabilities in TLS 1.0, and the protocol version has been depreciated for years. However, the big deadline is that PCI-DSS counsel has set a hard deadline for June 30th, 2018 as the final day that sites will no longer be able to pass PCI scans if they have TLS 1.0 enabled in any manner. The impact of requiring TLS 1.1 or higher, is almost certainly going to be negligible. Every major browser supports TLS 1.1 and 1.2, rough estimates put less than 4% of the global internet traffic as using a browser that only support TLS 1.0, this is mostly composed of old mobile devices. So, sorry everyone on a dated iPad or Android tablet/phone, it’s not safe for you to transmit data over HTTPS and hasn’t been for a long time! Luckily, this number continues to drop every year, as these old devices eventually get replaced or taken out of service. Pagely Login Page Updates Pagely customers will notice something new when accessing their Pagely administration panel https://atomic.pagely.com on May 31st 2018. Our new login portal! Don’t worry, this change is expected as we are rolling out some improvements to our administration panel and preparing for it’s replacement. When you visit https://atomic.pagely.com your browser will automatically be redirected to our new version of Atomic. You may see the words “BETA” here and there, and some customers (those already upgraded to ARES) will have new features available as well. There is nothing you need to do on your end at this time, your login will function as normal and the new atomic panel has all the same basic features as the old one — If you’re feeling a little nostalgic, you can still switch back to the old Atomic panel by hitting the “Atomic (Legacy)” button found in the panel. In the near future we will be offering a new 2FA feature to give our customers a better experience with their 2FA management, but this first login portal change on 2018-05-31 will not affect your existing login credentials. PHP Security Patch (CVE-2018-10546 CVE-2018-10547 CVE-2018-10548 CVE-2018-10549) You need a null byte; Or you get heap overflows! MakerNote take Note. PHP has released a security patch which addresses four security vulnerabilities, the worst of which is a heap overflow from uploaded images which lack null bytes or corrupted EXIF data in MakerNote files. Further details available in the PHP 7.0 Changelog and PHP 5.6 Changelog. Pagely has begun upgrading customer servers and all PHP versions will be on patched in the next few days, if not already. WordPress 4.9.5 Release Secure hardening in the four nine five release; Other bugs fixed too. WordPress version 4.9.5 has been released and is considered a security and maintenance release. The WP core team addressed 3 security related bugs which are not critical security bugs, but improve the code’s overall security. You can read more about the release here. Pagely will begin updating customer sites to 4.9.5 shortly. POP-ping WordPress Object Injection? DNS must be trusted. Or else, oh no! Hacks! Researcher Nick Bloor (@nickstadb) recently released a report on object inject+DNS vulnerabilities in WordPress which could lead to remote code execution/arbitrary file uploads to sites. Nick explains that if attackers control the name servers the website uses to lookup domains, then it’s possible to “spoof” being the WP update server due to WordPress defaulting to HTTP communications when HTTPS fails during updates. This report outline that if attackers were able to take control of a DNS server, they could pivot that access to then also take over WordPress website via the WordPress auto-updater as well as exposes a PHP Object injection as well. Pagely customers are not affected by this vulnerability, as we are a managed host and do not allow modifications to what name servers our customer’s servers utilize. Secondarily, our server permissions would not allow WordPress auto-updater to function on it’s own (we handle upgrades for customers), this is identified in the “caveats” section of the vulnerability disclosure page as a preventative measure. WordPress load-scripts.php DoS (CVE-2018-6389) Feb. 6, 2018 Loading all the scripts, leads to long web responses. Rate limiting, Win. We are aware of the reported Denial of Service (DoS) affecting WordPress’s /wp-admin/load-scripts.php; Assessing the risk we believe our caching system dramatically reduces any DoS threat targeting a single URL with scripts like this. We are implementing a fix which is currently in testing, it will limit the number of requests people can make to this file before being throttled and subsequently blocked. This fix will be available for all customers, including those on the new ARES platform. WordPress Security and Maintenance Release: 4.9.2 Jan. 16, 2018 Other people’s code How did it get on your site? Sad emoji face. WordPress version 4.9.2 has been released and it contains an update to address an insecurity in the Media Elements library, which is included in WordPress core. The patch addresses a cross site scripting (XSS) vulnerability, which could allow remote attackers to inject their own HTML onto your site. Pagely will be patching customer sites immediately, and should be finished shortly. If you would like to read more about this release please see the WordPress blog announcement here. Spectre and Meltdown Jan. 5, 2018 Reading memory, outside of your privilege. Time to patch kernels. [Update: Feb 2, 2018 CST] Our kernel hotpatch provider has released a working patch for Meltdown as well, and it has been applied to all customer servers. [Update: Jan 18, 2018 09:00 CST] Spectre: Patched without the need for a reboot Meltdown: Patch available if you request a reboot, we are still waiting on the no-reboot patch which is close to being tested as safe to apply. If you are concerned about the risks associated with Meltdown, contact support to request a server reboot. Or wait until our no-reboot patch has been tested and is working safely. Risk associated with Meltdown: There are still no PHP based proof of concepts, therefor we consider it a low-likelyhood that anyone (aside from someone with SSH access to your server) would be able to perform this attack on your site/server. If you disagree with this risk assessment, then please contact support and we will schedule a reboot to apply the patch for Meltdown ASAP. [Update: Jan 11, 2018 11:30 CST] Our kernel patch provider has released a working patch for Spectre, but not Meltdown. We will be applying the Spectre patch to all servers before the end of the week, and will be awaiting their patch for Meltdown when it becomes available. If you would like to hasten the patch time, we can apply the kernel patch from Ubuntu (released yesterday) however this will require a schedule reboot for the change to take affect. If you would like to schedule a reboot of your server, please contact our support staff from your account’s primary contact email address (or via our administration panel) These patches are known to cause a negligible performance hit on servers when applied. It’s likely you will not notice this performance hit on your site unless your code does a large amount of system calls and/or you are already close to needing an upgrade. Our engineers are working on a solution to this issue and we may be able to work with customers impacted to entirely remove this performance hit or actually come out ahead. [Update: Jan 9, 2018 09:00 CST] At this time (Tuesday January 9th) we do not yet have a stable patch to apply to customer’s servers. The patch plan for early this week was not met. This was due to the complicated nature of this patch, and ensuring a stable patch is what is pushed out to servers. It’s been identified by multiple sources that this patch is not the simplest, concerns of stability and CPU overhead come up and this has delayed the patch from either Ubuntu (our operating system) or KernelCare (our kernel patch provider). Risk assessment: The existing proof of concepts for these vulnerabilities are not executable against our customer’s sites due to how our PHP is configuration (we restrict/ban any exec/shell calls) which reduces the risk of this vulnerability. Only customers with compromised SSH accounts would be vulnerable (and if there does exist a PHP PoC in the future, only customers with compromised sites would be exposed.) We are delaying the patching process. This decision is made under the consideration that many people are reporting issues with the patches available, and the lower risk this vulnerability has at exploiting WordPress sites on our network. Tentative timeline: We expect patches from one of the upstream providers (Either KernelCare or Ubuntu) tomorrow, Wednesday Jan 10th, however this may be delayed. When a patch is available, if it is Kernel Care, no reboot will be required. If it is Ubuntu, then we will need to reboot your server for the change to take affect. We will begin applying patches for customers this weekend or next week (a few days after the patches are released so we have time to test the patch sets.) We will contact customers via email to schedule a reboot, if it will be required to apply this patch. [Original post] Pagely is aware of the multiple related vulnerabilities in Intel (and other) CPUs known as “meltdown” or “spectre” and has been working on patching affected servers. This vulnerability is a bit different than most, as it requires patching done on the bare-metal server as well as a second round of patching on our virtual instances for Pagely customers. Our data center provider notified us regarding what servers were affected by a security concern and needed reboots to apply a patch. We have already been working with the affected customers on and scheduled reboots to address this security concern. It’s likely that these CPU architecture vulnerabilities were likely the cause for the scheduled reboots in December. At least check, we have address almost all of these (and the last few are scheduled with the respective customers to happen shortly.) All remaining EC2 instances are on bare-metal servers which likely have been patched without the need for a reboot (however this may change). If you did not receive an email related to scheduling reboots on your site/server, then the patch for this vulnerability did not require a reboot to take affect. If this changes, we will be on contact with any customers who need to schedule a reboot. That only leaves the linux kernel on each of our EC2 instances as a remaining concern. Luckily we now utilize a new technology in the linux kernel which allows for live-patching the kernel without the need for a reboot. This patch will be applied to all of our customers as soon as the kernel patch is officially out and properly tested. The tentative timeline for this should be this weekend or early next week (and require no reboot of the server, it should be applied seamlessly.) PHPMyAdmin CSRF Jan. 5, 2018 Click this link my friend Cross-Site Request Forgery! But not with Pagely. Over the holiday break there was a CSRF vulnerability reported with PHPMyAdmin, this class of vulnerability would allow an attacker to send malicious links to users with browser’s already authenticated in PHPMyAdmin to perform actions as the logged in user. A patch was applied in 4.7.7 to address this issue, and all PHPMyAdmin installations Pagley has have been updated. WordPress Security and Maintenance Release: 4.9.1 Nov. 20, 2017 Holidays are for: Family, eating too much, and security. Don’t worry you can stay distraction free when dining with friends and family this holiday season, knowing that we have handled this WordPress security release update for you and your sites. Instead of worrying if your site has been patched, you can be the one to bring it up at social gatherings and watch as your friends or family with WordPress sites become uncomfortable not knowing if their sites are secure or not. Pagely customers will receive the WordPress 4.9.1 security release update this week. This security and maintenance release includes patches for multiple vulnerabilities including a cross-site scripting (XSS) and XML eXternal Entity (XXE) issues. This will also officially bring all customers up to the 4.9 branch from 4.8.3, unless you’ve previously written in requesting an upgrade to 4.9 in the last few weeks. You can read more about this security release and specific details on what it includes here on the WordPress news blog, as well as more details on how we handle major WordPress releases (like 4.9) on our blog here: WordPress 4.9 Release. WordPress 4.8.3 Oct. 31, 2017 WordPress Halloween. We patch the tricks, 4 8 3 You get the treats. Boo! There is nothing spookier than a WordPress security release, the 4.8.3 patch addresses an SQL injection vulnerability in WordPress core which could be exposed by insecure coding practices found in some plugins. This release hardens the WP Core code to protect the sites who may harbor an insecure SQL query that trusts user input, sanitizing the input before it’s passed along to the database server. More information on this release can be found on the WordPress blog, details on the changes and how it modifies the return value of of esc_sql() have been posted by Gary Pendergast on the Make WordPress Core developers blog. Thanks goes out to the reporter of the vulnerability (Anthony Ferrara) for working with the WordPress security team. And a special acknowledgement to our own Arman Zakaryan for the Haiku this time around. OptionsBleed Sept. 21, 2017 Memory Leaking over OPTIONS requests sent. This patch stops the leak. The vuln-du-jour is called OptionsBleed and affects Apache2 web servers. It was caused by a programming oversight in the Apache2 server project which allowed small amounts of memory to be leaked when an OPTIONS request is sent to the web server. This bug only affects sites that are configured with a LIMIT directive which attempts to filter nonexistent HTTP methods, which is extremely rare but does exist in just under 500 of the Alexa top 1 million websites. A more detailed write up about this can be found here. The Apache2 dev team wasted no time in providing a patch. Which we have already begun applying to customer servers. We are rolling this patch out slower than a normal security patch because it’s so rare for this misconfiguration to exist and initial reviews of customer sites shows no Pagely customers have misconfigured LIMIT directives which would put them at risk. That said, the patch will be applied in a safe manner over the next week as to minimize any risk of downtime on customer sites related to the upgrade. WordPress 4.8.2 Sept. 19, 2017 Within this release, Nine security patches. Sites are now secure This week brings a security update to WordPress core. The security patches include multiple serious vulnerabilities and we are applying patches as soon as possible for customers. The WordPress core and security team have also released version to address any of the patched vulnerabilities for the following versions: 4.8.2, 4.7.6, 4.6.7, 4.5.10, 4.4.11, 4.3.12, 4.2.16, 4.1.19, 4.0.19, 3.9.20, 3.8.22, and 3.7.22. Any customer of Pagely running older branches of WordPress will also be brought up to date with these security patches. Malicious Code in Display Widgets Sept. 13, 2017 We coined a new term: “plugin identity theft”. Let it not catch on. A popular plugin in the WordPress.org repository has been “hijacked” (for lack of a better term) by a developer with suspicious intent. The popular plugin “Display Widgets” is described as “Adds checkboxes to each widget to show or hide on site pages“, yet in the last few releases there have been some unexpected new features added: such as adding posts directly to the site and tracking site visitors. Wordfence, a security plugin, wrote a full explanation on how this might have happened, it’s worth a read here. For our customer’s safety, we have banned the plugin from our customer sites. If your site hosted with Pagely was affected we have already reaching out directly to help you with the concern. More information about the issue at hand with this plugin can be found on WPVULNDB and in the plugin’s support forum . Update: The plugin team at WordPress.org have released a patched version of Display Widgets which reverts it back to the last known safe version, but there appears to be no author to continue maintenance on the plugin. The plugin will remained banned on our network until a time that we see someone has taken responsibility for the plugin and the future of patching it’s code. Which plugins and themes aside from display-widgets should you avoid? See our full list here. WordPress 4.7.5 Release May 17, 2017 Patchy patchy patch I love patches for WordPress Here come the patches Pagely customer sites are being updated to address 6 vulnerabilities. The ExploitBox Unauthenticated Password Reset Vulnerability has still not yet been addressed; Pagely customers are still not affected. Further details on this release can be found here: wordpress.org ExploitBox’s CVE-2017-8295 May 5, 2017 Return to sender sending to the wrong domain read from HOST header. There was a recently released authentication bypass vulnerability that affects WordPress before and including 4.7.4, with specific server configurations. The attack requires a request to a WordPress site via it’s IP address, while the attacker sets the HTTP request header to their own HOST value. Pagely does not allow direct access to WordPress sites via IP address and requires the HOST field sent in the headers to be the actual site being requested, thus a request with a HOST value controlled by an attacker will not be directed to a WordPress installation at Pagely. Bonus Haiku: Pagely hosted sites are not affected by this reported exploit. For more details on the vulnerability and how it works, please read: https://exploitbox.io/vuln/WordPress-Exploit-4-7-Unauth-Password-Reset-0day-CVE-2017-8295.html WordPress 4.7.3 Security Release Mar. 6, 2017 XSS and more bugs get patched in this release. The update is done Customer sites are being updated to address 6 security related issues. Further details on the release can be found here: wordpress.org CloudBleed, Shattered, CVE-2017-6074 Feb. 28, 2017 SHA One Collision CloudFlare Leaking Memory and Kernel Patching Normally these Haiku’s are short and sweet, but it was a busy week for security in the headlines last week so I took a little more time to compile the following information for you: The CloudFlare Bug (A.k.a. “let’s not call it CloudBleed”) A security researcher working for Google’s Project Zero disclosed information on a bug identified in CloudFlare’s services. The bug was in CloudFlare’s services, and in some cases resulted in a trace amount of the contents of the CloudFlare’s servers memory being leaked. This could have had major repercussions as the contents of these servers may contain sensitive information being sent to or from the web server behind CloudFlare’s services (such as passwords, encryption keys, or other sensitive data.) Many news outlets reported this as a catastrophe, however CloudFlare patched it’s server’s before the announcement and there have been no reports of this being attacked in the wild before the report by the Project Zero researcher. Key points include that the data being leaked was not controllable by the attacker (it was always random, including no ability for an attacker to target a specific site’s data). The data was also limited to small chunks. The leaks however, have likely been happening for a while, no one knows how much data has been leaked to people looking for it or if any widespread attacks could have gleaned any usable data from the memory leaks. Ultimately, while it’s possible every password, SSL cert, and secret keys were pulled from CloudFlare server’s using this attack, it’s not likely to be the case. Most probably: the researchers at Google’s Project Zero were the first to be aware of the problem and reported it responsibly to CloudFlare. However, it is still yet to be seen if anyone reports malicious activity caused by these leaks in the weeks and months to come. How could this affect you? If you utilize CloudFlare on your site (or utilized a service that used CloudFlare) and wish to be absolutely sure your private data (such as a password) is safe then you may want to be pro-active and change that password or other secret data. The SHA-1 Collision: (A.k.a. “Shattered”) A collision in the SHA-1 algorithm was reported by a different team at Google. SHA-1 is a cryptographic hashing algorithm, commonly used to validate the integrity of data being sent. The collision released by the team at Google showed that they were able to send two different messages but they both validated with the same SHA-1 value; ultimately meaning that data signed or verified using a SHA-1 algorithm can no longer be trusted. There is some good news however, this attack is fairly expensive to execute (over $100k) and SHA-1 has been on it’s way out for the better part of a decade. SHA-256 has already been established as the replacement and most people have already migrated to the more secure algorithm. How could this affect you? If your site has SSL/HTTPS, then that certificate might be signed using SHA-1 , but it is probably already signed using SHA-256 (as of 2015) if you would like to double check you can always utilize a utility like ssllabs.com to look up your site’s SSL certificate and see what method is used to fingerprint it. If you find you are using SHA-1 only, then the fix is to get a new certificate (most likely whomever you purchased the certificate from will issue you a new one using SHA-256 without much hassle.) Secondarily, if you developed your site’s code explicitly using the sha1 function, then you may wish to swap that sha1 function with the sha256 function. CVE-2017-6074 While CVE-2017-6074 did not have a cool name or website or lots of media coverage; it was a more serious threat. This flaw could allow anyone with access to a Linux server to escalate their privileges from a normal user to root on the server. Linux servers running up to date kernels (such as ours) were affected and we were very concerned about getting this patched for our customers. Luckily we have been updating our infrastructure and these kernel based vulnerabilities no longer require reboots to apply new patches. We applied a patch to address this vulnerability on the same day it was made available and noted no issue with the new kernel code running. WordPress 4.7.2 Security Release Jan. 26, 2017 Sites updating now we handle the patch. So you focus on your site. Customer sites are being updated to address 3 security related issues. Further details on the release can be found here: wordpress.org CVE-2016-5195 “Dirty COW” Oct. 26, 2016 We have sent many email notifications about the reboot. Kernel patches have been applied on our servers, however a restart is required for it to take affect. Scheduled reboot notification emails have been sent out and reboots will take place the week of October 31st. More information on the vulnerability can be found here: dirtycow.ninja WordPress 4.6.1 Security Release Sept. 12, 2016 The update happened faster than I could write this haiku about it. All sites have been updated to address 2 security related issues. Further details on the release can be found here: wordpress.org httPoxy Jul. 20, 2016 A pox on proxy headers; that are misused by some developers. Updates to our server configs are being pushed out that remove any “Proxy:” values attempted to be set by a request header. More details here: httpoxy.org And see also: Pagely’s Reverse Proxy WordPress Hosting WordPress 4.5.3 Security Release Jun. 21, 2016 WordPress 4.5.3 Several security issues are addressed. We are currently testing and rolling out this security update. Further details on the release can be found here: wordpress.org WordPress 4.5.2 Security Release May 9, 2016 4 point 5 point 2; Patch vulnerabilities in cross site scripting Updates on our platform are finishing up today. Further details on the release can be found here: wordpress.org CVE-2016–3714 “ImageTragick” May 9, 2016 Image conversion tragedy; is currently patched by policy. Further details: ImageTragick.com CVE-2016-2107 CVE-2016-2108 May 3, 2016 High Severity Vuln? We patched openssl, so you don’t have to. Security Haiku: CVE-2015-7547 Feb. 19, 2016 Host lookup dangers? No worry, we already patched glibc Which plugins and themes aside from display-widgets should you avoid? See our full list here.
These monthly reports are provided for the WordPress community at large from Pagely’s head of security, Robert Rowley. Rowley and the entire security team keep their finger on the pulse of any potential vulnerabilities that might affect our customers, as well as any WordPress user. We sincerely hope these efforts help any and all that could use information from the experts on monthly security issues. We commend the researches and developers that help to identify and patch these issues in a timely fashion. WordPress Core No notable WordPress core security releases. Plugin/Theme Vulnerabilities of Note bbPress By The bbPress Contributors https://wpvulndb.com/vulnerabilities/10242 https://wpvulndb.com/vulnerabilities/10243 https://wpvulndb.com/vulnerabilities/10244 https://bbpress.org/blog/2020/05/bbpress-2-6-5-is-out/ bbPress version 2.6.5 was released on May 28th. This security release addresses multiple vulnerabilities including one which affects sites with New User Registration enabled, allowing privilege escalation on newly created accounts. WooCommerce By Automattic https://wpvulndb.com/vulnerabilities/10220 There exists a vulnerability within WooCommerce, which would allow users with access to modify and duplicate products to upload arbitrary PHP code to the website, then execute it. This is an authenticated vulnerability (requiring a user account), and high risk as it would allow attackers to execute code on the server itself. Note: This vulnerability is a Remote Code Execution (RCE) based on our review of mslavco’s findings. Page Builder by SiteOrigin https://wpvulndb.com/vulnerabilities/10219 The page-builder plugin before version 2.10.16 has a CSRF (Cross-Site Request Forgery) to Reflected XSS (Cross-Site Scripting) vulnerability. Attackers could utilize this attack to target site administrators to execute code within the administrator’s browser within wp-admin. The attack targets the live editor and action_builder_content functions of the plugins. Elementor Pro https://wpvulndb.com/vulnerabilities/10214 There is a critical vulnerability in Elementor Pro versions before 2.9.4 which allows any logged-in user the ability to upload and execute PHP scripts. This vulnerability is actively being utilized with a registration bypass vulnerability which affects Ultimate Addons for Elementor (described next), allowing for subscriber registration even if registration is disabled. Ultimate Addons for Elementor https://wpvulndb.com/vulnerabilities/10215 The Ultimate-Elementor plugin before versions 1.24.2 allows attackers to create subscriber-level users, even if registration is disabled on a WordPress site. As noted, this vulnerability is being combined with the Elementor Pro vulnerability described above which may lead to remote code execution on sites with registration open and both Elementor plugins installed. Photo Gallery By 10Web https://wpvulndb.com/vulnerabilities/10227 An unauthenticated SQL injection can be executed on this plugin and it looks to target the gallery_type area of the plugin specifically. Site owners have until June 5th to update to version 1.5.55 or higher before the vulnerability details will be made publicly available. Form Maker By 10Web https://wpvulndb.com/vulnerabilities/10237 A vulnerability in this plugin allows an administrator or higher-level user to perform a SQL injection via Form Maker. Site owners should update to version 1.13.35 or higher as soon as possible, as the security researchers have stated some details regarding how to exploit this vulnerability have already been released publically. Official MailerLite Sign Up Forms By MailerGroup (x2) https://wpvulndb.com/vulnerabilities/10235 https://wpvulndb.com/vulnerabilities/10236 The official-mailerlite-sign-up-forms plugin has two vulnerabilities that have recently been reported. The first deals with the MailerLite plugin not sanitizing user input data which leaves a site vulnerable to SQL injection, this vulnerability was fixed in version 1.4.4. The second vulnerability addresses CSRF issues and was patched in version 1.4.5 of this plugin. WP Product Review Lite By ThemeIsle https://wpvulndb.com/vulnerabilities/10226 The wp-product-review plugin before version 3.7.6 is susceptible to an Unauthenticated Stored XSS attack which bypasses built-in protections allowing malicious HTML or Javascript to be stored and injected on all the site’s product pages. See previous months’ WordPress security updates from April and March.
