You use a lot of different tools in your business. You’ve got WordPress, Google Drive, Evernote, MailChimp, Asana, and dozens of others. And while all these tools are incredibly helpful, there’s one major problem: They don’t communicate well with each other. In other words, getting information from one app to another isn’t usually very easy. For example, let’s say you wanted to create a new line in a spreadsheet every time someone contacts you through your website. Normally, you might have to manually download the contact information and then copy and paste it into the sheet. It’s a pain. That’s where Zapier comes in. It allows you to connect apps that don’t normally communicate AND automate tasks between the apps. This can save you huge amounts of time as well as eliminate the tedious tasks that eat up your day to day. Let me break it down for you. What Exactly Is Zapier? Simply put, Zapier is an online tool that connects and automates most of the apps you use, like WordPress, Gmail, MailChimp, Wrike, Zoho, ConvertKit, Trello, and hundreds more. It serves as a translator of sorts, translating the language of one app into the language of another so that they can pass information between each other. And the beauty of it is that there’s no coding necessary. No waiting for developers to do what you ask. No digging into complex tasks and routines to try to connect radically different apps. Zapier does all that for you. It serves as a digital butler of sorts, You can have Zapier automatically repeat tasks you would normally do yourself in your different apps. You can make a “Zap” which connects two or more apps with each other so they can talk to each other without you even entering the conversation. Zapier constantly monitors all the apps so that when a prespecified condition occurs (like a WordPress form being filled in), it can perform the task you’ve created. Scheduling meetings is another great example of how Zapier works. Let’s say you work in Slack a lot and tend to forget to look at your calendar. You can create a Zap that connects Google Calendar and Slack. Zapier will notify a Slack channel of your choosing that there is an upcoming Google Calendar event. And it can do this for over 1,000 other apps too. How Exactly Does Zapier Work? We’ve already explained the basics, but let’s dive in a bit more. To understand how Zapier works, you have to start learning the lingo. A Zap is basically a template for something you want Zapier to do repeatedly and automatically, without you needing to intervene in any way. Within a Zap, there are Triggers and Actions. A trigger is the initial event that sets the Zap in motion An action is what the Zap does in response to the trigger Let’s use WordPress as an example. You might tell Zapier, “When I publish a new post in a specific category, automatically create and publish a Facebook post on my page.” The Trigger here is you publishing the WordPress post and the Action is the post to Facebook. Then you can make a template for this Trigger-Action combo and apply it to any WordPress posts. This template is called a Zap. If you wanted to make a record of the WordPress post in a Google sheet, you could add that into the Zap as well. It’s kind of like a recipe. Or let’s say you were creating a new eCommerce store using WooCommerce. With Zapier, you can log every purchase into a Google Sheets spreadsheet so that you can keep track of all your orders. That’s how powerful and flexible Zapier is. The best part is that you can set up custom Zaps for any apps supported by Zapier (which is over a thousand). Pick two or more apps, choose the Trigger, choose the Action, and Zap it for all future similar situations. For some apps, Zapier will check on your Triggers every 15 minutes, while others get triggered immediately. Automated data flow. It’s a beautiful thing. What Can You Do With Zapier On WordPress? If you’re a WordPress blogger or using WordPress for your business’ website, you need Zapier. What are of some of the ways Zapier can supercharge your WordPress workflow? Here are the some of the Triggers you can set up in conjunction with both WordPress.com and WordPress.org: When your blog receives a new comment or a new comment status happens When you add a new tag, category, or any other way you would group posts When you publish a new post, add a post status, create a new post format, or create a new type of post When you add a new user or author to your WordPress backend When you or another user upload new media to your WordPress site When you set up nearly any type of Trigger via the HookPress plugin These triggers can then perform actions in numerous apps without you ever having to click a button. 10 Things You Can Do With Zapier That Will Make Your WordPress Experience Easier Let’s take this even further and look at 10 more things you can do when you combine the power of Zapier with WordPress. Remember — all of these Zaps are automatic. Share New Posts On Social Media You may have heard content marketers say something like, “Blogging is 5% writing and 95% other stuff.” Oftentimes, that’s true. But what if you could do less of that “other stuff” by delegating it to a machine? Zapier can help you by automatically sharing your new WordPress posts across all your social profiles like your Facebook page, Twitter profile, or Pinterest profile. That way, you won’t need to go to those platforms and share the post manually. Talk about a time saver. With Facebook, you can even tell Zapier to share only certain types of posts and what Facebook pages to use. With Twitter, you can pre-set the format of the tweet, shorten the URL (or not), and specify what types of posts should be tweeted. Post Instagram Photos To WordPress When you connect the Instagram Zap, you can go the other way by posting new Instagram photos to your blog. You can set it up so that when you post a photo to Instagram, Zapier will automatically publish it on your blog as a new post. You can even choose the post format and category. This is especially useful if you’re a photographer or utilize your Instagram profile heavily in your business. Post YouTube Videos To WordPress Many businesses also have YouTube channels as a way of cross-promotion and reaching every potential customer. If that’s you, you may want to look into the YouTube Zap. Like the Instagram Zap, you can have Zapier automatically post your YouTube videos to WordPress, choosing how the video post will look on the blog and if the post will go live immediately or be saved as a draft. Post An RSS Feed To WordPress You might be wondering why you’d want to post an RSS feed to your WordPress blog. A simple reason is to create a feed of blogs other than yours that you enjoy reading and that you think would be useful to your readers. You can also bring together content from other platforms, like your social media profiles or other blogs you run. However you use the RSS Zap, it’s going to be one of the easiest Zaps to set up (honestly, they’re all easy to set up). Send Your Buffer Posts To WordPress Buffer is an app that lets you schedule your social media content to Facebook, Twitter, and LinkedIn. And with the Buffer Zap, you can also have that same content posted to your WordPress blog. After connecting Buffer, you just create a title, select the post author, and any categories or tags. Post SurveyMonkey Responses To WordPress If you’re not aware, SurveyMonkey is a free service that allows you to make custom surveys, which you can use to get feedback from your fans and followers. And with the SurveyMonkey Zap, you can have people’s responses or the overall results of the surveys automatically posted to your WordPress site. This could be a cool way to tell your readers, “Hey! This is what you all think as a collective group. Cool, right?” Send Google Docs To WordPress Many writers and bloggers prefer to write in Google Docs. And with the Google Docs Zap, those types of people can easily transfer that content to WordPress. Zapier will automatically save Google Docs as draft posts in your WordPress account. Add New WordPress Posts To Google Calendar If you create a lot of written content, it’s really important to have a content calendar of some sort. Zapier knows that. That’s why they made a Zap that will add every new WordPress post to your Google Calendar. This will help you easily see, at a glance, what posts are going to be published and when. No more accidental double posts or a long time in between posts. Store WordPress Posts In Dropbox You probably already back up the content of your blog, but it’s better to be safe than sorry and use a secondary (and even tertiary) backup. With the DropBox Zap, you can store individual WordPress posts on your DropBox. This would be really annoying to do manually, so it’s really helpful that Zapier does it automatically. How To Connect Zapier With WordPress Don’t worry — this is a pretty simple process. After you sign up for Zapier, the best course of action is to create a new WordPress user just for Zapier to access. Here’s how to do that: Login to your WordPress account Under the Users option in the sidebar menu of your admin panel, choose “Add New User” As the Username, put “Zapier” For the email, put any email address that you have access to (not Zapier’s email address) Generate a secure password Under Role, choose Admin if you want Zapier to do pretty much anything with your blog (Zapier recommends using Editor) Click “Add New User” That was easy, right? Now that you set Zapier up as a new user, you can connect Zapier to your WordPress. Don’t Do Things The Hard Way You have enough to do as it is. Instead of wasting your time manually performing tedious tasks, let Zapier do the heavy lifting. That way you can focus on the things you do best without having to constantly worry that things aren’t being done. In our fast-paced, constantly evolving workplace, time is your greatest asset. Thanks to Zapier, you can potentially reclaim hours of previously wasted time.
HubSpot is an all-in-one inbound marketing software tool that can allow you to optimize your WordPress website for lead generation and conversion. Site owners use HubSpot to improve traffic generation, lead capture, automated nurturing and sales conversion and with $375.6 million in revenue for 2017, HubSpot has cemented themselves as a force to be reckoned with in this space. HubSpot does bundle its own content management system (CMS), but many marketers don’t realize that a HubSpot WordPress integration is possible via a plugin that gives you an easy way to continue using WordPress as your CMS while integrating HubSpot into your site for your inbound marketing efforts. In this article, we’re going to walk you through: Why you should consider using HubSpot with WordPress How to install the WordPress plugin Using HubSpot to improve your WordPress SEO Using HubSpot to generate and track leads on your WordPress site How to implement By the end, you’ll have a firm grasp of how to leverage both the marketing power of HubSpot and the flexibility of WordPress. Let’s dive in. Why HubSpot and WordPress? One of the things we love about WordPress is the huge amount of flexibility it offers. With thousands of open-source plugins, there’s not much you can’t do. But in some particular situations, it can be helpful to have everything neatly tied together, with all your data in a centralized location. HubSpot does that for inbound marketers. HubSpot’s inbound marketing framework can help you create a WordPress website that sees more traffic, by attracting more visitors, converting those visitors into leads, turning those leads into customers, and turning those customers into promoters of your brand. There are certainly plugins that can help you do each of these things, but your data will be scattered across a variety of platforms. With HubSpot, you can have everything you need to run powerful inbound marketing campaigns in a single location. We’ve had several clients use the HubSpot and WordPress integration plugin, and they have seen tremendous results from connecting their website with their inbound marketing software. Some of the results include: 4x increase in website traffic 2x increase in organic website traffic 228% increase in social media website traffic 140% increase in referral website traffic 47% increase in view to lead rate 38% increase in landing page conversions Obviously, HubSpot has some powerful tools that can be incredibly helpful if you’re an inbound marketer. Now, let’s walk through some simple ways you can use HubSpot to supercharge your WordPress site. Step #1: Install The HubSpot WordPress Plugin From your WordPress dashboard, install the official HubSpot plugin (which has over 30,000 active installs and comes with support from the HubSpot team). Note: you’ll need a HubSpot account for the plugin to work properly. Once the plugin is installed, it will begin pulling the data from your WordPress site into your HubSpot account. Step #2: Use HubSpot to Improve Your WordPress SEO HubSpot offers powerful SEO tools for your WordPress site. Keywords Obviously, you want to rank your content for the keywords that are most important to your business. Using the HubSpot keywords tool, you can identify which keywords you’re already ranking for, as well as get suggestions for additional keywords. In addition to showing standard metrics like monthly volume, keyword difficulty, and approximate CPC, HubSpot also shows specific marketing metrics, such as the number of leads generated by organic search traffic. This data is incredibly helpful in that it allows you to get a sense of how effective your SEO efforts are in generating not only traffic, but actual leads. If you’re struggling to figure out what keywords you should target, the suggested keywords tool allows you to type in a single keyword or a URL and then get a list of possible keywords. The URL function can be particularly helpful if you’re trying to compare organic content from a competitor. Simply type in their URL, see what keywords come up, and then determine if you should develop content around any of those keywords. Finally, under the recommendations tab, HubSpot will show you low difficulty keywords that you’re already ranking on pages 2-10. With just a little work, you can probably move these pages onto the first page of Google. On-Page SEO HubSpot’s on-page SEO optimization recommendations can help you improve SEO and the rankings of existing content. If you’re trying to move a piece of content to the first page of Google, following these recommendations is a must. Granted, there’s more to SEO than optimization, but it’s certainly a good starting point. Step #3: Use HubSpot To Generate And Track Leads HubSpot makes it really simple to place lead generation forms in strategic places throughout your WordPress website, and then A/B test those CTAs to see which perform the best. By implementing lead gen forms throughout your site and tracking their performance, you can begin moving prospects through your funnel. One simple A/B test to consider implementing is testing content upgrades versus popups. A content upgrade is a lead gen form embedded within a piece of content that gives readers access to exclusive additional resources. For example, if you have a list of the 10 best WordPress optimization tips, you could give readers a massively expanded version of that list as a PDF download in exchange for their email. Test this type of lead gen form versus standard popup email capture forms and see which one works best. With HubSpot, you’ll have detailed analytics that will tell you everything you need to know. Tracking Leads Once you’ve captured a lead, it’s simple to start nurturing that lead through your funnel and tracking their behavior. Within HubSpot, you can create email drip campaigns for your leads and then track how the leads respond. For example, you can determine which pages your leads visit, how they arrived, and where they are in your marketing funnel. This kind of data allows you to identify the buying intent of particular leads and customize your interactions based on where they sit in your funnel. Ramping Up with HubSpot on WordPress Now that you know the power of HubSpot and WordPress, what are your next steps? I recommend adding a call-to-action from HubSpot on each page of your WordPress website. Using the plugin, you will be able to easily see which calls-to-action are generating the most clicks and leads. Wherever you’re using a WordPress form, replace that with a HubSpot form. You can do this using the embed code from HubSpot. This will allow you to trigger automation and workflows based off of the form submission. Set up your email automation in HubSpot based on the above form submissions and conversions on your website. This will allow you to truly maximize the value of the HubSpot and WordPress integration by nurturing your leads as they convert on your website. Measure your analytics. With the plugin, you will be able to easily see which channels are not only driving the most visits, but more importantly, the most leads and customers. This is critical to analyzing your inbound marketing strategy daily, weekly and monthly to make sure you’re optimizing your strategy to coincide with your businesses goals. Identify low hanging SEO fruit. Determine which pages are already ranking, which ones could rank with a little bit of improvement, and which keywords you could easily rank for. Then optimize and improve existing pages, and create new content that will rank for low difficulty keywords For one Pagely client, prior to using HubSpot and the WordPress plugin, they were not able to track conversions on their website, get detailed analytics including how people were finding their website and, most importantly, get data on how people converted on calls-to-action. Using the WordPress plugin in conjunction with HubSpot has allowed them to truly maximize the value of their website to turn it into a lead generation engine. Since the transition, they have seen their website visits increase by an average of 352% over the first 6 months of the transition and leads increase by 124% over the first 6 months. How to Learn More You can start learning more by accessing countless tips and tricks and subscribing to HubSpot’s blogs. If you have a WordPress site now, here are some quick integration tips for your HubSpot trial or your new HubSpot platform: Track website activity with advanced analytics in HubSpot Plug into CTA messaging that works with HubSpot CTA tracking Add HubSpot forms to your WordPress site to increase your conversion rate Optimize your website content and search engine optimization with HubSpot Page Performance tools HubSpot also has a completely free Academy and Inbound Marketing Certification that you can take to start to familiarize yourself with the inbound marketing methodology. HubSpot and WordPress integration can be a powerful tool for your inbound marketing efforts. Please keep in mind that the only way to be truly effective is to have a holistic inbound marketing strategy that covers all facets of the inbound methodology. Making a strategic decision to start with inbound marketing will help maximize your online marketing efforts by increasing website visitors, lead generation, customers, and happy customers! Inbound marketing empowers marketers to attract visitors, convert leads, close customers and delight promoters. If you’re using HubSpot with WordPress now, please share your experience and/or questions/issues in the comments section below.
When it comes to building or updating your WordPress website in 2018, there are certain questions you absolutely need to answer. For example: Is your website going to have a modern look that’s elegant and beautiful? Is your current or proposed WordPress theme for 2018 a functional and intuitive design? Will it present your business in the best light? Your business’ website is of the utmost importance, so ensuring that you have an up-to-date, mobile friendly, intuitive, beautiful, and functional site should be a high priority. If you’re going to stand out from the crowd, you can’t afford to have a site that looks like it was designed in the America Online days. That being said, finding the best business themes for your WordPress site can be tedious and incredibly time-consuming. There are literally thousands of themes available, making finding the right one a difficult process. So, we saved you the trouble. We’ve created a list of ten beautiful WordPress business themes that you should consider for 2018. Below, you’ll find a few great free themes, as well as a collection of paid themes as well. As a reminder, when selecting a theme or framework, we highly recommend doing your research. Here are a few basic guidelines to always follow when choosing a theme: Make sure the theme author/shop is reputable and uses current WordPress coding standards. Read reviews. There are 1000’s of themes available, find out what others from the WordPress community have experienced. Look at the authors/shop update release logs. Do they push out updates when needed to support new core releases? Are the authors active in the community? Do they contribute to WordPress core and/or the theme, plugin repository? Support, is there a strong community of theme support? Do the authors actively engage their customers through support forums? Free WordPress Business Themes #1 – Flash If you want something that’s both elegant and a bit flashy, download the ultra-responsive, flexible, and stunning Flash template for your business’ WordPress theme. Though it’s a free theme, it’s not lacking in special features and it certainly won’t leave your customers thinking that you designed your site in Geocities. The Flash theme is fully widgetized and comes with a flexible, and extremely helpful, live page builder called the Flash Toolkit. This toolkit contains more than 10 different easy-to-use drag and drops that allow you to customize each page to your liking. Fluid and responsive, the Flash theme is no joke. It’s a great design for consumers looking at your page on a desktop, but also has brilliant mobile screen options that doesn’t make you sacrifice aesthetic for mobile functionality. Even better, the Flash theme is deeply integrated with SiteOrigin Page Builder plugin, so customizing widgets, rearranging, and crafting a beautiful page is simple and delightful. This theme is built on the foundation of WordPress customizer, so you’re able to fix, adjust, and tweak your site with live previews. With so many different variations, it’s an outstanding pick for all types of businesses Download here #2 – Talon With Talon, it’s all about design. With a stunning homepage, numerous features, and free of charge, the Talon theme is the perfect add-on or update for your WordPress site. Engaging and sharp, it will draw in your customers and keep them captivated long enough to allow them to explore your pages, which is exactly what a well-designed WordPress theme should. However, the Talon Theme is more than just attractive and appealing. It’s a responsive, easy-to-use, flexible theme for your site that was created with the latest WordPress technologies. This web theme is well-suited for businesses, freelancers, agencies, entrepreneurs, corporations, and much more. It’s designed with functionality in mind, beautiful on both a desktop and mobile screen or tablet, ensuring that you don’t have to sacrifice any of your aesthetics for purpose. It was built on WordPress Customizer, so you’re able to watch as you make changes and see your progress as you go. The best part? You don’t need to know a single line of code to make this theme look outstanding. With dozens of options on headers, icons, fonts, and layouts, you can make this theme your own in a snap. The theme even comes with a support team that will get back to you with any questions or concerns you may have. Download here #3 – Himalayas The Himalayas theme claims to be the best, clean parallax theme, and it’s hard to argue. Equipped with a feature (parallax) that’s missing in most free WordPress themes, the Himalayas theme is a one-of-a-kind user experience. It’s one-page style is ideal for people who want to highlight everything on a single scrolling page rather than deal with the fuss of creating numerous pages. All of the features you’d find in a premium them are present with this free theme — style, flexibility, customization, ease-of-use, and stunning versatility. You can customize and change your full-width slider, have transparent stick menus, and create customizable sections for whatever you want. You also have an on-call response team for any issues you may face with the theme. Download here #4 – Illdy This stunning theme is a multipurpose design that’s both clean and elaborate. It’s built based on the Bootstrap frontend framework, so you can expect a fully responsive site and full mobile accessibility without sacrificing looks. We certainly recommend this theme if you have a creative business (photographers, artists, musicians, etc). Illdy is built to integrate with WordPress Customizer, making it incredibly simple to customize your site. Using this theme, you can make customizations and then see exactly how they’ll look when they go live. Entirely flexible, this free-to-use theme is versatile enough to cater to both commercial and private sites and businesses. It also works well with dozens of popular WordPress plugins (think Contact Form 7, WP Super Cache, Next GEN Gallery, Gravity Forms, and soon, WooCommerce). While a theme alone won’t push you to the top of the search engines, this theme is considered SEO friendly, which is certainly a plus. And unlike many of the free WordPress themes available, you can use parallax scrolling enabled sections for a user experience unlike any other. Download here #5 – Ample Ample is a fast, effective, and fully-updated WordPress theme that could be the perfect fit for your WordPress site. If you’re on the hunt for a theme that creates a modern aesthetic for your business without sacrificing any functionality, Ample is a fantastic option. This theme is a fully responsive site that makes your web content easily accessible on any device, from desktop to mobile phone. The Ample theme capitalizes on the latest parallax background effects, allowing you to add more information to a single page without sacrificing readability. At the top of the theme, you’ll find a full-width slider that lets your customers access the site with ease. You can fully customize the theme with background images, colors, and different effects. Even more, this theme is extremely flexible, meaning you can easily expand your site if you plan to grow your business. Download here Premium WordPress Business Themes #6 – DynamiX Fast. Responsive. Engaging. This effectively describes the DyanmiX WordPress theme, and for that reason, it’s one of the best paid WordPress sites for 2018. This theme is more versatile than most WordPress themes and yet still retains its elegance and functionality. Simple and flexible, this theme can be used for your small business, corporate website, or ecommerce site. It’s is optimized for fast performance, which is essential to keeping customers on your site for any length of time. You don’t need add-ons, extra tools, or coding knowledge to make this theme your own. Everything you need to customize and change the theme is right in front of you. The DynamiX theme utilizes something called the “Visual Composer” which lets you control your site elements with an easy-to-use drag and drop tool. And you can always make sure you’re making the correct changes by checking the live preview before you publish the changes. Additionally, this theme is SEO optimized to make sure you’re ahead of the game when it comes to SEO rankings. Purchase here for $59 #7 – uDesign If you’re looking for a way to give your business website a little pizzazz, uDesign has everything you need. The homepage of the theme is entirely widgetized, meaning it’s incredibly simple to customize and move the elements on the page. Without any coding, you can customize your homepage to your heart’s content. This theme also has portfolio options which allow you to display your work, products, and photos, and it includes a a Google Maps widget so you can display the location of your business. You easily can optimize your site for SEO as well as make your theme multi-language ready. Purchase here for $49 #8 – Jupiter Jupiter is the WordPress theme for people who want options. If you’re looking for a certain degree of style, elegance, and richness to add to your site, look no further than this incredibly customizable theme. For starters, you can find over 70 pre-built templates to help you get started, generate ideas, or build on top of. Simply pick out the template you like best, insert the necessary information, and get to work on building the site you love. Your site can have everything you’ve ever wanted, including customizable headers, a variety of post styles, widgets, portfolio styles, and more. And like some of the other themes we’ve mentioned, no coding knowledge is required to make this theme look beautiful. Everything is drag and drop, making setting up your site a breeze. The Jupiter theme is performance oriented, using a memory management tool to keep your site fast. And if you were looking for a theme that’s multilingual, then Jupiter is a perfect fit. Using the WPML plugin, can easily translate your site into multiple languages. It’s also SEO optimized to help you with rankings. Purchase here for $59 #9 – Dante If you’re looking for a WordPress business theme that immediately makes your customers feel like they’re enjoying a premium experience, then Dante is a great option. This theme has just about everything you need thanks to its use of the Swift page builder. There are 27 pre-built page templates available, which can then be customized and tweaked in dozens of ways. For example, the Dante theme allows you to change the site background to parallax or video, and even lets you choose animations for specific elements on your pages. And like other themes we’ve mentioned, you don’t need coding experience to make this theme beautiful. If you are the kind of person who likes to get into the nitty gritty, you can use the shortcodes for advanced customization of your site. Purchase here for $59 #10 – Avada Downloaded almost 400,000 times, claims to be the number one theme of all time. While it’s difficult to verify this claim, the fact that this theme can he highly customized without any coding knowledge makes it ideal for most business owners. Using the Fusion Builder tool, you can make dozens of customizations to your site while still keeping it compatible with most of the popular WordPress plugins. Even better, once you purchase the theme, you’ll be able to get free updates for the rest of your life. Purchase here for $60 Final Thoughts The sheer volume of WordPress business themes available (for free or for purchase) can make it incredibly challenging to sit down, scroll through, and find one that works for you. Instead of staying stuck in the past, choose from one of these top ten WordPress business themes listed above, and give your site a fresh look. We’ve done the hard work for you. All you need to do is pick your favorite. Happy choosing!
72% of people prefer to get business communications via email and the ROI on email marketing can be as high as $38 for every $1 spent. You’ll hear people claim “email marketing is dead,” but the numbers don’t lie: email marketing is still very effective and every business should be using it to engage their prospects and customers. Looking for the best solution for email marketing, and how to integrate with WordPress? MailChimp is one of the best email services and also one of the easiest tools to use (and integrates incredibly well with WP, which is a massive plus). In this article, we’re going to walk you through everything you need to know about integrating MailChimp and WordPress to help stay ahead of trends in email marketing. By the end, you’ll know how to capture leads on your website with a subscribe form, automatically send new blog posts via an automated email newsletter, and we’ll recommend a slew of WordPress plugins that can supercharge your MailChimp marketing. We’re going to cover everything you need to get the two solutions fully integrated and working together seamlessly so you can leverage the power of MailChimp’s email marketing features to grow your WordPress site and engage your audience. Let’s dive in… WHY USE MAILCHIMP? First things first: why should you use MailChimp as your email marketing solution? It really boils down to one thing: simplicity. You don’t need to know any coding to create emails. Everything is drag-and-drop, meaning you can easily add text, images, links, captions, and just about anything else your heart desires. Emails are automatically mobile friendly, seeing all your statistics is a breeze, and creating simple A/B tests only requires a few clicks. And here’s the kicker: it’s free to sign up and you get your first 2,000 email subscribers and 12,000 emails per month for free. In terms of email marketing, MailChimp has an incredibly low barrier to entry. If you want simplicity married to functionality, Mailchimp is your golden ticket. If you’re interested in more advanced marketing automation and CRM functionality, there are more feature-rich solutions. But, if MailChimp’s refined feature set checks all the boxes for you, why use anything else? HOW TO INTEGRATE MAILCHIMP WITH WORDPRESS Good looks and ease-of-use are two critically important factors in getting people to subscribe to your email list. The sign-up form (a.k.a. subscription form) you put on your WordPress site needs to be easy on the eyes and easy on the brain. The more difficult or confusing it is to sign up, the less likely people will end up on your list. As a general rule of thumb, the more fields you require, the fewer email subscribers you will get. Generally, first name and email address are all you need. Fortunately, MailChimp and WordPress are very friendly. They’re practically best friends. ADD OPT-IN FORMS USING A PLUGIN To add opt-in forms to your site install the MailChimp for WP plugin. There is also an official MailChimp for WordPress plugin created by Mailchimp, but it has fewer features, lower ratings, and is updated less frequently. With the MailChimp for WP plugin, you can easily create and seamlessly embed customized signup forms anywhere on your WordPress site. It has nearly a perfect rating (4.8 out of 5 stars) and more than 1 million sites are using it. Here’s how to your website’s email subscription forms set it up… SETTING UP THE MAILCHIMP FOR WORDPRESS PLUGIN First, go to the WordPress plugin directory and download the plugin to your computer. After you unpack it, upload it to your plugins folder within WordPress. Alternatively, you can install it directly from the WordPress backend and activate it. Next, you’ll need to connect your MailChimp account to the plugin. To do this, you’ll need to get your API key from MailChimp and paste it within the plugin. To find your API key, log into your MailChimp account, visit Account > Extras > API keys. On the API keys page, scroll down and click on the “Create A Key” option. In the API key column, you will see a box with a bunch of numbers and letters in it — copy what’s in that box. Next, go back to your WordPress plugin and navigate to the Settings menu of that plugin. On the very first page, you will see a box where you can paste the API key. Paste it, then hit “Save Settings.” Boom. Your plugin is now connected with MailChimp. CREATE A SIGNUP FORM After getting the plugin installed, you can create a signup form to put on your WordPress site. Within the plugin, go to Forms. Here you can choose the design and format of the signup form. MailChimp for WordPress has five themes to choose from and a field generator where you can customize the form by adding HTML elements. Below, you can see extra settings, like the automated messages and the redirect URL. You’ll want to be sure you select the right MailChimp list in the MailChimp settings (the one you want these subscribers added to). PUT THE SIGNUP FORM ON YOUR SITE There are many ways to get your signup forms on your WordPress site. The first is to use a shortcode. Underneath the builder module in the plugin is where you will find the shortcode. If you paste this anywhere within a post or page, it will automatically add the form to that spot. Another way is to use the MailChimp widget, which you can find by going to Appearance > Widgets in WordPress. Just drag and drop the widget to your sidebar or footer, change the title if you like, and hit save. Plus, thanks to this awesome plugin, there is a third way to get a signup form on your site. You’re going to like this one. You can allow anyone who writes a comment or uses a contact form on your site to sign up to your email list. Simply go to the Checkbox settings to activate this option. Cool, right? With your form placed on your site, your website visitors can submit their info via the form and be automatically added to your MailChimp list so they’re ready and waiting for your next email campaign. ADDING FORMS MANUALLY If you want to get slightly more technical, you can add MailChimp opt-in forms manually to your site. Instead of using the plugin, you can go through your MailChimp backend. Many developers prefer this route. To do this, go to the Lists page within MailChimp. Next to the name of your email list, you’ll see a drop-down arrow next to the Stats button. One of the options from that drop-down arrow is Signup Forms. Click it. On this page, you will see some different options: General forms, Embedded forms, Subscriber popups, Form integrations. If you click on Embedded forms, you can then design your signup form. Once you’ve chosen your template (Classic, Super Slim or Naked) and selected what fields you want, you can scroll down under the header “Copy/paste onto your site.” That box has the HTML code that you will copy and paste within your post or page. When you paste the HTML on your post or page, make sure you switch over to the “Text” view rather than the “Visual” view. SUPERCHARGING YOUR MAILCHIMP-WORDPRESS MARKETING MailChimp and WordPress are a power couple, and if you know what you’re doing, you can really take things to the next level. Here are some ways you can take this MailChimp-WordPress integration and knock it out of the park. These tips will help you make the most of it all. AUTO-SEND BLOG POSTS TO YOUR EMAIL LIST MailChimp has a feature called “RSS-driven campaigns.” What that means is you can have MailChimp automatically out an email every time you write a blog post. This is an easy way to keep people up to date with the action happening on your blog. HOW TO SET UP AN RSS-DRIVEN CAMPAIGN THROUGH MAILCHIMP An RSS feed is something that is automatically created by your blog. Every time you add a new post, it goes into the RSS feed. MailChimp can use that feed to pull the full or partial content of your blog posts into emails, and then send those emails to your list. First, you’ll need the URL of your RSS feed (side note: if you want to send your subscribers content from multiple RSS feeds, you can use MailChimp’s FEED merge tag, or use a feed aggregator like RSSUnify or RSS Mix). Although the content that goes out depends on what you post on your site, you can use MailChimp to customize when to email the content to your subscribers. In WordPress, the link to the RSS feed is often times www.yoursitename.com/feed. To set up the RSS-Driven Campaign, navigate to the Campaigns page and hit the “Create Campaign” button. In the popup box that appears, choose “Create an Email.” Choose the Automated tab then choose “Share blog updates.” Enter the name of your campaign, choose the list you’ll be sending this to, then hit “Begin.” On the next page, you’ll enter the RSS feed URL, how often you want this auto-send to go out, and choose the template and design of the auto email. And now you’re all set! When a new post is published, MailChimp will automatically grab the info from your RSS feed and place it into an email campaign so it can be delivered to your email subscribers. ADDITIONAL PLUGINS TO USE WITH MAILCHIMP Numerous companies have created WordPress plugins specifically designed to improve your MailChimp email marketing even further. Here are some of the most popular ones. SUMOME SumoMe is a powerful suite of marketing tools used by thousands of companies. If you are serious about growing your email list fast, you should consider investing in SumoMe. They have some incredibly unique ways to get subscribers, like the “Welcome Mat”, “Hello Bar”, and more. SumoMe integrates nicely with WordPress and MailChimp and is able to automatically add subscribers to your list. GRAVITY FORMS Gravity Forms is an extremely popular WordPress form building solution. If you need more options or more complex forms than the simple MailChimp signup forms they provide by default, Gravity Forms can probably handle it. It’s a proven, time-tested solution with a great reputation and we recommend it without hesitation. WUFOO Wufoo is a tool that allows you to quickly build and customize subscriber forms. With the free package, you get five custom forms, 100 entries, 10 fields, and stats. Wufoo is designed to be both powerful and easy to use. If you want a lot of options for designing your opt-in forms, this is a good choice. MAILCHIMP WD This plugin allows you to create wonderful looking subscription forms with some cool fields. You also have the option of adding PayPal integration and hiding or displaying certain fields depending on the selections your users make. The PayPal integration is especially useful if you’re taking payments through PayPal and then want to add those customers to your email list. ANALYTICS360 MailChimp has stats and reports you can look at, and so does WordPress. But don’t you want to go deeper than that? If you’ve ever wondered how the rate of new subscriptions correlates with your website traffic, Analytics 360 from Google can answer those types of questions. Basically, this plugin puts everything in one place. It takes your Google Analytics and MailChimp tracking data and puts it neatly within your WordPress dashboard. Efficiency is a key characteristic of a successful business. MAILCHIMP FORMS BY MAILMUNCH Like SumoMe, MailMunch is a suite of tools designed to help marketers grow their email lists fast. It has a variety of lead capture forms, including scroll mats, advanced pop-up forms, slide boxes, and a lot more. If you’re really looking to supercharge your MailChimp marketing, this might be the right solution. EASY FORMS FOR MAILCHIMP Unfortunately, MailChimp’s standard opt-in forms are pretty ugly. As great as MailChimp is in terms of simplicity, it’s not the best when it comes to collecting email addresses. That’s why plugins like Easy Forms are useful. If you really want to customize the look and feel of your form, this plugin has built-in CSS classes that can dramatically improve the look. WOOCOMMERCE MAILCHIMP If you sell products using WooCommerce, you’re going to want to use this plugin. With this plugin, you can integrate WooCommerce with MailChimp, automatically assigning customers to their preferred email lists and MailChimp interest groups after finishing an order. You can then create your own interest groups and add subscribers based on the list they belong to. Additionally, you can add an opt-in option at the checkout page, giving customers yet one more opportunity to get on your email list. MAILCHIMP ACTIVITY The MailChimp activity plugin lets you see all your MailChimp stats in your WordPress dashboard. This means you don’t even need to login to MailChimp to get a feel for what’s happening with your list. MAILCHIMP COMMENTS This is a fantastic way to build your list through the comments on your WordPress blog. When a person comments on a post, they’re given the option of signing up for your email list. If they do, you can automatically direct them to different lists depending on the post they comment on. GO FORTH AND CONQUER! You now have everything you need to conquer email marketing with MailChimp and WordPress. Yes, you should keep using social media to promote your business and brand. But unlike social media, in which people are randomly scrolling through hundreds of random posts, email has the ability to grab people’s full attention. When something shows up in their inbox, they need to take action on it, even if that action is deleting the email. The world is yours!
WooCommerce vs. Shopify: which should you choose for your ecommerce business? Unlike in years past when you had to hire a developer to build an online store for you, there are now a number of services that allow you to build an ecommerce store with little to no knowledge of coding. When it comes to building your ecommerce store, there are two that really stand heads and tails above the rest: Shopify and WooCommerce. These are the two most popular ecommerce platforms for a reason. But which is the best ecommerce platform? If you read the reviews, both seem pretty good. They both have glowing reviews. They both have people recommending them. How can you know which is right for you? That’s where we come in. We’re going to break down everything you need to know about Shopify and WooCommerce, and give you some recommendations on which is more appropriate for specific situations. This can help you a lot if you’re trying to zero in on what makes one solution better or different than the other. We’ll break this down in detail below, but long story short, here’s what you need to know: Shopify vs. WooCommerce: Both platforms are outstanding ecommerce options that offer similar features and functionality. Your choice will probably depend on differences in pricing models between WooCommerce and Shopify. Shopify is fantastic for those new to ecommerce or those who want a turnkey solution. WooCommerce is perfect for those who want full control over their ecommerce store and also want the power of WordPress. But let’s go a little deeper. By the end, you’ll be ready to start building your own ecommerce store. WHAT IS SHOPIFY? First things first: what is Shopify? Essentially, it’s an online tool that enables you to build an ecommerce store without doing any coding. You don’t need to hire a developer, and if you get stuck on any of the steps, Shopify will guide you by the hand. And, there’s a huge community of Shopify users and experts out there willing to help if that’s not enough. With Shopify you can sell all sorts of products, including physical items, digital downloads, drop shipped products, and even services. If you have a brick-and-mortar store, you can integrate it with your Shopify store thanks to their Point-Of-Sale devices. If you’re new to ecommerce or simply want a simple, turnkey solution, Shopify is certainly a solid option. It allows you to get up and running really quickly. WHAT IS WOOCOMMERCE? In order to understand WooCommerce, you need to understand WordPress. WordPress is a massively popular, open-source website building platform. It’s so popular that it’s estimated that WordPress runs 28.9% of the internet, including some of the biggest sites out there. You can be sure that if more than ¼ of the internet uses WordPress, it’s got some things going for it. However, WordPress wasn’t built specifically with ecommerce in mind. Rather, it’s designed to be an all-in-one solution for creating and managing content with a dynamic website. Part of the reason WordPress is such a popular CMS is because it has an extensive ecosystem of add-ons called plugins. These plugins extend WordPress’s functionality in new and exciting ways allowing it to do much more than just publish blog posts. That’s where WooCommerce comes in. WooCommerce is a WordPress plugin that adds a host of ecommerce features to any WordPress site, including things like a shopping cart, product pages, inventory management, etc. WooCommerce stores are free to create because both WordPress and the WooCommerce plugin are free. Yes, you will need to spend a bit of money on things like WordPress web hosting, but you have that expense anyway if you already have a WordPress website. If you’re not already using WordPress, then the cost of web hosting becomes a bigger factor in your decision. That’s an additional expense you do not have to worry about with Shopify. EVERYTHING YOU NEED TO KNOW ABOUT SHOPIFY Now that you know a little bit about both services, let’s explore Shopify to give you a good feel for the service. DESIGN OPTIONS If your site doesn’t look good, people won’t want to buy from you. Your site can’t look like it was designed during the Geocities era or by someone who really loved MySpace. It needs to look professional, clean, and be easy to navigate. Without these elements, you can be pretty sure you won’t succeed in ecommerce. Shopify offers more than 50 different, professionally designed store themes. Ten of these themes are free, with the rest usually costing between $140-$200. The themes are professionally designed and allow you to easily customize the look and feel of your shop. Shopify outsources all theme design to professional developers who ensure that the themes stay appropriately updated. This is both an advantage and a disadvantage. The advantage is that the theme always stays fresh, but the disadvantage is that they can cost quite a bit. Shopify makes it pretty simple to change most of the design options on your site, like colors and styles. You can also easily update your site with new items and even change your theme completely. If you’re preparing for a new product launch, you can edit sections of your store without taking it offline. If you’re an advanced developer, you can use Shopify’s specialized ‘Liquid’ language to make more significant changes. This isn’t necessary; only if you want to really go deep into your site. PRICING OPTIONS Shopify is Software As A Service (SaaS) so they offer several pricing tiers that give increasingly more features as the monthly price goes up. The tier you choose determines which options are available to you. The most popular pricing package for Shopify will cost you $29/month, and they also have a number of other options: Lite ($9 per month) Basic Shopify ($29 per month) Shopify ($79 per month) Advanced Shopify ($299 per month). On top of these monthly fees, you will also pay transaction fees every time you sell something. Shopify takes a cut of every transaction, and if you’re using a payment gateway like PayPal or Stripe, there will be additional transaction fees from them. Because transaction fees vary and change depending on the payment gateway you choose, you’ll want to look into all the details to determine how you want to handle that aspect. SHOPIFY FEATURES Shopify offers a robust set of features right out of the box, including: Unlimited products Unlimited file storage Automatic fraud analysis Embedded Oberlo integration Credit card payments Multiple languages Adjustable shipping rates and taxes Customer profiles Drop shipping capabilities Manual order creation Discount codes Blog module Free SSL certificate Mobile commerce optimization Editable HTML and CSS Daily backups Site stats and product reports Fully featured mobile app Product importing via CSV files Different product variations Print orders SEO-ready site structure Individual product reviews Facebook selling module Social media integration Physical and digital products in the store Unlimited traffic to your store Again, Shopify’s goal is to be a turnkey product that allows you to quickly and easily build an ecommerce store. Including all these features ensures that you have everything you need to build your store. With Shopify, you can extend its base features using plugins called Shopify Apps. With Shopify become such a popular ecommerce solution, there’s a large ecosystem of third-party apps available to create advanced functionality like sophisticated email marketing, advanced financial and inventory analysis, and much more. If there’s a need, chances are there are already several apps that solve that problem. Shopify also offers an Enterprise-grade solution called Shopify Plus. You probably won’t need the power and features of Shopify Plus right out of the gate but it’s nice to know that they can continue to support your store as it grows. EASE OF USE One of Shopify’s greatest strengths is ease of use. It’s intentionally designed to make things quick and easy. All you need to do to get started is go to Shopify.com, go through the signup wizard process, and you’re done. After that, you can take your store live and begin selling. It’s really that simple. The Shopify dashboard makes it easy to get a feel for your store performance, as well as any issues you need to be aware of. It’s also easy to adjust settings like shipping, taxes, handling new orders, giving refunds, and more. For example, when you’re adding a product to your Shopify store, every option is available on a single panel so you don’t have to visit multiple spots on your dashboard when adding new products. This means you don’t have to hunt in multiple places for all the things that need to be included (description, specs, shipping, etc.) when you bring new products to market. If technology is intimidating to you, Shopify does everything they can to make things easy. CUSTOMER SUPPORT Because Shopify wants to be an all-in-one solution, they make great efforts to offer first class customer care. You can reach a customer care specialist at any time, 24/7 via phone, email, or live chat. They also has an extensive knowledge base that contains solutions to many of the most common problems. If you’re worried about getting stuck or running into a problem, Shopify wants to set your mind at ease. SHOPIFY SEO Basic SEO practices like meta data and site copy are no problem with Shopify. Assuming you’re adding sufficient descriptions for products, home page copy, and other SEO-related items, you should be fine. And when it comes to design, Shopify themes have a reputation for clean code and natural linking structures, both of which are important for search rankings. Because Shopify stores are hosted on their massive infrastructure, pages load fast, which is another important element for SEO. The only downside is that if you want to add a blog, it needs to be hosted on a third-party like WordPress. EVERYTHING YOU NEED TO KNOW ABOUT WOOCOMMERCE Now that you have a solid feel for Shopify, let’s explore WooCommerce. WooCommerce offers the same functions as Shopify with one key advantage: control. Because Shopify stores are built on the Shopify platform, you are limited in what you can do. You’re limited to their themes and their selling options. With WooCommerce, on the other hand, your options are almost unlimited because you’re building on the WordPress platform, which has thousands of themes and plugins, all of which can enhance your store. With Shopify, you don’t own your site. You get your own URL, and you’re spared the fee of hosting, but you’re restricted only to what Shopify allows you to do. This straightforward approach works well for eCommerce beginners (and lazy entrepreneurs), but not for those that prefer a hands-on approach. By contrast, WordPress and its WooCommerce plugin are tools to facilitate building your own site. You have much more options, vast libraries of plugins to customize your site, and more control in general — especially when it comes to site design, which we’ll discuss below. Think of it like this: You’re building a house and you have to choose between two construction crews. One lets you design the plans however you want, but the other comes with a rigid architect who tells you what you can and can’t do. DESIGN OPTIONS WooCommerce has been designed to work with the majority of WordPress themes, which means that your design options are essentially endless. There are many free themes available and thousands of top-quality premium themes to choose from. If you already have a WordPress site and a theme you like, WooCommerce can probably work with it. If you’re just getting started, you should pick a theme that advertises WooCommerce compatibility to ensure all its ecommerce features display correctly. There are themes that have been built specifically for WooCommerce, so if you’re having trouble selecting a theme, these are always a solid option. The Storefront Theme is the official WooCommerce theme and is a fine choice for your ecommerce store. While Shopify has an impressive range of themes, WooCommerce can be incorporated into any WordPress theme, in addition to its own library. That gives it far more variety, not just in template design, but in site features. Think about it. With WooCommerce, you can integrate any WordPress plugin into your eCommerce site. This creates a nearly infinite selection of possibilities. Of course, this means you have to put more time into designing your site, and not all plugins are free. Most of the Shopify themes are well designed, and if you have no desire to mess with design, then Shopify might be a better option. PRICING OPTIONS Both WooCommerce and WordPress are free. However, you will need to purchase a few things like web hosting, a domain name, a theme (if you choose a premium one), and any premium plugins you might use. Additionally, you’ll need to factor in the transaction fees from your payment gateway. Thankfully, these will only come into effect when you make a sale. When it comes to price, WooCommerce is at least initially, the cheaper alternative. However, if you start purchasing premium themes and plugins, your costs will go up. Depending on the Shopify plan, you could end up paying about the same amount. FEATURES WooCommerce can do anything that Shopify can do, and then some. While it doesn’t necessarily have all the features Shopify has right out of the box, you can be sure that someone has developed a plugin for whatever feature you need and there will probably be several different options to choose from. You’ll find plugins for everything from abandoned cart functionality to inventory management. You can fine-tune your checkout page and add in sophisticated marketing automation features. If there’s a need, there’s a plugin. In the event you need some very specific functionality and a plugin doesn’t exist, you’ll find that there’s an ocean of experienced WordPress developers that would be happy to create that plugin for you. Whether you want to sell on Facebook, implement email marketing, or study your customer’s behavior, WooCommerce can do it. Here’s what you’ll get with WooCommerce: Hundreds of plugins Runs off of your WordPress theme Payments via PayPal and Stripe built-in Adjustable shipping rates and taxes Complete control over your website and its data Facebook ad and Facebook stores extensions Unlimited products and categories Inventory control Mobile-friendly structure WooCommerce does a lot right out of the box and it’s free. It’s free core features are very similar to Shopify’s paid plans. This might make it seem like a much more affordable option, and it very well may be, but you should be mindful of the fact that in order to get advanced ecommerce features you may need to buy paid plugins. EASE OF USE Once you get through the initial steps of setting up a WordPress site, working with WooCommerce is just as easy as working with Shopify. The initial setup isn’t difficult, but it does take a bit longer and involve a few small technical details. If you’re uncomfortable when it comes to technology, you could have trouble at this step, but it’s really not difficult. To get started with WooCommerce, you need to: Buy your domain name. Purchase web hosting. Install WordPress. Install the WooCommerce plugin. Install any additional plugins needed. If this intimidates you, there are hosting companies that specialize in WordPress that will take care of everything for you. Some companies even have 1-click WordPress and WooCommerce installation options, meaning you can get your store up and running with minimal technical work. Once your site and WooCommerce are up and running, you’ll be taken through a setup wizard. It will help you set up things like currency settings, shipping options, payment gateways, and more. And like Shopify, WooCommerce makes it very easy to add new products. It usually can be done with a few clicks, meaning you don’t have to spend hours trying to get new products into your ecommerce store. SUPPORT One downside of WooCommerce is that, unlike Shopify, WooCommerce doesn’t have a central customer support staff. However, this doesn’t mean you can’t find solutions to your problems. Because WooCommerce is a WordPress plugin, you can get support on their forums or by creating a free account at WooCommerce.com. Additionally, Because WordPress and WooCommerce are open source, the developers who create the themes and plugins are available for support if you run into any issues. WOOCOMMERCE SEO This is one way that WooCommerce significantly outperforms Shopify. Hands down, WordPress is the best platform for blogging, which gives it a significant advantage for SEO. In fact, it’s not uncommon for Shopify sites to host their blogs externally on WordPress. Using a WooCommerce site on WordPress means consolidating these two crucial segments of the same brand. WordPress’s blogging capabilities encapsulate both a comprehensive CMS for content management and specific SEO concerns like meta data. Again, good SEO requires effort, but with WooCommerce on WordPress, the option is there for those that don’t mind the legwork. If you write outstanding blog content for the right keywords, you have a good shot at showing up on the first page of Google for particular searches, which can drive a massive amount of ecommerce sales. SO WHICH SHOULD YOU CHOOSE? Ultimately, the choice between Shopify and WordPress comes down to what you want out of your ecommerce store. Let’s break it down like this: CHOOSE SHOPIFY IF… Shopify distinguishes itself by being a really simple ecommerce solution for everyone. Anybody with the most basic computer and internet skills can create a Shopify store relatively quickly. It’s a simple, powerful turnkey solution that works right away. If the primary thing you’re after is simplicity and ease of use, Shopify can provide that. The setup is quick and easy and have a single dashboard that presents you with all the information. You should use Shopify… If you don’t have a website and you want to get an ecommerce store up and running as fast as possible with minimal effort. If you don’t mind paying a fee for all the features, even if you might not need them all. If you don’t care about the technological side of your ecommerce platform and just want it to work well and look good. If you are uncomfortable working setting up WordPress and don’t want to pay anybody to setup your store for you. If you want a turnkey approach where all you need to do is sign up and follow a few simple instructions. If you think you’ll depend heavily on customer support. CHOOSE WOOCOMMERCE IF… WooCommerce takes advantage of the hugely popular and powerful WordPress platform. Because of this, you get access to thousands of themes and plugins that can really make your ecommerce store shine. In terms of ecommerce, WooCommerce can do everything Shopify can, including coupons, shipping, taxes, and a lot more. You also have significantly more SEO options at your disposal with WooCommerce. An important concern to consider with WooCommerce, that you don’t have to worry about with Shopify, is choosing the right hosting provider for your website. Shopify handles this for you but you’ll want to be sure you find an experienced WordPress host that’s familiar with the unique technical, security, and maintenance needs of WordPress sites. In the world of web hosting, you generallly get what you pay for so don’t bargain shop on something as important as ecommerce hosting. You should use WooCommerce… If you want full control of your eCommerce store. If you to enhance your store with thousands of site designs and plugins. If you can handle the technical work required upfront to get your site up and running. If you’re one of those people who likes to do everything on their own. If you have a smaller budget. If you already have a WordPress site and want to build your store on top of it. If you already have a WordPress site and don’t want to add the additional cost of Shopify. If you can survive without 24/7 customer support. CONCLUSION Honestly, WooCommerce and Shopify are both outstanding options for building your ecommerce store. If you’re already familiar with WordPress, you might find the learning curve on WooCommerce more palatable than having to learn the ins and outs of a completely new CMS. Whichever you choose, the end result will still be a fully functional ecommerce store that can accept payments and process orders. So the real question is, “What are you waiting for?” The world needs another Amazon. Go create one!
While there are hundreds of factors that Google uses to rank a website, backlinks are undoubtedly one of the main building blocks of good Search Engine Optimization. And while it’s a fact that Google makes regular updates to its ranking algorithms and no one can know for sure what Google will do next, high-quality backlinks will always remain a decisive Google ranking factor. Why? Because a backlink is, in essence, a popularity vote. When someone links back to a page, it shows that they value that page and want others to see it. Google is in the business of delivering valuable information to its users, and when they see a page with a lot of quality backlinks it’s a signal to them that something valuable is on that page. The more backlinks, the more valuable. For this reason, it pays to learn how to build quality backlinks to your blog. But what exactly constitutes a quality backlink? Not all backlinks have the same value. In fact, some backlinks are worth far more than others. When Google analyzes the quality of backlinks, they look at how authoritative the site linking to you is and how related it is to your niche or main topic. There are numerous blackhat ways to get backlinks, but deploying these methods is playing with fire. If Google catches you using these methods, they can massively penalize your site, even going so far as removing it from search listings altogether. If your business relies on organic search traffic, this can be a death blow. Bottom line: don’t use shady methods when getting backlinks. Get quality links the right way. The following are 14 ways to do that. If you want to jump to any particular method, simply click the method: Method #1: Guest Post On Authoritative Websites Method #2: Create Amazing Content Method #3: Create Infographics Method #4: Promote Content Through Email Method #5: Use “Dofollow” Social Media Sites Method #6: Identify Broken Links Method #7: Contribute To Resource Pages Method #8: Find Brand Mentions Method #9: Give Testimonials Method #10: Find Outdated Resources Method #11: Do An Influencer Roundup Method #12: Appear On Podcasts Method #13: Create A Wikipedia Page For Your Company Method #14: Submit Your Blog To Aggregators Backlink Method #1: Guest Post On Authoritative Websites “Domain authority” is a metric used to measure a website’s authority on a scale of 0 to 100. If you can get backlinks from high authority sites, it can significantly boost you in the search rankings. Of course, these sites aren’t just going to give out backlinks for free. So how can you get them? One simple way is guest blogging. When you write a guest blog post on another site, you almost always have the option of including one link back to your site. Make sure that link points to a page you really want to rank, not just your homepage (unless you want your homepage to rank). For example, if you’re trying to rank a page where you sell tshirts, make sure the backlink points to that page. Julia McCoy talks about how she used guest blogging to massively increase her organic traffic: We don’t pay for advertisements or pay to get our rankings sponsored. Instead, we provide quality content on our site and through other sites to boost our authority in the industry. Our five-year-old company outranks major competitors by 5% on average, and we’ve already climbed to more than 4,100 keyword rankings with Google. Finding High Authority Sites But here’s the thing. In order for guest blogging to improve your rankings, you need to post on sites that have more authority than yours. Writing a post on your sister’s tiny knitting blog isn’t going to do much for your SEO. You need to guest blog on sites that are authoritative. To help you determine where to focus your guest blogging efforts, you can use MozBar, a tool that shows the authority status of any domain. The higher the domain authority, the better it is for guest blogging. This is a double-edged sword though. If you’re going to write for these sites, you need to produce outstanding content. You can’t expect them to accept a guest post that is fluffy, low on value, or full of grammatical errors. It needs to be outstanding. Writing For Reputable Sites In Your Niche As important as it is to get an authoritative website linking to you, the effort can go to waste if the website isn’t relevant to your industry. In other words, Google looks even more favorably on links coming from high authority sites that are related to your site. This demonstrates to Google that you’re an authority in your industry and should be valued and trusted. Guest blogging for websites in your niche helps you promote your website, increase your referral traffic, become an expert in your industry and, yes, get a quality backlink. Similar Site Search is a tool that can help you find relevant websites. Write For A Website More Than Once It’s important for backlinks to look as natural as possible. Guest posting for a website more than once can help the appearance of those backlinks as you continue to offer valuable commentary on your area of expertise. Keep in mind that Google is getting better and better at detecting shady SEO practices. If you land a guest blogging opportunity for a blog with a higher ranking than yours, use it to boost your credibility and become an expert in your field. Want to write a guest post for Pagely? Let us know. Backlink Method #2: Create Amazing Content There’s a reason why content is king. No matter how well you optimize your site, if your content isn’t good enough to be shared or linked to, your SEO campaign won’t work. There are hundreds of thousands of blog posts being published every day, and 99% are fluffy nonsense, like “Which Character From F.R.I.E.N.D.S Are You?”. To get high quality backlinks, you need to create content that stands far above everything else – content that is worth a backlink. Additionally, Google is increasingly prioritizing in-depth content for search results. Why? There are probably several reasons: Longer content is often more authoritative and contains the answers to people’s questions. Longer content contains more keywords, meaning it can rank for a variety of searches. Longer content is usually more thorough, increasing the odds that it’s valuable to the reader. Original research also tends to garner a huge number of backlinks. Why? Because people always link to it to back up claims they make. For example, if you did a detailed, data-based study in which you analyzed every factor that goes into making the perfect cup of coffee, you would get thousands of links from coffee bloggers. The bottom line: if you want backlinks and more organic traffic, create high-quality content that people will love. Take the time to map out a content strategy and only publish high quality content. You want viewers to find you through SEO, but once they do, you should be sure that your content is valuable to them. Backlink Method #3: Creating Infographics On Trending Topics Infographics are highly shareable, so look at what topics are trending at the moment in your industry and invest in creating a high-quality infographic. Infographics that display data in a visually appealing way work especially well since they make it much easier to digest complex subjects. BuzzSumo is an incredibly helpful tool when it comes to identifying trending topics. Simply type in a search term, like “content marketing”, and you can see what pages have been shared the most during a given time period. Make sure you mention at the bottom that you created the infographic. That way, if it goes viral, it will get a lot of views and might bring in some backlinks if viewers embed it into their own websites. Tools like Canva and Piktochart make it relatively easy to create engaging infographics that people will want to share. Backlink Method #4: Promote Content Through Email It’s not enough to just create content – you also need to promote it. If you can get notable influencers to share your content, either on social media or by linking to it on their site, it can be a huge win in terms of backlinks. Derek Halpern of Social Triggers is a huge advocate of this. He says: Here’s the truth: It’s smarter to find another 10,000 people to consume what you’ve already created as opposed to creating more. Or, in other words, create content 20% of the time. Spend the other 80% of the time promoting what you created. And while you may think that social media is the best place to promote your content, when it comes to getting backlinks, email tends to be more effective. Why? Because it allows you to engage with a person one-on-one and ask them if they would be willing to help you promote your content. But promoting your content through email involves a lot more than simply sending out an email blast to a bunch of people asking them to share your content. That’s called “spamming”. Rather, you need to cultivate relationships with influencers to the point that they’ll want to promote your content. How can you do this? That’s an entire article in an of itself, but here are some helpful strategies to consider: Follow them on social media and actually interact with them Quote them in the content you create Create something so valuable that sharing it makes them look good Be personal in your emails (no spammy templates) Help them see why your content adds value to their audience The main point is that you need to engage with influencers in a real and personal way. Show them that you know them and that the content you’re pointing them to is valuable to them. If you don’t do this, you’ll come across as a spammer sending out mass emails. Tim Soulo of Ahrefs makes this point: You just published a new article on your blog and now you’re going to send a mass email to 100+ top people in your niche with an excuse: “I saw you tweeted a similar post.” I’m sorry to say this, but your article is not welcome in their inbox. Otherwise, they would probably already be signed up to your email list. And besides, it’s just disrespectful to mass-email top people in your niche with some generic “outreach template.” The more famous a person is, the more of these outreach templates he gets in his inbox daily. Bottom line: be respectful when promoting via email. Backlink Method #5: Use “Dofollow” Social Media Sites “Nofollow” tags are pieces of code that tell search engines to ignore specific backlinks. In other words, if a backlink has the “Nofollow” tag, Google doesn’t give it much weight in terms of search rankings. It’s a little more nuanced than that and SEO experts will debate the subject endlessly, but that’s the general idea. They exist to prevent spammers from opening countless Facebook profiles and YouTube accounts to create backlinks to their website. However, not all social media sites have ‘no-follow’ tags. You can create Google+ profiles for your company’s key employees and founders and include custom links with anchor text for the search terms for which you want to be found. LinkedIn also allows you to create custom anchor text when you choose ‘other’ in the first website link. Google Places lets you create a local business listing with target keywords in the profile and description fields. Though you may not be a Foursquare user, you should still create a profile. The links associated with your account are followed by search engines. The same goes for your profile links on Yelp, and YouTube. Backlink Method #6: Identify Broken Links This method involves contacting a website owner to report broken links on his or her website. When you email them to report the problem, you can make a friendly suggestion that they replace the broken link with your website. The chances of a backlink back to your website are high because you are doing the site owner a favor and because a link to you is better than a 404 page error. How do you find these broken links? Step #1: Install the Chrome extension Check My Links or LinkMiner. These will automatically detect broken links on a page. Step #2: Find sites or pages in your niche that have a lot of outgoing links. These could be resource pages, directories, etc. The more outbound links there are, the greater the chance that some of them don’t work. Step #3: Identify broken links on the pages using the Chrome extensions. When you email the site owner, be sure that you’re suggesting content that is relevant to the original broken link. If it’s not, they’ll have no reason to link to it. Backlink Method #7: Contribute To Resource Pages Many sites contain resource pages where they curate the best content related to a specific subject. Assuming you’ve created outstanding content that’s related to the site, the owners of these sites are often willing to link to your content. How do you find these resource pages? Google has a series of specific search phrases designed to identify them: “Keyword” + inurl:links “Keyword” + “helpful resources” “Keyword” + “useful resources” “Keyword” + “useful links” Once you’ve found a relevant resource page, use the MozBar to determine the domain authority of the site. If it’s high enough, email the site owner and suggest your content to be added to the page. Backlink Method #8: Find Brand Mentions There are probably numerous mentions of your name or brand online that aren’t linked back to your site. These are golden opportunities to get links back to your site. Using a tool like BuzzSumo or Mention.net, you can easily find places that people have mentioned your name or brand but not linked to it. Once you’ve identified an unlinked mention, simply email the site owner, thank them for mentioning you, and ask if they would be willing to link back to your site. Most will be more than happy to. Backlink Method #9: Give Testimonials If there’s a product or service that you love, offer to give the creator a testimonial for their homepage. It takes only a few minutes to write one up and most people love featuring glowing testimonials on their site. On your name, simply include a link back to your site. If you use a large number of tools, this can be a great way to easily get a number of backlinks. Simply list them out then contact the creator or each to see if they would be interested in a testimonial. Backlink Method #10: Find Outdated Resources Because things change so fast on the internet, things become outdated extremely quickly. For example, a 2015 list of all the factors that cause a Facebook post to be seen would be completely outdated since Facebook has changed their algorithm numerous times since then. Nevertheless, that outdated resource may have dozens, or even hundreds of backlinks pointing to it. Those backlinks are ripe for the taking. How do you do it? Three simple steps: Step #1: Create the updated resource. Step #2: Find all the sites that are linking to the old resource. There are numerous tools, such as SEMRush or Ahrefs, that make it easy to find all the backlinks. Step #3: Email the sites linking to the old resource, alert them to the fact that it’s outdated, and let them know about your updated version. Assuming your content is top-notch, most site owners will be grateful for the heads up and more than willing to link to your new and updated version. Backlink Method #11: Do An Influencer Roundup An influencer roundup is when you contact numerous well-known people within an industry, get their opinion on a particular subject, and then put all those opinions in a single piece of content. Alternatively, you can collect the best content produced by influencers and put it into one big roundup. Once you’ve created the content, you email the influencer letting them know about it and asking if they might be willing to share it. You also share the post multiple times on social media, tagging a different influencer each time you share. It’s a powerful way to get both backlinks and social shares from some of the biggest names out there. Why? Because the influencers have a vested interest in promoting your content. They’re featured prominently, which in turn makes them want to share your content on social media and link back to it. Backlink Method #12: Appear On Podcasts This is a slightly unconventional, yet very easy way to get links back to your site. When you are interviewed on a podcast, it’s common practice for the host to include a link to your site in the show notes. Depending on the authority of the host’s site, this can generate some seriously high quality backlinks for you. Additionally, it establishes you as an authority in your industry. Backlink Method #13: Create A Wikipedia Page For Your Company Wikipedia has an extremely high domain authority, meaning that any links coming from it to your site are going to pass along some serious SEO juice. But how do you get a link from Wikipedia? You create a page for your business. On the page, links to the appropriate pages on your site. It’s important to note that Wikipedia pages are reviewed and must pass a series of conditions to get approved. This means you can’t just slap something together, cram it with links, and expect it to get approved. You need to follow the terms spelled out by Wikipedia, including citing all your sources and ensuring everything is factually correct. Backlink Method #14: Submit Your Blog To Aggregators Blog aggregators, like Alltop, are sites where links from numerous blogs are automatically posted. In order to be included on blog aggregators, you need to submit your blog. Typically, the process looks something like this: Sign up for an account on aggregator site Submit your site to the aggregator You’ll be given a small snippet of HTML code to place on your site. This code lets the aggregator confirm that you’re the owner. Someone from the aggregator site will review your submission. Assuming everything is okay, you’ll be added to this list. Other blog aggregators include: BizSugar.com BlogEngage.com BloKube.com InBound.org The Work Is Worth It Yes, each of these methods requires some amount of work. But the reality is that organic search traffic is becoming increasingly important as social media platforms kill the reach of businesses. Additionally, organic traffic tends to be more valuable than social traffic due to the fact that there is intent behind searches. In other words, people are looking for something when they search, whether that’s a product or the answer to a question. If you can provide them what they want, you become valuable to them and they’ll come back again in the future. So get to work building those high quality backlinks. Your blog will thank you.
Pagely is thrilled to announce our partnership with Object Cache Pro. Utilizing state of the art compression technology, Object Cache Pro is now part of Pagely’s core offering, and available to all of our customers, platform wide. Offering major cost savings, access to some of the world’s best technology, and a dedicated DevOps team to personalize your setup, Pagely customers can look forward to continued scale and growth, with no hosting friction. A first of its kind partnership, Pagely is proud to help fund innovation in this WordPress space by investing part of our budget into working alongside the fantastic team at Object Cache Pro. We’ve already seen great gains with Object Cache Pro and our customers can look forward to more in the future! Why Object Cache Pro? Before Object Cache Pro, we faced two challenges with sites making use of an object cache – CPU overhead and network saturation. The underlying technologies in Object Cache Pro solved both of these problems for us, translating to less money spent on server hardware and fewer situations where the (quite generous) AWS network limits are reached. With Object Cache Pro’s state of the art technology utilizing the Zstandard compression library from Facebook, without a lot of CPU overhead, compression is now done at the extension level, talking to and from Redis. This means less hardware, lower costs, and a better experience for our customers. Aside from supporting an efficient compression algorithm (zstd), Object Cache Pro also uses the igbinary serializer which is a drop-in replacement for the standard serializer in PHP. This works about twice as fast at serializing and unserializing data. Additionally, the data footprint is smaller when using igbinary and that translates into less memory being used by the underlying Redis service. We also found an in-depth comparison on igbinary vs other serializers on Blobfolio that you may also enjoy reading if you’re into this kinda stuff: https://blobfolio.com/2017/03/benchmark-php7-serialization/ With a wide selection of Redis plugins available in the WordPress marketplace, Object Cache Pro was the obvious choice for us not only because of their forward-thinking tech but also because of the dependability we have come to expect and appreciate from their brilliant team. All of this aside, Object Cache Pro is unrivaled when it comes to bug fixing, an extent to which is a rarity across opensource software. There’s a saying in the opensource community that goes, “there’s a lot of eyes so all the bugs get fixed.” But, more what we see concentrated use of the software by lots of users leading to fewer bug fixes for fear of breaking one users’ site. That, and, no one owns the codebase, so less can get addressed in a timely manner. Similarly, we are continuously impressed by their coverage of testing, fully unit tested with 100% code coverage. Further, switching over to Object Cache Pro gives Pagely customers access to our commercial relationship with their team, which means any problems our customers see are fixed within a few days. You benefit from our relationship. Fewer bugs in the caching layer and full unit testing is a good thing, and that’s something we stand behind. So, What’s in it for the Pagely Customer? We are the first premium host to achieve this level of partnership with one of the best technology companies in WordPress. Through our relationship with Object Cache Pro, every single Pagely customer benefits from the work we’ve done to secure that. But real talk, what’s in it for you? Major cost savings. Even when it means less revenue for Pagely, we’re constantly looking out for cost savings for our customers. By decreasing our dependency on more hardware, you see the savings directly on your bill. Access to a premium partner. Since you’re at a premium hosting provider, you automatically get access to the partnerships we’ve developed. What’s more? You don’t pay an extra licensing fee. The best tech, baked into your Pagely account. We’re always on the hunt for the best and most innovative technology for you. With no effort on your part, we do the legwork of implementing this tech across our technology stack. All you do is benefit from it. Bigger performance wins possible with a little extra code work. WordPress has a feature called Transients. It’s a way to store the result of a complex query or a long-running remote API call temporarily in order to make subsequent lookups for that data return a lot faster without doing the same expensive operation again. Normally without any object cache, transients are stored in the WordPress database’s wp_options table. When using an object cache, it is stored in memory. Adding a few extra lines to your code allows you to tap into the power of this API for incredible performance gains. Having an efficient object cache utilizing fast compression and serialization only increases those gains. A dedicated DevOps team. While others might catch on and jump on the bandwagon of partnerships like this, Pagely still stands above the rest in meaningful ways that translate to real gains for you, the customer. Our DevOps staff becomes your dedicated, in-house team. Our engineers handle all the setup and optimization to make sure your usage of Redis is optimized specifically based on your exact circumstances and needs. Other hosts don’t do that! When you partner with Pagely for your WordPress hosting at scale, you know you have selected the most forward-looking host driven by advances in technology, cost savings for you, and tangible outcomes that help your business thrive. Object Cache Pro Helped FanSided Scale So let’s get to a real-life example here. One of the first Pagely customers we switched over to Object Cache Pro was FanSided. Here you can see a dramatic decrease in network utilization on the Amazon Aurora RDS instance after implementing Object Cache Pro along with custom Transients Caching, which dropped usage from 1 Gigabit per second to 400 Megabit per second; and yielded even lower usage after some more optimizations were made. FanSided comprises a massive network of over 300 active websites and needed a fast solution to maxing out servers and using way too much CPU. Pagely found that solution in Object Cache Pro and implemented it with no effort on FanSided’s part to completely eliminate those issues. Here you can see how memory is no longer being maxed out after the date we turned on Object Cache Pro for FanSided. The proof is in the data, and here you can see dramatic drops in CPU usage after Object Cache Pro was implemented, as well as servers being maxed-out-no-more after the switch. Dramatic drops in CPU usage after implementing Object Cache Pro for FanSided. Read the full FanSided + Object Cache Pro case study here, and take it from our CEO: “In the vacuum of 1 website, a small performance gain is useful. At our scale of hosting, processing hundreds of billions of requests per month across thousands of AWS EC2 instances, a small performance gain to each site means a real and quantifiable benefit to our customers and our bottom line. Now what if that performance gain was not so small, but major. We sought out and partnered with Object Cache Pro after seeing the dramatic results in terms of performance and resource usage when testing. We have thus deployed their Enterprise solution fleet wide and the results speak for themselves.” – Joshua Strebel, CEO of Pagely
Catch up on the conversation. This piece comes as a followup to our CEO Joshua Strebel’s recent piece on why you should never pay your WordPress host for pageviews. Managed WordPress hosting has exploded across the hosting industry since Pagely created it way back in 2006. Overall, the level of innovation that the mainstream has brought to WordPress is amazing. Unfortunately, this sometimes comes with negative side-effects. As investors demand higher profits, many of these managed WordPress hosts are looking for ways to gain a quick and easy boost to their margins. Like we mentioned in our definitive guide to PHP workers, there are a few different metrics that are often misinterpreted, whether intentionally or not. Today, we’re going to talk about pageviews and their role in the managed WordPress hosting world. What Counts as a Pageview? Many hosts cite pageviews as a billing metric with vague term descriptions, if any exist at all. Even with clarified definitions, pageviews tend to mutate on a host-by-host basis with a dizzying array of buzzwords. Although individual managed WordPress hosts vary on what they consider a “pageview”, most define it like this: pageviews are the number of unique IP addresses that access pages on your WordPress site per day, excluding known bots. (Yeah, I know. The term is more like “the number of unique request sources per day, based on predefined catch-all filters.” But I wasn’t the one that made this up, so bear with me here.) Pageviews as a Billing Metric Before we dig in any deeper into the details, let’s think about the definition that I mentioned. Considering that narrative, which of these sites would be more expensive to host? A directory website that houses billions of pages, showing 1,000 entries at a time. A personal blog who’s majority of traffic is to single posts. A documentation site where visitors typically access multiple pages per day. A simple informational website for a local restaurant. An online shop that sells small-batch artisanal snake oil. An API that uses headless WordPress to dynamically fetch content. If you guessed that they represent the same metrics in the eyes of pageview-based billing, your logic prevails! Assuming that they all experience the same number of unique visitors, they’re all treated the same way, regardless of how resource-intensive the site is or how many pages each visitor accesses. Of course, it would be silly to treat all of these sites the same way. Some pages might have large amounts of fully dynamic content, while others might be eternally served from cache. Using an umbrella term like pageviews as a billing metric causes several different issues, based on the site being hosted. Setting Realistic Expectations The first issue that pageview-based billing causes is an unrealistic expectation for low-performance, unoptimized sites. If you’re not familiar with how WordPress sites perform on the server side, you might think that these limits matter exclusively and use them to determine what capabilities you need from a hosting provider. If you’re evaluating your hosting options purely based on a pageview limit, you’re ignoring critical factors that can dramatically impact your WordPress site. Performance-Based Punishment What if you’ve put hard work into optimizing your site? Well, now you’re wasting money on a billing metric that doesn’t matter. If your site is highly cacheable, you’re feeling the impacts even further. When serving content from cache, it’s practically free from a hosting perspective. You’re being nickel-and-dimed for something that is entirely outside of your control. Knowledge is Power As you scale, knowing what you’re paying for can quickly become a critical part of maintaining a healthy, cost-effective site. Coupled with the fact that the same people who are charging for pageviews tend to hide their underlying infrastructure behind the curtains, there’s no way to verify or manipulate what’s being counted. While many claim that they exclude the known IP addresses and user agents of known bots from counting towards your monthly pageview bill, what’s their motivation for even bothering? After all, more pageviews mean more money in their pockets. Pageviews Are Still Helpful Many of our prospective customers ask, “How many pageviews can ‘x’ plan handle?” Like we mentioned earlier, the impact of each pageview dramatically varies based on the type of content viewed and how your site was developed. Every WordPress site is different. It would be impossible to accurately estimate the ideal hosting environment without a complete understanding of what your site’s usage looks like. Although pageviews are a faulty metric as far as billing is concerned, they can still be useful as part of a larger dataset. Whether you’re scaling, optimizing for better performance, or shopping for a new hosting provider, pageview data plays a role in getting a full picture of your site. For example, if you were running benchmarks to determine your server’s capacity, pageview data could be used to identify what a typical day looks like. Let’s say your site looks something like this: 10% of traffic is on the home page. 30% of traffic is to various landing pages. 30% of traffic is to different blog posts. 20% of traffic is to your product’s pricing page. 10% of traffic is on account-related pages. Using that traffic data, you could then estimate what types of content have the most significant impact on server resources. You may find that some pages underperform and could use some optimization, while other highly-cacheable content, like blog posts or landing pages, remain essentially free. If 90% of your traffic goes to fully-cached content, increases in traffic have a trivial impact on your bottom line, if any. Closing Remarks Operating a WordPress site at scale is all about a delicate balance of performance and cost. At Pagely, we partner with our clients to help them achieve those goals. While shopping for a new hosting provider, be on the lookout for hosts that impose false barriers, such as PHP worker limits and pageview counts. Those vague limitations are a red flag that they’re going to try to upsell you later. (These limitations are also a sign that they’re trying to sell you on shared hosting resources too, but that’s a topic for another discussion entirely.) We hope that you’ve learned more about the impact of pageviews (or lack thereof) and why it’s not an appropriate billing metric. Do you have any experiences with pageview-based billing that you’d like to share? Is there something we missed? Let us know in the comments below.
This monthly report is provided for the WordPress community at large from Pagely’s head of security, Robert Rowley. Rowley and the entire security team keep their finger on the pulse of any potential vulnerabilities that might affect our customers, as well as any WordPress user. We sincerely hope these efforts help any and all that could use information from the experts on monthly security issues. We commend the researches and developers that help to identify and patch these issues in a timely fashion. WordPress Core No notable WordPress core security releases. Plugin/Theme Vulnerabilities of Note Security & Malware scan by CleanTalk https://wpvulndb.com/vulnerabilities/10292 This vulnerability within CleanTalk allows an authenticated user, such as an editor or subscriber, to make unauthorized Ajax calls which could lead to file deletion or downloads and also potentially function calls. Adning Advertising https://wpvulndb.com/vulnerabilities/10293 The Adning Advertising plugin has a vulnerability in versions lower than 1.5.6 which allows unauthenticated requests to upload or delete files, leading to an RCE attack, which can then lead to full site takeover. Wise Chat https://wpvulndb.com/vulnerabilities/10299 Wise Chat versions lower than 2.8.4 are susceptible to a CSV injection via a command sent in chat messages by an unauthenticated user that is included in an exported CSV file, which then could potentially lead to an RCE attack. Email Verification for WooCommerce https://wpvulndb.com/vulnerabilities/10318 The Email Verification for Woocommerce plugin prior to version 1.8.2 is affected by a loose comparison issue. This could potentially lead to any user (authenticated or non-authenticated), to log into the WordPress site. SRS Simple Hits Counter https://wpvulndb.com/vulnerabilities/10316 The SRS Simple Hits counter plugin is currently vulnerable to an unauthenticated blind SQL injection vulnerability. The responsible reporting parties at Tenable ( https://www.tenable.com/security/research/tra-2020-42 ) are working with the developer to write a more comprehensive patch to address this vulnerability, and will not release more details on the attack until they know a patch has been released. Site owners using SRS Simple Hits Counter plugin on their sites should keep an eye out daily for the patch to be released. Payment Form For Paypal Pro https://wpvulndb.com/vulnerabilities/10287 The Payment Form for Paypal Pro plugin versions before 1.1.65 are vulnerable to an unauthenticated SQL injection attack. The attack is a trivial single request which can expose the contents of your database (which includes user passwords and potentially other secrets) to the attack. This is a high risk vulnerability and site owners should patch immediately. WooCommerce Subscriptions https://wpvulndb.com/vulnerabilities/10330 The WooCommerce Subscription plugin is vulnerable to an unauthenticated stored cross site scripting (XSS) attack in the subscription billing process. Attackers can submit their XSS attack payload to during the billing step in the signup process, and later that payload will be executed on the browser of the administrator/user who reviews the attacker’s account. Site owners should update WooCommerce Subscriptions plugin to version 2.6.3 and not check any new user account information until that update is performed. TC Custom JavaScript https://wpvulndb.com/vulnerabilities/10325 The TC Custom Javascript plugin is vulnerable to an unauthenticated stored cross site scripting attack. Sites running versions before 1.2.2 should update immediately, attackers can add their own javascript or HTML to the footer of all pages loaded by WordPress with a few basic requests. This vulnerability is likely to be targeted by SEO spam bots. KingComposer https://wpvulndb.com/vulnerabilities/10297 The KingComposer plugin is vulnerable to a reflected cross site scripting vulnerability in versions before 2.9.5 This means the attacker’s malicious HTML/javascript will only be available to the browser making this request. This still poses a high risk if an attacker can trick an already logged in user to click on a malicious link/form to the website, potentially exposing secrets viewable by the user giving them to the attacker. JobSearch https://wpvulndb.com/vulnerabilities/10328 The JobSearch plugin versions before 1.5.6 are vulnerable to a reflected cross site scripting vulnerability. Much like the KingComposer vulnerability above it is a high risk if logged in users to be targeted. The proof of concept for this vulnerability will be released on August 6th, 2020, site owners should patch before this date. See previous months’ WordPress security updates from May and June.
The benefits of this WordPress security guide are two fold: Learn exactly what you need to know about WordPress security in 2020. Understanding WordPress security helps you adopt a security-oriented mindset that will help you prevent and mitigate risks as you make day-to-day decisions. Get actionable, step-by-step instructions for securing your WordPress site. The steps you need to take aren’t particularly time-consuming, don’t require advanced technical knowledge, and the linked guides are vetted for clarity and completeness. Of course, it’s impossible to cover every possible vulnerability and scenario. That’s why we also include the overarching “principles of WordPress security.” If you can follow these broad principles many of the minute details that are difficult to address in this type of post will take care of themselves. Why is WordPress security critical? It’s important you understand how big an issue WordPress security is so you give it the time and attention it deserves. Here are some sobering statistics: Google blacklists 10k sites a day for malware and another 50k for phishing each week. A blacklist from Google kills that source of traffic which can be highly disruptive to a business’s revenue. Fixing and removing a blacklist can be a hassle, particularly if your server was used to send SPAM emails. A blacklist from email service providers harms your deliverability rate which undermines the effectiveness of your email marketing. In 2018, 90% of CMS hacks were WordPress. Granted, WordPress is the world’s most popular CMS with 34% of the web powered by WordPress, but this is still a disproportionate amount of hacks. For a variety of reasons, WordPress sites are targeted and exploited more than any other CMS. 60% of attacks target small businesses. You may think that hackers won’t bother with your site because you’re a small fish but “security through obscurity” does not exist on the web. No one is too small to be a victim of an attack. WordFence reports that there are over 97,978 attacks happening per minute. This is not a small, isolated problem. Large swaths of WordPress sites are being probed for weaknesses at any given time. Will you be ready if your site is targeted? While these stats paint an intimidating picture of what you’re up against, it’s important you confront the realities of managing a WordPress site in 2020. If your business relies on WordPress, security is not something you can afford to ignore. If you haven’t taken steps to secure your site, you’re vulnerable to attack. It could be only a matter of time until your site becomes compromised. This is one area where “an ounce of prevention is worth a pound of cure.” The principles of WordPress security Securing WordPress is more than checking off a list of boxes, it requires you to adopt a security-oriented mindset that guides your decision making. These principles will help you prevent mistakes as you make day-to-day decisions like adding new WordPress users, plugins, and themes: Vulnerabilities are often introduced by WordPress users. Vanilla WordPress that is kept up to date and uses strong passwords is relatively secure. It’s often the decisions made by WordPress users that create weaknesses that hackers exploit. This is why articles like this one are so important. It’s up to you to be educated on, and consistently follow, the WordPress security best practices outlined here. Minimize plugins and themes. New WordPress users are often overjoyed by the extensive ecosystem of plugins and themes available for WordPress. This can lead to indiscriminate installation of plugins. But, each new plugin or theme adds code to your site that, potentially, adds new vulnerabilities. By minimizing the plugins and themes installed, you also minimize the amount of code your site uses, and, by extension, the number of potential security vulnerabilities. In general, if you can solve a problem without installing a plugin, that’s the best option. Install updates as soon as possible. Updates to the WordPress core and updates to plugins and themes often contain critical security updates. They should be installed as quickly as possible. If you have a good back up strategy in place, you can roll back to a previous version in the event the update causes issues. Follow the principle of least privilege. This is a core principle of cybersecurity in general and is not unique to WordPress. This is a fancy way of saying, “don’t give a user more privileges than they need because those extra privileges give hackers more power and access than they’d otherwise have if they compromise that account.” Attacks can still happen. You can try as hard as you can to cover all the bases and still fall victim to an attack. This is why regular, automated backups are critical. Do not ignore this advice. A hacked site can be disruptive but can generally be fixed with minimal cost and disruption, a hacked site without a backup to roll back to can be severely disruptive. You are never finished with security. Having a 100% secure WordPress site is an impossible task. You can’t accomplish complete risk elimination, so aim instead for ongoing risk reduction. This “risk reduction” mindset prompts you to continue taking steps to improve your security as part of an ongoing, never-ending initiative. The most common WordPress attack vectors Understanding the most common methods hackers use to exploit WordPress will help you understand how to address them and why the steps recommended later in this article are necessary: Brute Force Attack A cyber criminal uses trial and error to identify a password or pin. They use combinations of common usernames and passwords until they find the right one. It’s the equivalent of trying every key on a key ring to find the one that works. This is all done using a computer script so they can run thousands of combinations with very little effort. Given enough time, any account is hackable but strong passwords thwart this kind of attack. SQL Injection Malicious SQL code is injected into a database to gain access to database information that was never intended to be displayed. Depending on the hackers goals, this can lead to your database being deleted, customer information being stolen, or sensitive company information being accessed. Malware A virus or spyware is inserted using an expired theme or plugin. The attacker can gain access to your data, insert pages into your site for black hat SEO, and perform a number of other nefarious activities using your site. Cross-site scripting Javascript code is inserted which then collects data commonly used to exploit WordPress plugins. This can be used to redirect your site visitors to malicious content. also known as an “XSS attack.” DDoS Attack A Distributed Denial of Service (DDoS) attack floods a website with traffic which overwhelms server resources causing it to fail. Multiple machines send frequent requests to the server using malware installed on those machines for that purpose. The distributed nature of the attack can make it difficult to identify and block the sources of the traffic. Now that you understand how hackers will attempt to breach your site security, let’s look at how we can block and prevent these attacks… Steps to secure your WordPress site In spite of the many ways your site can be compromised, it is possible to mitigate these risks and prevent many attacks. Here’s a list of recommended steps to protect your WordPress site from security attacks: 1. Force Strong Passwords “81% of attacks are based on insecure or stolen passwords” “It only takes about 10 minutes to crack a lowercase password that is 6 characters long.” These two facts taken together make the case that you must use strong passwords for all WordPress users. Strong passwords are long and use a combination of upper and lower case letters, numbers, and symbols. Longer is better but 20-characters is probably plenty. Strong passwords are difficult to memorize, especially if you’re using unique passwords for each site (you should be!). This means a password manager, such as LastPass or Dashlane, is a critical tool. These apps make creating strong passwords easy, store them in a central location, and make logging into your websites easy by autofilling your passwords. Here’s how to make sure all your WordPress users are using strong passwords. 2. Turn on automatic WordPress Core updates One of the advantages of using a popular CMS like WordPress is that there are many people with a vested interest in keeping it secure. Thousands of people are contributing to WordPress security by reporting vulnerabilities to the WordPress team. This widespread collaboration means most holes are patched relatively quickly. But, if the updates that contain those fixes are not applied, you leave your site vulnerable to attack. The best way to ensure your WordPress core updates happen quickly is to turn on automatic updates. This way your WordPress site will be kept up-to-date without you having to do anything. Here’s how to turn on automatic core updates by modifying your config.php file. 3. Stay on top of plugin and theme updates You absolutely must keep your plugins and themes up-to-date. The importance of this cannot be overstated. You’ll also want to be careful to use plugins and themes that are updated often. If you’re using a plugin or theme that has not received an update in months, it’s a good idea to check in with the developer or find a more frequently updated plugin that accomplishes the same goal. When you search for a plugin in the WordPress plugin database, this information is provided in the sidebar: 4. Use Two-Factor Authentication (2FA) Two-factor authentication adds a layer of protection to your WordPress site by making it nearly impossible for a hacker to log in to your site — even if they know your username and password. You should set up 2FA for all WordPress users. 2FA can be set up quickly with simple, free plugins. Here’s a list of available 2FA plugin solutions for WordPress. 5. Brute Force protection Even with 2FA and strong passwords, it is good to setup brute force protection to help with overall performance on the server by reducing the amount of work PHP has to do. Here’s how to protect your site from brute force attacks. 6. Create automated, scheduled Backups In the event of an issue, there should always be recent database and file backups available. You should also create a backup before making any major changes to your site, such as installing plugin and theme updates. Many of the popular backup solutions take care of this for you. Here’s a list of backup solutions for your WordPress site 7. Change your login pages The default login pages for all WordPress sites are sitename.com/wp-login.php and sitename.com/wp-admin.php. Using these default login page URLs makes it easy for hackers to begin a brute force attack by trying combinations of usernames and passwords. By using a login URL that is difficult to guess, it makes it more difficult for hackers to begin the brute force attack because they don’t know where the login form lives. Here’s how to change your login page URLs. 8. Use SSL Secure Sockets Layer (SSL) encrypts all data sent from your website to the visitors browser obscuring potentially sensitive data. Using SSL has many benefits in addition to security. Google may rank your site higher in the search results and many browsers indicate whether a site is secured by SSL which can reassure them your site is trustworthy. Here’s a tutorial on setting up SSL for your WordPress site 9. Don’t use the default database prefix Using the default “wp_” database prefix makes it easier for a hacker to insert code into your database (SQL injection). Here’s how to change the default database prefix for a new site and an existing site. 10. Check your folder and file permissions File permissions define what actions can be applied to the files on your server. You should never set any WordPress file or directory to 777 permissions. Instead, make sure your permission scheme is as follows: Folders – 755 Files – 644 Here’s a guide to checking and fixing the permissions of your WordPress files and folders. 11. Disable pingbacks WordPress pingbacks are enabled by default. But for most sites, they offer little benefit. But, they can be used to turn your WordPress site into an unwilling participant in a DDoS botnet. To turn off pingbacks, you can go to “Settings –> Discussion” and uncheck the “Attempt to notify any blogs linked to from the article” box. It’s also a good idea to uncheck the “Allow link notifications from other blogs (pingbacks and trackbacks) on new articles” box: 12. Hide your WordPress version number One of the ways attackers gain access to a site is by exploiting known vulnerabilities in outdated versions of WordPress. Hackers can scan your site and easily find out what version of WordPress you’re using. If that version has a known vulnerability then the hacker has a good idea of how to proceed. The best way to prevent this is to keep WordPress up to date. However, you can also prevent a hacker from finding out what version of WordPress you’re running. Here’s how to hide your WordPress version number. 13. Don’t use the admin username Hackers can safely assume that a WordPress site is using the default “admin” username and that username will give them admin privileges so all they need to do is figure out the password. This gives them a direct path to gaining admin access to your site with a good probability of success. Eliminating the admin username makes it significantly more difficult to attack your site this way. If you’re already using the admin username, that’s okay, you can change it now. Here’s how to change the admin username. 14. Use a secure Managed WordPress Host A host that supports all the major CMSs will have difficulty staying on top of WordPress security. By specializing in the WordPress CMS alone, a WordPress hosting provider can devote the resources necessary to prevent many attacks. A reputable Managed WordPress Host will have a security team dedicated to shielding your site from threats. They’ll handle many of the concerns raised above like taking care of WordPress updates, creating backups, and more. Here at Pagely we have a comprehensive suite of security features called PressArmor that handles both WordPress application security and server security. Security questions to ask a potential managed WordPress host: Is your hosting environment chrooted? If your host has multiple domains on the same server, check with them to ensure they use chroot to isolate each WordPress app. If one app is hacked, this would help prevent access to other apps on the server. Is SSL included and easy to set up? A good WordPress hosting provider will provide SSL free of charge using a service such as Let’s Encrypt. Do you actively monitor my site specifically for WordPress vulnerabilities? If you detect a vulnerability on my site, how will you inform me? A good WordPress host will stay on top of the latest threats to WordPress sites and constantly scan your site for those threats. If they find a vulnerability, they will work with you to address it. Are you using a web application firewall (WAF) to protect my site? A WAF block malicious traffic before it reaches your site and can help prevent XSS attacks and SQL injections. Here’s a list of important considerations for choosing a Managed WordPress Host. Conclusion WordPress security cannot be taken lightly and you must take steps to secure your site. Using a Managed WordPress Hosting Provider like Pagely is one of the best ways to improve your security because you will have an experienced team dedicated to protecting you. Whether you choose to handle WordPress security yourself or leverage a host that specializes in WordPress, it’s important to treat WordPress security as an ongoing effort. You are never done with security but if you’ve taken the above steps you’ve protected yourself from many of the most common threats.
Since this is the internet – and the rules of the internet clearly state everyone gets an opinion, I’d like to share one of mine around website hosting billing plans. Quick backstory: 10+ years ago when we launched Pagely we did so with a simple line on our pricing page denoting a rough estimate of the expected capabilities of that plan ie: Plan – 1 was suitable for ~1 million pageviews. Along came the next several providers who did something similar with one important difference. They actually attempted to measure and cap pageviews per hosting plan, bracketing their plans by this new billing metric. In my opinion Pageviews used as a billing item is a predatory and anti-consumer practice and you should be very wary of working with any company that applies this #successtax to your monthly bill. Definition of anti-consumer : not favorable to consumers: improperly favoring the interests of businesses over the interests of consumers Hi, I’m Joshua Strebel, Co-founder and CEO of Pagely – A leading Managed WordPress hosting company – Thank you for attending my TED Talk. What are you buying when you are buying “hosting”? To host a WordPress site you need a few key components. A server (a computer) connected to the internet with software installed to process requests and responses for your application. Storage / Disk space attached to that webserver to save your files to. Data Transfer / Bandwidth. This is the pipe the information flows through. That’s basically it. Hosting providers typically lease/sell you packaged fragments of these resources for a monthly fee. Plan A, Plan B, Plan C. etc. Of course there are other items that may be line-itemed such as included support levels, CDN GB’s per month, managed services, etc. Plan A has X amount of consumables for Z price. It’s all fairly straightforward as most consumers understand what a Gigabyte of Disk space is and can at least grasp that more CPU/RAM offered should equate to more potential performance. “Pageviews” does not fit this model well – as the definition of a pageview is amorphous and subject to exploitation. Oh, and spoiler alert, PHP workers is not a valid billing metric for WordPress hosts either. What does an automobile lease have to do with hosting plans? Pageview limits on hosting plans are akin to annual mileage limits on auto leases. It’s a cap on the use of an asset you already purchased. In an automobile lease context a mileage cap at least has some merit as being a form of controlling the depreciation of the vehicle – you are essentially financing the deprecation of the automobile asset with a lease – and the lease company expects to sell that car (New retail value – Depreciation) when you return it. If the depreciation is too high, they lose money on that transaction as they have to sell it for less than they calculated. Your hosting plan is not a depreciating asset though – the hosting company is going to sell the same resources to the next customer when you are done for the same or likely higher fee. Therefore in my humble opinion: Pageviews are just an arbitrary anti-consumer fee – a penalty tax for using the service you already paid for. A Pageview is (depending on who you ask) a wrapper around these items: A measurable amount of Data Transfer in and out A measurable amount of CPU resources to process the request and render the response A measurable amount of Disk and Database activity Are you not already paying for these items as part of your hosting plan? Hint: Yes you are. But wait, there’s more – and my colleague will dig into these more in a future post. This pageview billing model is so poorly defined by the hosts that use it – it is ripe for abuse. It’s a scheme to generate revenue for the hosting company and unfairly penalizes the consumer. Hint: You already “paid” for the sum of the parts of a “pageview”. No two pages are the same. A cached page even with a few images can be served a million times a month with ease, and yet a badly coded membership-site page may tax the hardware it runs on each time it loads. They have very different cost profiles to the host – yet both are treated equally under this model. If you invested the time to optimize your site, get it caching well and then blow it up with viral traffic.. That is a GOOD day for you and costs your host pennies of the monthly fee you are already paying them – yet when you get the overage bill for exceeding your pageview cap at the end of the month, are you going to enjoy that tax on your success? If you want to keep paying twice for the same resources you are welcome to. I simply do not think that is fair. Our friends down in Austin have made millions on charging their customers overage fees for exceeding their monthly pageview cap – even to the point having to publicly respond to criticism – only to keep the practice in place. Reminds me of airline baggage fees and fuel surcharges. and An “online payment convenience fee” when they only accept payments online. and JetPack being “free”. Happy WordPress’ing – Joshua Strebel
These monthly reports are provided for the WordPress community at large from Pagely’s head of security, Robert Rowley. Rowley and the entire security team keep their finger on the pulse of any potential vulnerabilities that might affect our customers, as well as any WordPress user. We sincerely hope these efforts help any and all that could use information from the experts on monthly security issues. We commend the researches and developers that help to identify and patch these issues in a timely fashion. WordPress Core WordPress 5.4.2 Security Release https://wordpress.org/news/2020/06/wordpress-5-4-2-security-and-maintenance-release/ A WordPress Security release (5.4.2) was made available on June 10th. This release addresses the following 6 vulnerabilities: Authenticated XSS in the block editor Authenticated XSS in media files Authenticated XSS in theme uploads Privilege escalation in set-screen-option() Open redirect in wp_validate_redirect() Information leak allowing comments to be read from password-protected posts and pages. Plugin/Theme Vulnerabilities of Note Removed from Repo WordPress website owners who have the following plugins installed are strongly encouraged to remove them from their websites or find a replacement as soon as possible. These plugins were removed from the WP.org plugin repository due to inaction of the developer to patch one or more security flaws: wp-pro-quiz delete-all-comments-easily High Severity Vulnerabilities ACF to REST API https://wpvulndb.com/vulnerabilities/10284 The acf-to-rest-api plugin versions before 3.3.0 are affected by a vulnerability which would disclose the values of the wp_options table to attackers. This vulnerability has varying severity based on what data is contained in a site’s wp_options table. KingComposer https://wpvulndb.com/vulnerabilities/10270 The kingcomposer plugin versions before 2.9.4 lack proper access controls for ajax endpoints, many of these ajax endpoints also include vulnerabilities which users with a valid accounts could target to change WordPress option values, inject content, store XSS code, delete files on the site or execute arbitrary code. wpDiscuz https://wpvulndb.com/vulnerabilities/10273 The wpdiscuz plugin versions before 5.3.6 are affected by an unauthenticated SQL injection vulnerability. This plugin is currently on release 7.0.3, and the plugin author is making 5.3.6 available as a back port for site owners not ready for version 7. Brizy – Page Builder https://wpvulndb.com/vulnerabilities/10261 Brizy Page Builder before version 1.0.126 is susceptible to an access control vulnerability via AJAX calls which allows a user with minimal privileges the ability to access editor functions. JobSearch https://wpvulndb.com/vulnerabilities/10255 The Jobsearch premium plugin before version 1.5.1 is affected by an unauthenticated reflected cross-site scripting vulnerability. The Proof of Concept is provided within the link below and is easily replicated: https://github.com/vladvector/vladvector.github.io/blob/master/exploit/2020-07-03-jobsearch-wp-job-board-wordpress-plugin-v1-5-1.txt See previous months’ WordPress security updates from April and May.
This article covers our public notifications related to major security issues our clients and the WordPress community should know about. We are always focused on prevention and the mitigation of risk to our clients, and keeping you updated here is part of that process. WordPress 5.4.2 Security Release June 11th, 2020 WordPress site users We trust them within reason. And patch, to be sure. The WordPress security team has released WordPress 5.4.2. This security release addresses 6 security vulnerabilities. There are numerous cross site scripting vulnerabilities addressed in this release however each required an authenticated user to execute the attack. There also includes one privilege escalation attack. If there were a theme in this release, it serves as a reminder to be sure you trust who you give accounts to on your WordPress site. The Pagely team has already begun rolling out this patch for all customers. If you have a version hold request on file, we will patch your site while keeping it on the same major branch version. WordPress 5.4.1 Security Release April 29th, 2020 You are safe at home, while we are patching your sites. Stay Safe. Stay Secure. The WordPress security team has released WordPress 5.4.1. This security release addresses 7 security vulnerabilities and includes 17 bug fixes. There are numerous cross site scripting vulnerabilities addressed in this release, so it is recommended site owner update right away (if you’re a Pagely customer we are already working on this for you.) The Pagely team will be rolling out this patch for all customers shortly. If you have a version hold request on file, we will patch your site while keeping it on the same major branch version. WordPress 5.3.1 Security Release December 13th, 2019 A vuln is a vuln, until a patch is released. Now it is secure. The WordPress core team has released WordPress 5.3.1, which addresses 3 security vulnerabilities and includes 1 security hardening measure. The higher risk vulnerabilities include XSS (Cross Site Scripting) in some unlikely situations, as well a vulnerability which could allow someone to mark a post “sticky” on the site, without the need for authentication. Pagely has tested this version and has the patch available for all customers running any WordPress version. Due to the weekend being upon us, we will begin upgrading sites on Monday December 16th. Any customers who would like the upgrade to be performed over the weekend can reach out to our support staff and they will be glad to help. PHP-FPM+Nginx Remote Code Execution (CVE-2019-11043) October 29th, 2019 Hasty vuln released. We checked immediately; Our servers are safe. On October 22nd, 2019 a security researcher released their findings related to a remote code execution in PHP-FPM, which was present on hosts with specific nginx configurations using fastcgi_split_path_info. Pagely’s stack does use the fastcgi_split_path_info directive within our nginx configurations, and our staff investigated the vulnerability on the 22nd the day of the relase. We identified we were already properly using the recommended remediation of try_files to ensure the file being requested actually exists on the website. Pagely’s default nginx configuration is not vulnerable. On October 24th the PHP dev team released the official patch version to address this vulnerability. Our staff have already started applying this patch to all customer servers. WordPress 5.2.4 Security Release October 15th, 2019 Secure WordPress Fast Six Vulnerabilities Secured by this Patch. The WordPress.org core team has released WordPress 5.2.4, a security release addressing six vulnerabilities from XSS to viewing unauthorized posts. Pagely staff have already begun applying patches to our customer’s WordPress websites. Customers with version holds will only receive the patch for the branch they are currently running. WordPress 5.1.1 Security Release Addresses XSS March 15th, 2019 Comment filter for Cross Site Scripting prevention; Helps secure WordPress. The WordPress.org core team has released WordPress 5.1.1 which is a security release to address two vulnerabilities related to improper filtering of comments on WordPress sites. Pagely staff have already begun applying the patch for each of our customer’s WordPress version, and will keep customers on their current branch version if they have requested a version hold. WordPress 5.0.1 (and 4.9.9) Security Release December 13th, 2018 WordPress new release Patches seven vulns in all. Handled by our team. The WordPress.org core team has released WordPress 5.0.1 which is a security release to address a number of vulnerabilities found in WordPress versions 5.0, 4.9.8 and older. The core team has also provided security releases for WordPress versions 4.9.x, 4.8.x, etc.. which addresses the same vulnerabilities for that WordPress branch release. Pagely staff will apply the appropriate patch for each of our customer’s WordPress version, and will keep customers on their current branch version. This means, if you’re running 5.0, we will apply the 5.0.1 patch, if you’re running 4.9 then we will apply the 4.9.9 patch, and so on with 4.8 and etc… This patching will be completed by the end of the week. WordPress 4.9.7 Security Release Addresses Arbitrary File Delete (CVE-2018-12895) July 5th, 2018 We patched this last week. This security release is safe to wait for. The WordPress.org core team has released WordPress 4.9.7 which adds some functionality and includes a security patch for the previously reported “Arbitrary File Delete” vulnerability (CVE-2018-12895) which we addressed last week Pagely implemented a patch to address this vulnerability on all customer websites, as there was no WordPress.org patch available when the vulnerability was publicly disclosed. Pagely customers can request to be upgraded to patched versions of WordPress over the weekend, all customer sites will be upgraded by early next week. WordPress Author Arbitrary File Delete (CVE-2018-12895) We trust our authors, to not delete files, but let’s not allow it. RIPSTech researchers Slavco Mihajloski and Karim El Ouerghemmi reported yesterday of a vulnerability in WordPress core which would allow users on a WordPress site with Author level access or higher the ability to delete and/or re-upload any file writable by the PHP process WordPress runs under. The limitation of this vulnerability hinges on the fact a malicious user must also be someone a site owner trusted with having author level access already (or a compromised author user account could be abused) The consequence of this vulnerability would be that an attacker or malicious user could potentially remove files on the server, which may disable protections (such as .htaccess files, or security plugins), or allow them to re-write a site’s wp-config.php (to point your site at the attacker’s database, or install their own credentials/secret keys.) Our infrastructure configuration does not allow PHP processes to be able to modify any WordPress core files, however the risk of modifications to plugins, .htaccess files or other user uploaded files remains. To address this we have implemented a recommended hotfix which sanitizes the file path in the attachment delete/modification function used by WordPress core. The patch implemented has been tested and verified as safe and will be pushed out to our customer servers this week. If for any reason this hotfix causes issues with your site user’s ability to remove or edit media on your blog, please let our support staff know and we can help sort out the problem. PHPMyAdmin File Inclusion and Remote Code Execution (CVE-2018-12613) (PMASA-2018-4) Admin your DB with php, securely. We did the upgrade Pagely customers who have phpMyAdmin configured on their servers can rest assured we have taken steps to upgrade all of our customer’s phpMyAdmin installations to address multiple vulnerabilities recently reported. TLS 1.0 Retirement It’s been a long time coming, so break out the gold watch and cake. TLS 1.0 is finally being retired across the web thanks to the push by PCI-DSS. Pagely is updating our customer websites this week to address this and will be supporting TLS 1.1 or higher by default on our servers this week. By default, customer websites will only communicate over HTTP using the more secure TLS 1.1 and 1.2 protocol versions, and TLS 1.0 will no longer be an option. The reason for the change has been a long time coming. There are multiple browser based vulnerabilities in TLS 1.0, and the protocol version has been depreciated for years. However, the big deadline is that PCI-DSS counsel has set a hard deadline for June 30th, 2018 as the final day that sites will no longer be able to pass PCI scans if they have TLS 1.0 enabled in any manner. The impact of requiring TLS 1.1 or higher, is almost certainly going to be negligible. Every major browser supports TLS 1.1 and 1.2, rough estimates put less than 4% of the global internet traffic as using a browser that only support TLS 1.0, this is mostly composed of old mobile devices. So, sorry everyone on a dated iPad or Android tablet/phone, it’s not safe for you to transmit data over HTTPS and hasn’t been for a long time! Luckily, this number continues to drop every year, as these old devices eventually get replaced or taken out of service. Pagely Login Page Updates Pagely customers will notice something new when accessing their Pagely administration panel https://atomic.pagely.com on May 31st 2018. Our new login portal! Don’t worry, this change is expected as we are rolling out some improvements to our administration panel and preparing for it’s replacement. When you visit https://atomic.pagely.com your browser will automatically be redirected to our new version of Atomic. You may see the words “BETA” here and there, and some customers (those already upgraded to ARES) will have new features available as well. There is nothing you need to do on your end at this time, your login will function as normal and the new atomic panel has all the same basic features as the old one — If you’re feeling a little nostalgic, you can still switch back to the old Atomic panel by hitting the “Atomic (Legacy)” button found in the panel. In the near future we will be offering a new 2FA feature to give our customers a better experience with their 2FA management, but this first login portal change on 2018-05-31 will not affect your existing login credentials. PHP Security Patch (CVE-2018-10546 CVE-2018-10547 CVE-2018-10548 CVE-2018-10549) You need a null byte; Or you get heap overflows! MakerNote take Note. PHP has released a security patch which addresses four security vulnerabilities, the worst of which is a heap overflow from uploaded images which lack null bytes or corrupted EXIF data in MakerNote files. Further details available in the PHP 7.0 Changelog and PHP 5.6 Changelog. Pagely has begun upgrading customer servers and all PHP versions will be on patched in the next few days, if not already. WordPress 4.9.5 Release Secure hardening in the four nine five release; Other bugs fixed too. WordPress version 4.9.5 has been released and is considered a security and maintenance release. The WP core team addressed 3 security related bugs which are not critical security bugs, but improve the code’s overall security. You can read more about the release here. Pagely will begin updating customer sites to 4.9.5 shortly. POP-ping WordPress Object Injection? DNS must be trusted. Or else, oh no! Hacks! Researcher Nick Bloor (@nickstadb) recently released a report on object inject+DNS vulnerabilities in WordPress which could lead to remote code execution/arbitrary file uploads to sites. Nick explains that if attackers control the name servers the website uses to lookup domains, then it’s possible to “spoof” being the WP update server due to WordPress defaulting to HTTP communications when HTTPS fails during updates. This report outline that if attackers were able to take control of a DNS server, they could pivot that access to then also take over WordPress website via the WordPress auto-updater as well as exposes a PHP Object injection as well. Pagely customers are not affected by this vulnerability, as we are a managed host and do not allow modifications to what name servers our customer’s servers utilize. Secondarily, our server permissions would not allow WordPress auto-updater to function on it’s own (we handle upgrades for customers), this is identified in the “caveats” section of the vulnerability disclosure page as a preventative measure. WordPress load-scripts.php DoS (CVE-2018-6389) Feb. 6, 2018 Loading all the scripts, leads to long web responses. Rate limiting, Win. We are aware of the reported Denial of Service (DoS) affecting WordPress’s /wp-admin/load-scripts.php; Assessing the risk we believe our caching system dramatically reduces any DoS threat targeting a single URL with scripts like this. We are implementing a fix which is currently in testing, it will limit the number of requests people can make to this file before being throttled and subsequently blocked. This fix will be available for all customers, including those on the new ARES platform. WordPress Security and Maintenance Release: 4.9.2 Jan. 16, 2018 Other people’s code How did it get on your site? Sad emoji face. WordPress version 4.9.2 has been released and it contains an update to address an insecurity in the Media Elements library, which is included in WordPress core. The patch addresses a cross site scripting (XSS) vulnerability, which could allow remote attackers to inject their own HTML onto your site. Pagely will be patching customer sites immediately, and should be finished shortly. If you would like to read more about this release please see the WordPress blog announcement here. Spectre and Meltdown Jan. 5, 2018 Reading memory, outside of your privilege. Time to patch kernels. [Update: Feb 2, 2018 CST] Our kernel hotpatch provider has released a working patch for Meltdown as well, and it has been applied to all customer servers. [Update: Jan 18, 2018 09:00 CST] Spectre: Patched without the need for a reboot Meltdown: Patch available if you request a reboot, we are still waiting on the no-reboot patch which is close to being tested as safe to apply. If you are concerned about the risks associated with Meltdown, contact support to request a server reboot. Or wait until our no-reboot patch has been tested and is working safely. Risk associated with Meltdown: There are still no PHP based proof of concepts, therefor we consider it a low-likelyhood that anyone (aside from someone with SSH access to your server) would be able to perform this attack on your site/server. If you disagree with this risk assessment, then please contact support and we will schedule a reboot to apply the patch for Meltdown ASAP. [Update: Jan 11, 2018 11:30 CST] Our kernel patch provider has released a working patch for Spectre, but not Meltdown. We will be applying the Spectre patch to all servers before the end of the week, and will be awaiting their patch for Meltdown when it becomes available. If you would like to hasten the patch time, we can apply the kernel patch from Ubuntu (released yesterday) however this will require a schedule reboot for the change to take affect. If you would like to schedule a reboot of your server, please contact our support staff from your account’s primary contact email address (or via our administration panel) These patches are known to cause a negligible performance hit on servers when applied. It’s likely you will not notice this performance hit on your site unless your code does a large amount of system calls and/or you are already close to needing an upgrade. Our engineers are working on a solution to this issue and we may be able to work with customers impacted to entirely remove this performance hit or actually come out ahead. [Update: Jan 9, 2018 09:00 CST] At this time (Tuesday January 9th) we do not yet have a stable patch to apply to customer’s servers. The patch plan for early this week was not met. This was due to the complicated nature of this patch, and ensuring a stable patch is what is pushed out to servers. It’s been identified by multiple sources that this patch is not the simplest, concerns of stability and CPU overhead come up and this has delayed the patch from either Ubuntu (our operating system) or KernelCare (our kernel patch provider). Risk assessment: The existing proof of concepts for these vulnerabilities are not executable against our customer’s sites due to how our PHP is configuration (we restrict/ban any exec/shell calls) which reduces the risk of this vulnerability. Only customers with compromised SSH accounts would be vulnerable (and if there does exist a PHP PoC in the future, only customers with compromised sites would be exposed.) We are delaying the patching process. This decision is made under the consideration that many people are reporting issues with the patches available, and the lower risk this vulnerability has at exploiting WordPress sites on our network. Tentative timeline: We expect patches from one of the upstream providers (Either KernelCare or Ubuntu) tomorrow, Wednesday Jan 10th, however this may be delayed. When a patch is available, if it is Kernel Care, no reboot will be required. If it is Ubuntu, then we will need to reboot your server for the change to take affect. We will begin applying patches for customers this weekend or next week (a few days after the patches are released so we have time to test the patch sets.) We will contact customers via email to schedule a reboot, if it will be required to apply this patch. [Original post] Pagely is aware of the multiple related vulnerabilities in Intel (and other) CPUs known as “meltdown” or “spectre” and has been working on patching affected servers. This vulnerability is a bit different than most, as it requires patching done on the bare-metal server as well as a second round of patching on our virtual instances for Pagely customers. Our data center provider notified us regarding what servers were affected by a security concern and needed reboots to apply a patch. We have already been working with the affected customers on and scheduled reboots to address this security concern. It’s likely that these CPU architecture vulnerabilities were likely the cause for the scheduled reboots in December. At least check, we have address almost all of these (and the last few are scheduled with the respective customers to happen shortly.) All remaining EC2 instances are on bare-metal servers which likely have been patched without the need for a reboot (however this may change). If you did not receive an email related to scheduling reboots on your site/server, then the patch for this vulnerability did not require a reboot to take affect. If this changes, we will be on contact with any customers who need to schedule a reboot. That only leaves the linux kernel on each of our EC2 instances as a remaining concern. Luckily we now utilize a new technology in the linux kernel which allows for live-patching the kernel without the need for a reboot. This patch will be applied to all of our customers as soon as the kernel patch is officially out and properly tested. The tentative timeline for this should be this weekend or early next week (and require no reboot of the server, it should be applied seamlessly.) PHPMyAdmin CSRF Jan. 5, 2018 Click this link my friend Cross-Site Request Forgery! But not with Pagely. Over the holiday break there was a CSRF vulnerability reported with PHPMyAdmin, this class of vulnerability would allow an attacker to send malicious links to users with browser’s already authenticated in PHPMyAdmin to perform actions as the logged in user. A patch was applied in 4.7.7 to address this issue, and all PHPMyAdmin installations Pagley has have been updated. WordPress Security and Maintenance Release: 4.9.1 Nov. 20, 2017 Holidays are for: Family, eating too much, and security. Don’t worry you can stay distraction free when dining with friends and family this holiday season, knowing that we have handled this WordPress security release update for you and your sites. Instead of worrying if your site has been patched, you can be the one to bring it up at social gatherings and watch as your friends or family with WordPress sites become uncomfortable not knowing if their sites are secure or not. Pagely customers will receive the WordPress 4.9.1 security release update this week. This security and maintenance release includes patches for multiple vulnerabilities including a cross-site scripting (XSS) and XML eXternal Entity (XXE) issues. This will also officially bring all customers up to the 4.9 branch from 4.8.3, unless you’ve previously written in requesting an upgrade to 4.9 in the last few weeks. You can read more about this security release and specific details on what it includes here on the WordPress news blog, as well as more details on how we handle major WordPress releases (like 4.9) on our blog here: WordPress 4.9 Release. WordPress 4.8.3 Oct. 31, 2017 WordPress Halloween. We patch the tricks, 4 8 3 You get the treats. Boo! There is nothing spookier than a WordPress security release, the 4.8.3 patch addresses an SQL injection vulnerability in WordPress core which could be exposed by insecure coding practices found in some plugins. This release hardens the WP Core code to protect the sites who may harbor an insecure SQL query that trusts user input, sanitizing the input before it’s passed along to the database server. More information on this release can be found on the WordPress blog, details on the changes and how it modifies the return value of of esc_sql() have been posted by Gary Pendergast on the Make WordPress Core developers blog. Thanks goes out to the reporter of the vulnerability (Anthony Ferrara) for working with the WordPress security team. And a special acknowledgement to our own Arman Zakaryan for the Haiku this time around. OptionsBleed Sept. 21, 2017 Memory Leaking over OPTIONS requests sent. This patch stops the leak. The vuln-du-jour is called OptionsBleed and affects Apache2 web servers. It was caused by a programming oversight in the Apache2 server project which allowed small amounts of memory to be leaked when an OPTIONS request is sent to the web server. This bug only affects sites that are configured with a LIMIT directive which attempts to filter nonexistent HTTP methods, which is extremely rare but does exist in just under 500 of the Alexa top 1 million websites. A more detailed write up about this can be found here. The Apache2 dev team wasted no time in providing a patch. Which we have already begun applying to customer servers. We are rolling this patch out slower than a normal security patch because it’s so rare for this misconfiguration to exist and initial reviews of customer sites shows no Pagely customers have misconfigured LIMIT directives which would put them at risk. That said, the patch will be applied in a safe manner over the next week as to minimize any risk of downtime on customer sites related to the upgrade. WordPress 4.8.2 Sept. 19, 2017 Within this release, Nine security patches. Sites are now secure This week brings a security update to WordPress core. The security patches include multiple serious vulnerabilities and we are applying patches as soon as possible for customers. The WordPress core and security team have also released version to address any of the patched vulnerabilities for the following versions: 4.8.2, 4.7.6, 4.6.7, 4.5.10, 4.4.11, 4.3.12, 4.2.16, 4.1.19, 4.0.19, 3.9.20, 3.8.22, and 3.7.22. Any customer of Pagely running older branches of WordPress will also be brought up to date with these security patches. Malicious Code in Display Widgets Sept. 13, 2017 We coined a new term: “plugin identity theft”. Let it not catch on. A popular plugin in the WordPress.org repository has been “hijacked” (for lack of a better term) by a developer with suspicious intent. The popular plugin “Display Widgets” is described as “Adds checkboxes to each widget to show or hide on site pages“, yet in the last few releases there have been some unexpected new features added: such as adding posts directly to the site and tracking site visitors. Wordfence, a security plugin, wrote a full explanation on how this might have happened, it’s worth a read here. For our customer’s safety, we have banned the plugin from our customer sites. If your site hosted with Pagely was affected we have already reaching out directly to help you with the concern. More information about the issue at hand with this plugin can be found on WPVULNDB and in the plugin’s support forum . Update: The plugin team at WordPress.org have released a patched version of Display Widgets which reverts it back to the last known safe version, but there appears to be no author to continue maintenance on the plugin. The plugin will remained banned on our network until a time that we see someone has taken responsibility for the plugin and the future of patching it’s code. Which plugins and themes aside from display-widgets should you avoid? See our full list here. WordPress 4.7.5 Release May 17, 2017 Patchy patchy patch I love patches for WordPress Here come the patches Pagely customer sites are being updated to address 6 vulnerabilities. The ExploitBox Unauthenticated Password Reset Vulnerability has still not yet been addressed; Pagely customers are still not affected. Further details on this release can be found here: wordpress.org ExploitBox’s CVE-2017-8295 May 5, 2017 Return to sender sending to the wrong domain read from HOST header. There was a recently released authentication bypass vulnerability that affects WordPress before and including 4.7.4, with specific server configurations. The attack requires a request to a WordPress site via it’s IP address, while the attacker sets the HTTP request header to their own HOST value. Pagely does not allow direct access to WordPress sites via IP address and requires the HOST field sent in the headers to be the actual site being requested, thus a request with a HOST value controlled by an attacker will not be directed to a WordPress installation at Pagely. Bonus Haiku: Pagely hosted sites are not affected by this reported exploit. For more details on the vulnerability and how it works, please read: https://exploitbox.io/vuln/WordPress-Exploit-4-7-Unauth-Password-Reset-0day-CVE-2017-8295.html WordPress 4.7.3 Security Release Mar. 6, 2017 XSS and more bugs get patched in this release. The update is done Customer sites are being updated to address 6 security related issues. Further details on the release can be found here: wordpress.org CloudBleed, Shattered, CVE-2017-6074 Feb. 28, 2017 SHA One Collision CloudFlare Leaking Memory and Kernel Patching Normally these Haiku’s are short and sweet, but it was a busy week for security in the headlines last week so I took a little more time to compile the following information for you: The CloudFlare Bug (A.k.a. “let’s not call it CloudBleed”) A security researcher working for Google’s Project Zero disclosed information on a bug identified in CloudFlare’s services. The bug was in CloudFlare’s services, and in some cases resulted in a trace amount of the contents of the CloudFlare’s servers memory being leaked. This could have had major repercussions as the contents of these servers may contain sensitive information being sent to or from the web server behind CloudFlare’s services (such as passwords, encryption keys, or other sensitive data.) Many news outlets reported this as a catastrophe, however CloudFlare patched it’s server’s before the announcement and there have been no reports of this being attacked in the wild before the report by the Project Zero researcher. Key points include that the data being leaked was not controllable by the attacker (it was always random, including no ability for an attacker to target a specific site’s data). The data was also limited to small chunks. The leaks however, have likely been happening for a while, no one knows how much data has been leaked to people looking for it or if any widespread attacks could have gleaned any usable data from the memory leaks. Ultimately, while it’s possible every password, SSL cert, and secret keys were pulled from CloudFlare server’s using this attack, it’s not likely to be the case. Most probably: the researchers at Google’s Project Zero were the first to be aware of the problem and reported it responsibly to CloudFlare. However, it is still yet to be seen if anyone reports malicious activity caused by these leaks in the weeks and months to come. How could this affect you? If you utilize CloudFlare on your site (or utilized a service that used CloudFlare) and wish to be absolutely sure your private data (such as a password) is safe then you may want to be pro-active and change that password or other secret data. The SHA-1 Collision: (A.k.a. “Shattered”) A collision in the SHA-1 algorithm was reported by a different team at Google. SHA-1 is a cryptographic hashing algorithm, commonly used to validate the integrity of data being sent. The collision released by the team at Google showed that they were able to send two different messages but they both validated with the same SHA-1 value; ultimately meaning that data signed or verified using a SHA-1 algorithm can no longer be trusted. There is some good news however, this attack is fairly expensive to execute (over $100k) and SHA-1 has been on it’s way out for the better part of a decade. SHA-256 has already been established as the replacement and most people have already migrated to the more secure algorithm. How could this affect you? If your site has SSL/HTTPS, then that certificate might be signed using SHA-1 , but it is probably already signed using SHA-256 (as of 2015) if you would like to double check you can always utilize a utility like ssllabs.com to look up your site’s SSL certificate and see what method is used to fingerprint it. If you find you are using SHA-1 only, then the fix is to get a new certificate (most likely whomever you purchased the certificate from will issue you a new one using SHA-256 without much hassle.) Secondarily, if you developed your site’s code explicitly using the sha1 function, then you may wish to swap that sha1 function with the sha256 function. CVE-2017-6074 While CVE-2017-6074 did not have a cool name or website or lots of media coverage; it was a more serious threat. This flaw could allow anyone with access to a Linux server to escalate their privileges from a normal user to root on the server. Linux servers running up to date kernels (such as ours) were affected and we were very concerned about getting this patched for our customers. Luckily we have been updating our infrastructure and these kernel based vulnerabilities no longer require reboots to apply new patches. We applied a patch to address this vulnerability on the same day it was made available and noted no issue with the new kernel code running. WordPress 4.7.2 Security Release Jan. 26, 2017 Sites updating now we handle the patch. So you focus on your site. Customer sites are being updated to address 3 security related issues. Further details on the release can be found here: wordpress.org CVE-2016-5195 “Dirty COW” Oct. 26, 2016 We have sent many email notifications about the reboot. Kernel patches have been applied on our servers, however a restart is required for it to take affect. Scheduled reboot notification emails have been sent out and reboots will take place the week of October 31st. More information on the vulnerability can be found here: dirtycow.ninja WordPress 4.6.1 Security Release Sept. 12, 2016 The update happened faster than I could write this haiku about it. All sites have been updated to address 2 security related issues. Further details on the release can be found here: wordpress.org httPoxy Jul. 20, 2016 A pox on proxy headers; that are misused by some developers. Updates to our server configs are being pushed out that remove any “Proxy:” values attempted to be set by a request header. More details here: httpoxy.org And see also: Pagely’s Reverse Proxy WordPress Hosting WordPress 4.5.3 Security Release Jun. 21, 2016 WordPress 4.5.3 Several security issues are addressed. We are currently testing and rolling out this security update. Further details on the release can be found here: wordpress.org WordPress 4.5.2 Security Release May 9, 2016 4 point 5 point 2; Patch vulnerabilities in cross site scripting Updates on our platform are finishing up today. Further details on the release can be found here: wordpress.org CVE-2016–3714 “ImageTragick” May 9, 2016 Image conversion tragedy; is currently patched by policy. Further details: ImageTragick.com CVE-2016-2107 CVE-2016-2108 May 3, 2016 High Severity Vuln? We patched openssl, so you don’t have to. Security Haiku: CVE-2015-7547 Feb. 19, 2016 Host lookup dangers? No worry, we already patched glibc Which plugins and themes aside from display-widgets should you avoid? See our full list here.
These monthly reports are provided for the WordPress community at large from Pagely’s head of security, Robert Rowley. Rowley and the entire security team keep their finger on the pulse of any potential vulnerabilities that might affect our customers, as well as any WordPress user. We sincerely hope these efforts help any and all that could use information from the experts on monthly security issues. We commend the researches and developers that help to identify and patch these issues in a timely fashion. WordPress Core No notable WordPress core security releases. Plugin/Theme Vulnerabilities of Note bbPress By The bbPress Contributors https://wpvulndb.com/vulnerabilities/10242 https://wpvulndb.com/vulnerabilities/10243 https://wpvulndb.com/vulnerabilities/10244 https://bbpress.org/blog/2020/05/bbpress-2-6-5-is-out/ bbPress version 2.6.5 was released on May 28th. This security release addresses multiple vulnerabilities including one which affects sites with New User Registration enabled, allowing privilege escalation on newly created accounts. WooCommerce By Automattic https://wpvulndb.com/vulnerabilities/10220 There exists a vulnerability within WooCommerce, which would allow users with access to modify and duplicate products to upload arbitrary PHP code to the website, then execute it. This is an authenticated vulnerability (requiring a user account), and high risk as it would allow attackers to execute code on the server itself. Note: This vulnerability is a Remote Code Execution (RCE) based on our review of mslavco’s findings. Page Builder by SiteOrigin https://wpvulndb.com/vulnerabilities/10219 The page-builder plugin before version 2.10.16 has a CSRF (Cross-Site Request Forgery) to Reflected XSS (Cross-Site Scripting) vulnerability. Attackers could utilize this attack to target site administrators to execute code within the administrator’s browser within wp-admin. The attack targets the live editor and action_builder_content functions of the plugins. Elementor Pro https://wpvulndb.com/vulnerabilities/10214 There is a critical vulnerability in Elementor Pro versions before 2.9.4 which allows any logged-in user the ability to upload and execute PHP scripts. This vulnerability is actively being utilized with a registration bypass vulnerability which affects Ultimate Addons for Elementor (described next), allowing for subscriber registration even if registration is disabled. Ultimate Addons for Elementor https://wpvulndb.com/vulnerabilities/10215 The Ultimate-Elementor plugin before versions 1.24.2 allows attackers to create subscriber-level users, even if registration is disabled on a WordPress site. As noted, this vulnerability is being combined with the Elementor Pro vulnerability described above which may lead to remote code execution on sites with registration open and both Elementor plugins installed. Photo Gallery By 10Web https://wpvulndb.com/vulnerabilities/10227 An unauthenticated SQL injection can be executed on this plugin and it looks to target the gallery_type area of the plugin specifically. Site owners have until June 5th to update to version 1.5.55 or higher before the vulnerability details will be made publicly available. Form Maker By 10Web https://wpvulndb.com/vulnerabilities/10237 A vulnerability in this plugin allows an administrator or higher-level user to perform a SQL injection via Form Maker. Site owners should update to version 1.13.35 or higher as soon as possible, as the security researchers have stated some details regarding how to exploit this vulnerability have already been released publically. Official MailerLite Sign Up Forms By MailerGroup (x2) https://wpvulndb.com/vulnerabilities/10235 https://wpvulndb.com/vulnerabilities/10236 The official-mailerlite-sign-up-forms plugin has two vulnerabilities that have recently been reported. The first deals with the MailerLite plugin not sanitizing user input data which leaves a site vulnerable to SQL injection, this vulnerability was fixed in version 1.4.4. The second vulnerability addresses CSRF issues and was patched in version 1.4.5 of this plugin. WP Product Review Lite By ThemeIsle https://wpvulndb.com/vulnerabilities/10226 The wp-product-review plugin before version 3.7.6 is susceptible to an Unauthenticated Stored XSS attack which bypasses built-in protections allowing malicious HTML or Javascript to be stored and injected on all the site’s product pages. See previous months’ WordPress security updates from April and March.
