Monthly ArchivesJuly 2019

Drupal is widely regarded as a secure content management system, so much so that it is often chosen for sensitive sites, including the sites of many government agencies. WordPress’s reputation for security is not quite as impressive, and we’re all familiar with stories of hacked WordPress sites.

Does that mean it’s fair to say that WordPress is less secure than Drupal?

This is not a simple question to answer because it depends on our answers to other questions: What do we mean by secure? How do we measure security? It certainly wouldn’t be fair to compare media stories about WordPress security with Drupal’s record — there are hundreds of times more WordPress sites than Drupal sites, so you’d expect WordPress to be hacked more.

One possible definition of a secure Content Management System (CMS) is one that is extremely unlikely to be compromised if it is configured according to the documentation and regularly updated. If we accept that definition, then both WordPress and Drupal are secure. No application on the web is ever totally secure, but properly configured and regularly updated Drupal and WordPress sites are unlikely to be compromised.

What Are the Qualities of a Secure CMS?

There are many ways to measure the security of an application, but from the perspective of users, three factors are particularly important.

• Few vulnerabilities. Software bugs that cause exploitable vulnerabilities should not be a regular occurrence. They’ll sometimes happen because software is complex and humans are fallible, but users should not expect to see their sites regularly hacked because of vulnerabilities in the core application.
• Vulnerabilities are quickly fixed. When vulnerabilities are reported to the developers, patches to fix them should be released quickly, and users should be informed of the need to update (or updates should happen automatically).
• Easy to secure. If a content management system is generally used by people without a lot of technical knowledge, then it should be designed to minimize opportunities for users to create security problems. For example, it shouldn’t be easy for people to use a default password instead of a secure password.

It’s easier to compare Drupal and WordPress on some of these measures than others. We can see how many critical vulnerabilities are found and fixed in WordPress and Drupal. We can’t see vulnerabilities that haven’t been discovered or reported — so-called zero-day vulnerabilities — but reported vulnerabilities are a useful proxy for overall risk.

It’s clear that both projects have their share of vulnerabilities, but we can also see that patches are released quickly. Both projects take security seriously and react with haste when vulnerabilities are reported.

Security Beyond the Core

What about WordPress plugins and Drupal modules? The fact is that when a WordPress site is hacked, it’s almost always a plugin to blame. There are 50,000 plugins created by developers of mixed ability who are not equally motivated to secure their code. Drupal too has occasional security issues related to modules, but the Drupal module ecosystem is smaller and more tightly controlled.

There are many high-quality WordPress plugins made by developers who are committed to building secure products, but the depth of the WordPress ecosystem means that the average WordPress plugin is more likely to pose a risk than the average Drupal plugin.

For both content management systems, and WordPress in particular, it pays to be cautious when sourcing and installing modules or plugins. Nulled plugins — pirate premium plugins — are a particular issue in the WordPress world. They are often infected with malware, and once a malware-infected plugin is installed on a site, it’s game over.

Developers Can Only Do So Much

Now we come to the most significant cause of security vulnerabilities for any content management system: its users. As we’ve established, every CMS has vulnerabilities that can be exploited by hackers at some point in its life. Those vulnerabilities are usually quickly fixed, but the fixes are useless if they aren’t installed. WordPress users who fail to update WordPress and its plugins are probably the single biggest cause of compromised sites. Outdated sites are also a big problem in the Drupal world, albeit on a smaller scale.

Whereas WordPress’ attracts non-technical users, the same is not true of Drupal, which is squarely aimed at developers and organizations that have the expertise to maintain a more complex content management system. However, because users are expected to be experts or at least have some technical knowledge, it’s not as easy to be secure as WordPress.

Updating Drupal and its modules can be a bit of a pain compared to WordPress’s automatic minor version updates, but if you know what you’re doing, it’s not prohibitively difficult.

Drupal or WordPress?

The truth is that both Drupal and WordPress are secure if properly installed, configured, and maintained. The opposite is also true; a poorly maintained Drupal or WordPress site is a gift to hackers.

Drupal has fewer issues with plugin vulnerabilities, but if a Drupal site is left without updates for a couple of years, it’ll be hacked as quickly as an unpatched WordPress site. Moreover, because Drupal is more complex and more challenging to update, a non-technical user may struggle to maintain adequate security.

If you don’t need the power and flexibility of Drupal, then a well-maintained WordPress site is the best option — just remember to keep the site and its plugins updated. If you do need Drupal’s flexibility, then the fact that expert developers choose Drupal for highly sensitive government and corporate sites should reassure you that Drupal can be secured to the highest level.It’s important to understand that security goes deeper than whichever CMS you choose. Both Drupal and WordPress rely on utility software, a database, a web server, an operating system, and more. These must all be maintained and updated too, and that’s the job of the hosting provider. The first step in securing your content management system is to choose secure WordPress hosting or secure Drupal hosting.

Posted in:
Hostdedi

What should happen when a security researcher discovers a vulnerability in a popular software project? Should details of the vulnerability be released so that users can protect themselves? Or should it be kept secret so that bad actors can’t exploit it?

There are drawbacks to both approaches. Immediate full disclosure puts users at risk. Bad actors find out about the vulnerability too, and there isn’t a lot users can do to protect themselves until patches are released. In contrast, secrecy allows software developers to ignore vulnerabilities, and there is no guarantee that bad actors don’t know about them already.

The industry has, for the most part, settled on a hybrid approach called responsible disclosure. When a security researcher finds a vulnerability, they inform the software’s developers but they don’t go public immediately. The developer is given time to release patches. Once the patches are released, the vulnerability is publicized so that users know to update. If the developer fails to release a patch in a reasonable amount of time, the vulnerability is disclosed to users so they can protect themselves. The amount of time given to developers varies; Google’s Project Zero allows 90 days.

Responsible disclosure attempts to balance competing goods. Users who are in the dark about vulnerabilities can’t respond to the threat, but immediate disclosure gives bad actors an advantage. Secrecy might prevent widespread exploitation of a vulnerability before it’s been patched, but developers, especially developers of proprietary software, may not be inclined to invest time and money into bug fixes for vulnerabilities no one knows about. Responsible disclosure is the golden mean between complete transparency and security by obscurity.

Responsible disclosure depends on the assumption that software is updated when patches are released. Secrecy following discovery is justified by the risk disclosure poses to users. They would be exposed without any way to fix the problem. Delayed disclosure is justified by the belief that once patches are available, users are safe.

But what happens when users don’t update? They are in as much peril as if the vulnerability had been exposed without patches having been released. Bad actors know all about the vulnerability, including, in the case of open source software, exactly which code was vulnerable and how to exploit it. Unfortunately, failing to patch isn’t rare: many recent data leaks and security breaches were the result of the exploitation of known vulnerabilities for which patches were widely available.

The point is this: over many years, a system for handling vulnerabilities has evolved, a system which aims to keep software users as safe as possible. Developers, security researchers, and corporations cooperate to minimize the risk to users. But users — businesses, server administrators, hosting providers — have a vital role to play. They have to update their software when patches become available. If they don’t, they put their business, their customers, and the wider population at risk.

Posted in:
Hostdedi

For 74% of consumers, the quality and relevancy of search results on an ecommerce site is the difference between whether they do or don’t make a purchase. Storefronts can no longer rely on good navigation alone. Search has become a primary purchasing path, with consumers that use search 200% more likely to make a purchase than those who don’t.

Powerful on-site search provides more than just a direct purchasing path. It also provides customers with the ability to research and further define desired products and attributes. This not only means consumers are able to research their choices more effectively, it also positions you as an industry leader and an invaluable consumer resource.

This article looks at the search options available to Magento merchants, and outlines four of the main tools available; including Elasticsearch, SOLR, Sphinx, and MySQL. It examines the pros and cons of each, and provides a recommendation of what option is best.

Keep reading to see which Magento search option is right for your storefront.

Consumers who use search are 200% more likely to convert.

Note: this article will not be taking a detailed look at the multiple Magento search extensions available on the marketplace, but instead focuses on more powerful, external solutions.

How Magento Search Works

How Magento search works depends on what search option you choose and how you configure it. In some cases, it’s possible to simply connect a search engine to your Magento store and it will do the rest automatically. In other cases, proper implementation requires either a developer or expert. 

Regardless of which path you choose, once a search engine has been implemented, it will index your site. This provides an easy to search through directory of your products and their attributes. Depending on the size of your store, this can take a few minutes to a few days. 

When looking for a search engine, there are several different features that should stand out. These include:

• Fast and accurate results
• Natural language processing for longtail and complex search queries
• Filtered results pages for more accurate results (Faceted search)
• Error-tolerance (this needs to be high to provide better, more relevant results) 
• Synonym management (especially important for niche stores)

Expanding Magento Search Functionality Through Extensions

If you own a smaller Magento store and don’t want to invest in a dedicated search engine, then it’s also possible to expand the search functionality of Magento through extensions. These can be found and downloaded from the Magento Marketplace. 

Posted in:
Hostdedi

Every ecommerce store is unique. Merchants have a lot of choices to make before their store even goes live; choices including site design, customer base, and product curation. Yet underlying these choices is another, potentially more important one: which ecommerce CMS is right for delivering on those decisions?

In 2019, ecommerce sales will account for 13.7% of retail sales worldwide. By 2021, that number is expected to increase to 17.5%. Improved access, data-driven strategies, and mobile implementations are only a few of the reasons for this rapid growth. The continued development of ecommerce CMSs to match merchant and consumer expectations is another. 

From Magento to WooCommerce, and beyond, the right CMS allows merchants to create a storefront that optimizes the buyer’s journey and increases sales. 

This article takes a look at seven of the most popular ecommerce CMS available to merchants. It breaks down the pros and cons of each and looks at which merchants should be using which. If you’re looking to set up a new ecommerce store, or are interested in exploring other possibilities, keep reading. 

The Ecommerce CMS Comparison

The Right Ecommerce CMS for You

Each application has its own advantages and disadvantages. Much like the products a merchant sells, choosing the right CMS requires merchants to analyze both the resources available to them and their own preferences. 

For medium and larger stores, we recommend adopting Magento 2. Not only is it a versatile platform that continues to grow, it also has an incredible community that’s both helpful and knowledgeable.

If you’re looking to be on the cutting edge of ecommerce, we recommend making the move to Sylius. While a relatively new platform, it has already proved itself with merchants worldwide. Contact the Sylius team to learn more about what it can do for your storefront. 

Ecommerce sales will account for 13.7% of retail sales worldwide in 2019.

For those interested in content marketing and taking advantage of its relatively “new” appearance on the ecommerce scene, BigCommerce is going to offer a lot of tools you won’t find elsewhere. At the same time, it’s also going to allow better management of products. 

For smaller stores, we recommend WooCommerce. With an easy to use interface and even simpler product management, it’s better than a lot of other “easy to use” and manage CMS available. Not sure how to get started, follow our WooCommerce setup guide.

Posted in:
Hostdedi

Dev sites allow you to make changes to your site without breaking it.

Whether refreshing your theme or applying a critical security update, sites are living environments that can react unpredictably to well-intentioned changes.

Any change, small or significant, can disrupt or even break your site when carelessly applied. Such disruptions torpedo both your sales and your customers’ trust. Properly executing these changes can be the difference between an unnoticeable hiccup and a prolonged outage. 

If you already enjoy the services of a knowledgeable web developer, then you’re likely all set. If you’re not — or you have reason to suspect their qualifications — read on.

Read More »

At Hostdedi, we host several content management systems, including WordPress, ExpressionEngine, Craft CMS, and Drupal. You can build just about any site with any of these content management system, but each has strengths that make it a better choice for some projects than others. In this article, we will focus on Drupal and the projects to which Drupal is most suited.

Your Website Needs Flexible Content Management

Drupal is often thought of as a content management framework. It provides a set of tools and features that hosting clients can use to manage content, but Drupal doesn’t impose its opinion about how content should be organized. That’s ideal for large organizations with complex and heterogeneous content. Rather than fighting against a built-in content model, they can use Drupal to build a custom content model shaped by the requirements of their project.

Drupal’s fundamental content primitive is the node. All content is in a node (unless it’s a comment, in which case it’s attached to a node). A node can be an article, a page, a forum topic, or a custom content type. Content in nodes can be displayed on pages with endless flexibility.

Lots Of People Will Work On Your Site

Just as Drupal’s content model is supremely flexible, so are Drupal’s user management capabilities. Drupal user management is based on user roles, each of which can have different permissions. A user can be given multiple user roles that determine what they can do on the site. Drupal administrators can create as many user roles as they need.

Drupal’s user role and permissions model is ideal for sites with many writers, editors, and users.

You Need A Decoupled Content Management System

Drupal is architected to make building decoupled or “headless” content management platforms as easy as possible. Decoupling isn’t an afterthought in Drupal; it’s a core design principle. Drupal is an API-first content management system and that makes it much less challenging to build front-end applications and services that take advantage of Drupal as a back-end.

You Need Your Website To Scale

Drupal was built to support the largest and busiest websites. Its target users are enterprise organizations that receive millions of visitors a month, so it’s engineered to scale. Some of the largest publishing and promotional sites on the web are built on Drupal, including the Economist, OpenSource.com, Johnson & Johnson, Lady Gaga’s site, Al Jazeera, and many government sites.

Although Drupal is built to scale, web hosting plays a vital role in the performance, availability, and scalability of a Drupal site. To get the most out of Drupal’s scalability, choose a Drupal hosting platform that can grow with your business.

You Want To Build A Custom User Experience

Although Drupal includes a basic theme and it’s possible to install an off-the-peg theme, organizations that choose Drupal typically build a custom theme that reflects their branding and publication constraints. If your organization would prefer to use a premade theme, then WordPress may be a better choice. But if you value the ability to create a custom content model and complete control over the user experience, Drupal offers many advantages.

In summary, your website needs Drupal if it requires flexible content modeling and management, has many users with a multitude of roles, and you need a comprehensive array of tools to build a custom user experience.

Posted in:
Hostdedi

WordPress sites and WooCommerce stores should be backed up. Every byte of data should exist in more than one location, including the files in the site’s WordPress directory and the data in its database. Sites that aren’t backed up are vulnerable to user error and security issues. Sites with an off-site backup are robust. If something does go wrong, a backed up site can be restored in minutes, while a site without a backup may be gone for good.

WordPress and WooCommerce can be backed up manually by copying the files and dumping the database, but it is easy to forget to do a manual backup. A backup that runs at the push of a button is better, and automatic backups that need no manual intervention are best of all.

If you have more discipline than average, you might choose to back up your site and its database manually, copying all of the database’s SQL and the site’s PHP files, images, plugins, and themes to a secure offsite location every day or two. For everyone else, a backup plugin is a good idea.

VaultPress is a backup service owned and operated by Automattic. Part of the Jetpack suite of services, VaultPress is the easiest option for low-maintenance backups. It provides automated daily backups with unlimited storage and a 30-day backup archive at the Personal and Professional tiers. If you need longer-term backups, Jetpack Professional includes an unlimited backup archive.

UpdraftPlus provides a complete backup solution to copy all of a WordPress site’s data to any of a wide variety of storage solutions, including Dropbox, Google Drive, and Amazon’s S3. The free version includes scheduled backups and the ability to restore from the WordPress control panel. The premium version of the plugin adds a few storage options and incremental backups, a useful feature that backs up only the changes since the last backup, rather than sending everything with every backup.

BackupBuddy is a premium-only backup plugin that offers scheduled backups to a variety of storage solutions, including BackupBuddy Stash, which is managed by the plugin’s developers. In addition to complete backups, BackupBuddy also allows you to choose partial backups, such as files-only or database-only backups.

Duplicator is aimed at WordPress users with some technical knowledge because it offers far more configuration options than the user-friendly plugins we’ve already looked at. That makes it more flexible than other backup plugins, but also more complex.

Duplicator is a general tool for migrating, cloning, and moving a WordPress site. For example, it can be used by WordPress professionals to create pre-bundled websites so that the same configuration can be installed for multiple clients.

The premium version of the plugin, Duplicator Pro, includes more backup-focused tools, including scheduled backups to cloud storage, email notifications, multi-threaded backup for large sites, and premium support.

All of the plugins we’ve discussed here will make your WordPress site or WooCommerce store safer and more resilient to attacks, malware, and user errors. If you’d rather not pay for a premium plugin, the free version of UpdraftPlus is an excellent backup solution.

Posted in:
Hostdedi

Domain Name System (DNS) is a critical component of every website or eCommerce store. If DNS doesn’t perform, a site can’t be fast. If a site is slow or unavailable, DNS is a likely candidate. In this article, we explain what DNS is, how it can affect your site, and how you can test DNS to make sure it’s working correctly.

DNS is responsible for transforming a domain name like nexcess.net into an IP address that computer networks understand. When a user clicks on a link or enters a URL in their browser, the browser asks a domain name server if it knows the associated IP address. The domain name server is usually hosted by the user’s ISP, although there are public domain name servers hosted by organizations like Google and Cloudflare.

If the domain name server knows the IP address, it tells the browser. If it doesn’t know, it asks another domain name server, which might ask another server, and so on until the answer is found. The order in which servers are asked is determined by a hierarchy. In the case of nexcess.net, the root domain server is asked which DNS server knows about the .net top-level domain, and that server is asked about the nexcess.net domain. All of this is complicated by geographic redundancy: duplicates of major DNS servers exist all over the world.

Is DNS Slowing Your Site Down?

DNS lookups should be a small proportion of your site’s total load time. The browser does nothing while it’s waiting for a response to a DNS request. If you’ve ever clicked on a link and wondered why your browser seems to be stuck, it’s because it is waiting for a response from a DNS server.

Ideally, DNS lookups should take less than 100 milliseconds from any part of the world from which a site gets substantial traffic. A web performance tool like Pingdom can tell you how long each lookup takes from locations around the world. There are several possible causes for slow DNS lookups. If the lookups are slow for you, but fast from elsewhere in the world, the issue is with your ISP’s DNS servers. If lookups are slow from everywhere, then the problem is most likely a slow DNS host. The solution is to host your domain records with a fast global DNS hosting provider.

Have Your DNS Records Propagated?

DNS is a hierarchical and geographically distributed system with many thousands of individual servers spread across the globe. When a site owner edits the DNS records of their site’s domain, the new records have to be synchronized with servers around the world — a process called DNS propagation.

Propagation isn’t instantaneous; it can take up to 24 hours for domain records to propagate. Until they do, some DNS servers will respond to requests with the old records. In some cases, a DNS server might not be able to find any records at all. In consequence, when the site owner or a user tries to visit the site, they may not get the expected results.

This can be confusing and frustrating for web hosting clients who want their domain to work immediately, but propagation takes time. Hostdedi developed a tool to help hosting clients figure out how far DNS propagation has progressed for their domain. Enter your domain, and the tool will tell you which DNS servers around the world have your DNS records.

Posted in:
Hostdedi