The Four-eyed Journal » WP plugins

Plugins to beef up blog security

jhay — Thu, 29 Oct 2009 04:44:35 +0000

Okay, as I’ve promised earlier, here’s a quick run down of how I have beefed up the security of this blog in response to the horrendous episode of hack attacks that screwed up my blog, the database and wiped out 6 month’s worth of posts.

Hard to crack passwords for Cpanel and Dashboard.

It’s a good thing I’ve developed the habit of creating passwords that are completely unrelated to my person such as name, date of birth, place where I live, the schools I’ve attended, etc. and manage to remember them. Passwords based on such information could easily be guessed by anyone whose bent on doing me harm even without the use of password-cracking techniques and software because those basic information about me could be easily culled from the web via the various social networking sites I use. Just Google my name and you’d know what I mean.

So on top of that, I’ve also become used to using passwords that are alpha-numeric and containing special characters. Finally, I’ve decided to change my blog’s and my hosting account’s Cpanel password every 6-months to keep hackers and other evil-doers guessing.

Plugins that add layers of security to my blog

Creating hard to crack passwords is just one step in blog security. The next logical step is to install plugins that add more security to your blog. It does not only prevent hackers from gaining entry and using your blog for their evil deeds, it also helps in the prevention of spam.

Login LockDown by By Michael VanDeMar, it adds some extra security to WordPress by restricting the rate at which failed logins can be re-attempted from a given IP range. I’ve customized mine to limit login attempts to 3 retries within 3 minutes. Offending IP ranges are blocked for two full hours. It’s so effective, it even blocked me when I failed to enter my correct password due to clumsy fingers.

Theme Authenticity Checker (TAC) by builtBackwards. It scans all of your theme files for potentially malicious or unwanted code. Had I known about this plugin earlier, the first hack attack could’ve have been prevented because the hacker injected my theme files with their spam codes. Do check out Jaypee’s review of this great plugin. We highly recommend it.

WordPress Firewall by SEO Egghead, Inc. just like what it’s name says, it blocks suspicious-looking requests to WordPress and provides for a way to white-list certain requests made by us admins and the plugins we use. It’s so powerful because it’s customizable.

Besides from this security plugins, it’s best to always upgrade your WordPress to the latest version because these releases contain bug fixes and security improvements. And never forget to keep backups and more backups of your blog’s database and make sure they’re in working condition.

Has you blog been hacked? How did you secure it and steps did you take to deal with the damage? Do share your tips and stories. Stay safe!

Image by lloydi.

Now powered by WordPress 2.8 Chet Baker

jhay — Thu, 11 Jun 2009 01:45:47 +0000

The newest and most up-to-date version of WordPress has just been released to the public today. Version 2.8 is named after notable Jazz musician Chet Baker. A quick summary of what’s new with WP 2.8 is showcased here in this video:

It’s true that the most notable improvement brought by WP 2.8 is its speed. My blog’s dashboard has taken a couple of seconds faster to load as well as the other parts of the Admin interface.

Install a theme with one click

I’ve tested this feature with my other blog and browsing themes from inside WP 2.8 is way much better than visiting the WP themes gallery because of the options to refine your theme search with the attributes you’re looking for in a theme.

The theme preview works great but lacking for heavy theme customizers like myself, because the preview lacks the customizations of your previous theme that you’d like to carry over to the new one. Perhaps this feature would come in future versions of WordPress.

Completely re-designed widgets interface

This is by far the best and most obvious improvement brought about by WP 2.8. Moving around widgets in each sidebar of your theme has never been easy, fun and intuitive. Kudos to the WP team and all the developers!

A step back with the Plugins management area

This is something that totally left me scratching my head. Why was the wonderfully more organized look of the Plugins management area in WP 2.7, wherein Active plugins are displayed on top, recently activated plugins in the middle and the inactive ones grouped at the bottom, abandoned for the old-school look?

Before in WP 2.7

Plugins management in WP2.7

Now in WP 2.8

Plugin management page in WP 2.8

All the plugins, be active or not, are once more displayed alphabetically in one big group. The color scheme adds more to the confusion and does little to give order to things. Basically, this sucks.

What happened?! Seriously, why the step back? What was wrong with the previous look?

With this, I’m really torn apart on whether to really cheer for WP 2.8 for all of its speed, awesome widget management and theme installation or cry foul for what has happened to the Plugins management page.

Give WordPress 2.8 a download and don’t forget to share your thoughts about it.

WP 2.7 and compatible plugins I use

jhay — Sat, 13 Dec 2008 12:08:54 +0000

Took another risk yesterday as I quickly downloaded and upgraded all my blogs to the latest version of WordPress 2.7 without even checking if any of the plugins I use where compatible or not with WP 2.7.

Much to my delight and relief, I was surprised to find out that all of the plugins I currently use works fine with WordPress 2.7. No hickups or bugs have surfaced both inside the spankin’ new Dashboard and on the front end of my blog.

This is the second time all my plugins worked “out-of-the-box” with the newest major release of WordPress and I’ve been thankful because of it. The horrors and headaches of plugins falling on its ass and messing up my blog is something I don’t want to experience any more.

That’s why it has become my habit of checking the plugins compatibility list for every major version of WordPress that is about to be released. Research and making backups and backups of my blog’s database, plugins and theme files have also become part of the routine in preparation for an upgrade to the latest versions of WordPress.

I’m sure though, almost every blogger is now familiar with this good habit. So without no more delays, I share the list of plugins currently in use on this blog that’s working fine with WordPress 2.7

It’s quite a list and I’m sure most of you fellow bloggers also use one or a couple of the same plugins. If you do, now you can rest easy knowing that these plugins are compatible with WordPress 2.7.

Be warned though that I’ve not tested these plugins extensively with WP 2.7 because I’m neither a plugin or WP developer, just your average blogger here who braved to use these plugins right away with WP 2.7

Visit the plugins respective home pages for updates or bugs in relation to WP 2.7 and if I run into any troubles with them, I’ll be sure to blog and report about it to the plugin author.

Until then, happy blogging with WordPress 2.7!

Now powered by WordPress 2.5

jhay — Sun, 30 Mar 2008 07:27:57 +0000

Finally! After waiting for so long this blog is now being powered by the awesome newest version of the most popular blogging software out there, WordPress 2.5 which is now available for anyone to download and take their blogging experience to new levels. (naks!)

A short recap of the new features of WP 2.5 has been laid down by Matt on the WP Dev Blog:

“multi-file uploading, one-click plugin upgrades, built-in galleries, customizable dashboard, salted passwords and cookie encryption, media library, a WYSIWYG that doesn’t mess with your code, concurrent post editing protection, full-screen writing, and search that covers posts and pages.”

So far, I’m happy and excited by the fresh look and feel of the Dashboard. All in all, I’d say that the inside of WordPress 2.5 has been “web 2.0-ized”. Cool and smooth colors, clean lines and still an elegant look. Blogging with WP 2.5 is a rewarding process in itself! Big kudos to the WP team and the community.

Testing. 1..2..3

Instead of playing with the RC versions of WP 2.5 on my demo blog, I opted to wait until the full version is available and test/play with it right here on The Four-eyed Journal. I’m looking forward to get my hands on the media library and see what it can do to improve my content and blogging experience. I’ll also be on the look out on how other bloggers will harness these new features of WP 2.5

Plugin Issues & Compatibilities

One of the major issues whenever a new version of WP comes out is how it will work with the current set of plugins we use on our blogs. That’s why before the release of a new WP version, we scour the web for lists or guides on Plugin Compatibilities. The most popular and trusted destination is the Plugins/Plugin Compatibility list which keeps the latest info on which plugins will work and won’t work with WordPress 2.5

Fortunately for me, 98% of the plugins that I currently use are compatible with WP 2.5. Even I was surprised by smooth upgrade I went through. Here below is the complete list of all the plugins I currently use which works well with WordPress 2.5

AntiLeech 1.8
Brian’s Threaded Comments 1.5.12
Commentluv 0.999
DoFollow 2.2
flickrRSS 3.2.1
Google Adsense widget 1.0
Google XML Sitemaps 3.0.3
Got Banners 1.0
Maintenance Mode 3.2
Most Commented 1.4
Optimal Title 3.0
Popularity Contest 1.3b3 (with this fix by Blogvaria)
Psychic Search 1.1
Recent Posts 1.07
Related Posts 2.02
Samsarin PHP Widget 1.2
Secure and Accessible PHP Contact Form v.2.0WP B20061101
ShareThis Classic 1.5.1
Smart Archives 1.9
Subscribe To Comments 2.1.2
the_excerpt Reloaded R1
Twitter Tools 1.1b1 (it works fine as long as you don’t twit from the sidebar)
WordPress Database Backup 2.1.5
WP-PostViews 1.20
WP Grins 1.5
WP lightbox 2 0.6.3

The two plugins that I have to let go of are Advanced Tag Entry whose functionality has been taken over by WP 2.5′s improved native tagging system and Get Recent Comments which somehow doesn’t work in widgetized sidebar. It wasn’t really a loss as there’s a default widget in WP that provides the same functionality of the said plugin. The removal of these plugins and some more that I no longer use also gave me the chance to clean up my blog’s MySQL database by removing the tables that plugins once used. A lighter database will come in handy when the time comes to yet again switch hosting, but that’s for another post.

Go ahead and grab a download of WordPress 2.5, you don’t know how much you’re missing.

Blog updates 2.08: WordPress security upgrade and Openads

jhay — Wed, 06 Feb 2008 00:50:07 +0000

It’s been a long while since I posted a blog update but it’s never too late to post one every once in a while.

This blog, along with all the blogs under this domain have just been upgraded to WordPress 2.3.3 (a marathon upgrade session last night!) in order to address the security issue raised by the WP guys. Thus here is the customary ~~repitition~~ quote from the WP blog about this security upgrade:

WordPress 2.3.3 is an urgent security release. If you have registration enabled a flaw was found in the XML-RPC implementation such that a specially crafted request would allow a user to edit posts of other users on that blog.

If memory serves me correct, this is one of the quickest succession of WP upgrades in years. It’s not that WP 2.3 is less stable or buggier than the previous versions, it’s just that these new bugs or issues come up along the way and are found thanks to the dedicated WP community who has made it their mission and passion to continually improve WordPress. Kudos to all of them!

A treat for future sponsors

Last Monday, I installed Openads, that free, open-source and popular ad server package from Openads organization. I’ve decided to install this ad server to run the existing and future ads on this blog except for the current text link ads scattered throughout this site. (And is what’s Google punishing me for T.T)

The benefits:

More reliable metrics about ad performance for my advertisers – advertisers love metrics, with Openads I’ll satisfy their needs to know almost every detail of their ads’ performance on this blog.
A centralized method of managing ads on this blog – Instead of uploading ad banners in my uploads folder then doing some barebones html/php code for it to be displayed on my blog, Openads will do most of the dirty jobs for me and offer a lot more control over the ads.
Ads not dependent on the kind of WP theme I’m using or going to use – Changing themes has become a sort of habit for me, it gives a fresh reboot to my blog, readers and a lot of other good things and so I don’t want to hindered in switching themes just because the current ads will loose their optimization in the next theme reboot.

Hopefully, with this new feature, advertisers would be encouraged more to buy ad space on this blog. Besides, I’ll always throw in some bonuses just to sweeten the deal and make advertising on this blog more worth the buck. If you’re curious as to what those bonuses are, you’ll have to advertise on this blog first. It’s negotiable and you can start the ball rolling here.

Behind the scenes cleanup

The other latest updates or changes to this blog are internal. I removed the plugins I do not use or will not use in the next 6 months or so. The WP database has also been checked for errors, cleaned up and optimized via phpMyAdmin.

SEO and optimization

This is the second or third post where you’d notice that the permalink is quite different from the post’s actual title. It’s because I’ve been using the Post Slug feature to shorten my permalinks and pack them with more relevant keywords for greater SEO benefits. A simple yet powerful SEO tool built right into WordPress.

To speed the load times of this blog and its pages, I’m interested in installing PHP Speedy, a script automatically speeds up download time of your pages by compressing all the files in one go instead of pulling the individual elements separately. The result is a reduction in the number of HTTP requests. (Thanks to Yuga for the heads up) Of course, I’ll have to check with my current host to see if they’re servers will be fine with this script. Any one else who’s interested or who has already tried this script?

That’s all for now. More on how things will pan out in my next blog update post.