CAll Us: +1 888-999-8231 Submit Ticket

WordPress Update Fixes Critical PHPMailer Vulnerability

PHPMailer VulnerabilityWordPress 4.7 was released towards the end of last year and brought with it a host of new features, including a new default theme, theme starter content, and REST API content endpoints.

As is usually the case with a major new WordPress version, WordPress 4.7 was closely followed by a minor release with bugfixes. WordPress 4.7.1 also includes a number of fixes for potentially serious vulnerabilities. WordPress users should update at their earliest convenience to ensure that their sites are safe.

The headline vulnerability is one that has caused serious problems for a number of PHP-based applications, but which left WordPress largely unscathed. PHPMailer is an email library used on millions of servers — in fact, it’s billed as the most popular email sending library in the world and almost every major PHP application that includes email functionality uses it, including Drupal, Joomla!, and WordPress.

Late last year it was discovered that PHPMailer contained a serious remote code execution vulnerability. I want to emphasize that there’s no evidence this vulnerability is being (or could be) actively used against WordPress sites. Major plugins have been checked and they’re unaffected too.

Nevertheless, it’s never a good idea to leave known vulnerabilities in play; it’s entirely possible that less-popular plugins aren’t so resilient, so a speedy update is the best course of action.

The vulnerability had the potential to allow anyone to remotely execute code on a server by sending an email. PHPMailer did not properly sanitize input and passed some parts of emails to the shell without making any code it contained inert. By embedding shell script in the sender field of an email, an attacker could cause it to be executed on the server.

In addition to the PHPMailer problem, several other vulnerabilities were fixed, including a couple of cross-site scripting vulnerabilities. Cross-site scripting vulnerabilities could allow an attacker to embed JavaScript code within a web page. When a user opens the page, the code is executed and has access to session information for that user, including their authentication cookie. If an admin user runs the code, the attacker may be able to take control of the site.

Finally, WordPress 4.7.1 fixes a information leak problem with the REST API.

If your site has automatic updates turned on, you don’t have to do anything — minor updates are applied automatically. But if you have automatic updates turned off, be sure to manually update to the most recent version of WordPress.

Posted in:
Security, WordPress

Source link

Drizzle Is A Micropayments Platform For WordPress

DrizzleMonetizing WordPress blogs has become increasingly difficult over the last few years. If you want to blog for a living, throwing up a few Google AdWords units next to your content is unlikely to cut it unless you have a huge audience — and even if you do, ad-blockers will take a bite.

There are, of course, plenty of alternatives. Native advertising — of which sponsored posts are a popular example for bloggers — has the potential to earn decent revenue. Membership sites with subscriptions are another option. Some of my favorite bloggers have taken this route and are doing well with it. And then there are the less savory techniques like paid reviews.

Micropayments

Micropayments are another option bloggers have to monetize content. Users pay a small amount, typically less than a dollar, to access premium content. There are no recurring fees, which is both good and bad. It’s good for users who don’t want to increase the number of site memberships they’re paying for. But for bloggers, it may not be so great: recurring revenue is hugely important to anyone who makes a living blogging — it helps create at least a little consistency and security.

Micropayments don’t work for every blogger. If you’re a blogger who publishes frequent, short articles, it’s unlikely users will be willing to pay by the article. But, if you publish longer, in-depth articles, or articles that are particularly valuable within your niche, micropayments may be a viable option.

Drizzle

Drizzle is a micropayments platform that aims to make it easy for bloggers to set up micropayment paywalls on their site. Drizzle provides a plugin for WordPress users, and once it’s installed and you have created a Drizzle account, implementing micropayments is as simple as setting a few options and wrapping content in a shortcode. It works for any content you publish on your WordPress blog, including text, podcasts, and video.

Drizzle is a third-party service, which means users have to sign up for a Drizzle account to access paywalled content. The sign-up process is simple, but it might be off-putting to users who just want to support your blog.

A quirk of using Drizzle is that you don’t get to set your own price for access to content. The price charged by Drizzle is determined by the popularity of your content within the Drizzle platform. All articles start at $0.20, and, if they prove popular, the price is hiked to $0.40, or $0.80 for the most popular content. Drizzle doesn’t take a cut of that, but it does add a fee on top which is charged to the user.

Drizzle also allows users to pay a regular subscription if they’d like to access all paywalled content.

If you think micropayments are a viable option for your site and you don’t want to deal with the technicalities of managing them, Drizzle is worth looking at. If you’d prefer to retain full control of the process, and don’t like the idea of asking your users to sign-up to a third-party service, check out Pay Per View from WPMU Dev.

Posted in:
Content, WordPress

Source link

WordPress Asks For Feedback On Rewritten Plugin Guidelines

WordPress Plugin GuidelinesIf you develop plugins for WordPress, you’ll be aware of the controversy caused by the removal of plugins from the repository for breaches of its guidelines.

Many such incidents are caused by developers stepping over the line with “growth-hacking” or data collection, a prime example being incentivized reviews. Some developers offer free or discount premium upgrades if users agree to review their plugins. Obviously, incentivized reviews are harmful — who can trust a review that’s been paid for.

However, the guidelines have never been sufficiently clear about what constitutes unacceptable behavior and enforcement has been inconsistent. In the absence of clear guidelines, enforcement by the repository team can seem arbitrary.

In an effort to help plugin developers understand what is and is not acceptable, the repository team has revised and expanded the guidelines. The new guidelines have been published on GitHub so developers and other interested parties can review them and submit commentary and pull requests.

The content of the guidelines won’t come as any surprise to experienced developers — plugin code must be GPL compatible, for example — but they make concrete rules that were previously vague or implied.

Some of the guidelines developers should be aware of include:

  • No use of external JavaScript. With the exception of SaaS plugins, Javascript and other resources should be part of the plugin rather than being loaded from an external server or CDN.
  • Don’t push updates too frequently. The WordPress Subversion repository should be considered a release repo, not a development repo. Excessive updates may be considered an attempt to game the Recently Updated list.
  • No user tracking without explicit opt-in. This issue has caused problems for a number of plugins of late. The message here is simple: don’t do anything to to track users without their explicit permission.
  • No illegal, dishonest, or morally offensive behavior. This is the broadest guideline, and it includes behavior like incentivized or fake reviews, attempting to exploit loopholes in the guidelines, and SEO trickery.

Explicit and comprehensive guidelines have been a long time coming, but better late than never. The vast majority of WordPress plugin developers understand the limits of reasonable behavior. But an ecosystem as big as WordPress’ is bound to attract bad apples who want to exploit the enormous user base.

The clarified guidelines give moderators and the repository team a useful tool to combat malicious behavior without getting involved in endless logic-chopping arguments about what is acceptable.

Posted in:
Content, WordPress

Source link

Why Are So Many WordPress Users Stuck With Old Versions Of PHP?

PHP 7PHP 7 is a clear win compared to earlier versions of PHP, yet, unlike Hostdedi, many WordPress hosts haven’t upgraded. It’s difficult to get a clear view of the exact adoption rates of PHP 7, but according to figures from Jordi Boggiano, developer of Composer, PHP 7 adoption rates are hovering around 20 percent, with nearly 40 percent of PHP sites based on PHP 5.6, 30 percent on PHP 5.5, and, worryingly, a substantial number based on even older versions.

WordPress accounts for about a quarter of all sites on the web, far more than any other PHP-based content management system or web framework. Many of the PHP 5.6 and older deployments are hosting WordPress sites.

PHP 7 offers numerous benefits compared to older versions of PHP. It’s faster, it introduces new features, and by the end of this year, it’ll be only actively developed version. There are a few reasons the vast majority of WordPress users are stuck on older versions, and most of them have to do with shared hosting companies not doing their job properly.

The speed benefits PHP 7 brings are not negligible. We should always take benchmarks with a pinch of salt, but testing has shown a 2-3 times performance increase for a WordPress site based on PHP 7 compared to one based on WordPress 5.6. That doesn’t mean your WordPress site’s pages will load three times faster, server-side processing is only one part of getting a web page loaded in a browser, but it’s a big part.

WordPress has occasionally been criticized as intrinsically slow, but that’s never been the case for a properly configured WordPress installation, especially when compared to the other benefits it brings. WordPress was limited by the performance of the underlying PHP engine, but with the release of PHP7 , many of the historic problems with PHP were solved.

The web is always slow to change. The vast majority of WordPress sites use low-cost shared hosting, and many hosting providers don’t have the right incentives to upgrade their platform. Even though PHP 7 is more-or-less a drop-in replacement for earlier versions, there’s some work to be done, and the majority of shared hosting providers simply haven’t made the effort, in spite of the obvious advantages to their users.

PHP 5.5 support ended last July, which means it’s no longer under active development, and, even worse, it’s no longer getting security updates. Any vulnerabilities in that version of PHP will not be fixed. PHP 5.6 will be actively supported until the end of this year, and will receive security updates for another a couple of years, but given the obvious benefits of upgrading, why are WordPress hosting providers holding back?

Hostdedi cares deeply about the performance of all of its WordPress hosting plans, which is why we’ve supported PHP 7 on WordPress (and Magento) since it was released.

Posted in:
Content, WordPress

Source link

Browser Push Notifications For Your WordPress Site

Push NotificationsI’m a heavy user of RSS. Every day, I peruse dozens of websites in my feed reader, searching for content by writers and publishers that have, over many years, created content that appeals to me both professionally and personally. I know this is an unusual habit these days. RSS use has declined, and many sites no longer offer an RSS feed at all. Instead, they rely on Twitter and other social networks. But Twitter isn’t a replacement for RSS — Twitter feeds are too hectic and crowded.

There is no direct replacement for RSS, but push notifications provide some of the immediacy and reliability of RSS for a site’s most committed users — those who want to know as soon as a new piece of content is published.

Typically, this will be a small proportion of the site’s users — those who are happy be interrupted every time an article is published — but the most engaged and loyal users are often happy to opt-in to push notifications.

Web Push Notifications

To be clear, in this article I’m talking about browser push notifications, not the mobile push notifications managed by iOS and Android. It is possible to create WordPress mobile push notifications, but it usually requires users to install an app, either a third-party notification app or an app created for the publisher.

Browser push notifications let users receive notifications while their web browsers are open. Safari, Firefox, and Google Chrome support push notifications on the desktop, and Chrome supports them on Android.

When a user visits a WordPress site that offers push notifications, it will present them with a dialogue asking if they’d like to opt-in to browser notifications. If they choose, they’ll receive notifications whenever an article is published.

There are several web push notification solutions for WordPress, but the one I’ve had most success with is OneSignal, which provides a WordPress plugin. OneSignal offers a custom opt-in message and automatic notifications. It also has a number of useful extras, including the ability to target notifications to segments of your audience, A/B testing, and scheduled notifications.

Don’t Go Nuts With Notifications

Publishers should remember that being allowed to send push notifications is a privilege, and it shouldn’t be abused. I’ve opted-out of many website’s push notifications because the volume of notifications became onerous.

Notifications are great for informing the most engaged readers about your content; they shouldn’t be used to broadcast daily “We miss you!” messages or other promotional messages that are unlikely to have broad appeal. If you overuse push notifications, there’s a good chance of alienating the users who would otherwise be the most engaged and loyal.

Posted in:
Content, WordPress

Source link

Why Doesn’t My WordPress Theme Look Like The Demo Theme?

WordPress ThemeWhen I first used WordPress, several years ago, I bought a premium theme from a well-known marketplace. I decided on that particular theme because I liked the way its demo site looked. Most theme developers and marketplaces provide a demonstration site so that potential buyers can take a theme for a spin before they buy it.

However, when I installed the theme, I was disappointed to discover that my site looked nothing like the demo site. The basic components were all there, but it looked nowhere near as impressive as the site that had influenced me to buy the theme in the first place.

After several years using WordPress, I understand why this happened. I was recently talking to a friend of mine who was trying to set up a new WordPress site — her first — and she encountered exactly the same disappointment. I’d like to explain why it happens and what new site owners can do about it.

Demo Sites Are Built To Sell

In the worst cases, demo sites are simply dishonest. The theme developers put a lot of time into perfecting the demo site, which can include adding plugins and features that don’t come with the theme. After all, these are web designers and developers — they know how to make a site look good with or without a theme.

But it’s not always, or even frequently, the case that a demo site misrepresents a theme. They represent the best possible end result, but it can be quite easy to achieve the same outcome. It all depends on the theme and the developer. Before you spend a cent, take a close look at the theme’s ratings and its support forum, both of which you’ll find on the theme marketplace. Satisfy yourself that there are happy users out there.

Install The Sample Content

A newly installed WordPress site has next to no content, so even the best themes will look underwhelming compared to the demo site, which is full of text and professional photography.

The best developers make sample content available to users, often the same sample content used on the demo site. If the developer makes sample content available, you should be able to find out how to install it in the theme’s documentation. If not, ask in the support channel.

Installing the sample content will give you a much better approximation of the theme’s appearance and capabilities as you work with it to add your own content.
If the developer doesn’t make sample content available, take a look at the WP Example Content plugin.

Keep in mind, you should not use the sample content on your live site — it may be an infringement of several people’s copyright.

Read The Documentation

Themes come in many different types, ranging from bare-bones theme frameworks to comprehensively designed layouts with almost no flexibility. If you’re a WordPress novice and want to get up and running quickly, I suggest choosing the latter — all you’ll need to do is fill in your content and you’ll be good to go.

Whichever type of theme you choose, make sure that you read the accompanying documentation. Any theme worth the money will come with a comprehensive set of instructions that explain how it’s supposed to be used.

Hire A WordPress Professional

If you don’t have the time or the patience to learn how to set your theme up properly, there are many WordPress professionals who would be happy to help. Most will be capable of installing and configuring a premium theme quite quickly, so it needn’t be an expensive step.

Don’t be discouraged because your site doesn’t look exactly the way you imagined it when you install your theme, with a few tweaks and some great content, it will come to life.

Posted in:
Content, WordPress

Source link

Why Are WordPress Developers So Excited About The New Content API Endpoints?

EndpointsWordPress 4.7 introduced many new features and enhancements. Users are most likely to be interested in the Customizer enhancements or the ability to quickly activate starter content for new themes. But it’s the inclusion of new content API endpoints that has developers talking. While the new endpoints don’t directly change the experience of WordPress users, they will enrich WordPress ecosystem.

First, what’s an API? API stands for Application Program Interface. That sounds complex, but an API is just a way to interact with a piece of software from the outside. In this case, we’re talking about a REST API, which can thought of as a set of URLs. When you send a request to the API using a URL — which is basically a web address — you’re telling WordPress that you want it to do something.

When you or I visit a page on a WordPress site, we click on a web address and WordPress sends back a web page that our browser displays. The REST API works in the same way, but it exposes much more functionality than a standard web address. For example, the URL may instruct WordPress to create a new post.

Until recently, using the rich functionality of WordPress from an external application was difficult and inflexible. The API makes it simple to do almost anything that can be done in the admin interface from an external application. It’s possible to write an entirely new admin interface that isn’t tightly coupled to WordPress’s technology stack. Any application that can send an HTTP request (and has the right authentication) can interact with any WordPress site.

For developers, this is liberating. They can use their favorite programming languages and frameworks to create rich interactive experiences while benefiting from all the battle-tested content management functionality WordPress brings to the table.

I’ve been talking about how WordPress applications can use the API, but it’s important to understand that by application I mean any piece of software that interacts with WordPress, including plugins, themes, mobile apps, text editors, and much more.

A couple of years ago, when Matt Mullenweg said, “Learn JavaScript, deeply,” this is what he was getting at. JavaScript is the primary language of front-end web development. It’s the only programming language that runs natively in the browser, and the WordPress REST API allows developers to hook their JavaScript front-end applications directly into WordPress.

Until the merging of the REST API, theme developers had to build themes in PHP that were tightly coupled to the hooks and functions that WordPress exposes. It was the same for plugin developers. The REST API changes all that and heralds big things for the future of the WordPress ecosystem.

Posted in:
Content, WordPress

Source link

WordPress.org Warns Plugin Developers Not To “Incentivize” Plugin Reviewers

Plugin ReviewersWordPress.org has warned plugin developers against paying or otherwise giving incentives to users for reviews, whether those reviews are positive or not. Until recently, there was no clear guideline about what was acceptable where review incentives were concerned, but a recently published blog post makes it clear that the WordPress.org team are strongly opposed to paid reviews.

“The WordPress.org plugin and theme directories are for users to write their experiences, not for companies to use market [sic] their products. A compensated or recruited review should be posted on someone’s own site, the reviewers own site, or the 3rd party site itself.”

User-generated reviews are a powerful mechanism for determining the quality of a plugin, but they put all the power in the hands of reviewers. A one-star review can negatively impact the perception of a plugin. That would be fine if every review was a good faith assessment of the plugin, but many are not. Reviewers may not understand the purpose of the plugin, and many negative reviews are simply the result of a desire to harm the plugin’s developer or to influence the developer to provide free support.

Malicious reviews are far from the only problem developers face. The majority of satisfied plugin users don’t leave reviews. A plugin can be excellent, but you wouldn’t know it because of the tiny amount of reviews it has attracted.

From the perspective of the user, that’s understandable — they gain nothing by leaving a review, which is why some developers have taken to offering inducements that may include direct payments or discounts on premium plugins.

Incentivized reviews can impact the reliability and trustworthiness of the review system as a whole. User reviews exist so that plugin users can share their experiences of plugins. If they’re being paid to do so, there’s a strong likelihood that their review doesn’t reflect their experience. The result is a review system that can’t be trusted — even if the majority of reviews are accurate, users can’t trust them because they have no way to determine which are given freely and which are paid for.

The WordPress team considers incentivized reviews a form of spam, in much the same way that Google considers paid-for links a form of spam. If reviews and links aren’t given freely, they’re not trustworthy.

It should be made clear the blog article explicitly states that WordPress.org is only concerned with reviews published on their platform. Incentivized reviews posted on the developer’s site and on third-party sites are not their concern.

What do you think? Is it OK to pay a reviewer for their time, or is the WordPress team justified in taking a hard line on the issue?

Posted in:
Content, WordPress

Source link

Finding And Fixing Broken Links On Your WordPress Site

Broken LinksLinks are an important part of the web, but they’re fragile. Every link is a pointer to a fixed location, and the web is constantly evolving, which means links break all the time — a process called link rot. When a user clicks on a broken link they see an error instead of the content they expect.

Why should you care about broken links on your WordPress site? One reason is that they cause a poor user experience. It’s no fun to be reading, click on a link, and get an error. That’s bad enough when it’s a link to an external resource, but it’s even worse when it’s an internal link that results in an error.

When you publish a blog article that contains calls-to-action with links to a product page, you want users to be able to click the links and reach the product page. If the link is broken, they’ll see a 404 error instead. Every visit to a website is a journey. Broken links are like collapsed bridges: they stop users getting where they want to go and where you want them to go.

There’s a lot of debate in the SEO world about whether broken links hurt a page’s ranking. The popular wisdom used to be that broken links are harmful, but Google has indicated that they have no impact on ranking. Even though broken links probably don’t hurt search engine ranking, they can limit the effectiveness of crawling. Google’s crawlers only know a page exists because of links that point to it. Without links, the crawler probably won’t find the page.

There’s also a more subtle SEO issue. Google carries out topic and relevance analysis of pages, and the anchor text and context of incoming links impact Google’s understanding of a page. The effect is probably small, but combined with the crawling problem and the user experience problem, there’s no reason not to spend a few minutes finding and fixing broken links every couple of months.

Find And Fix Broken Links On WordPress

The Broken Link Checker plugin is my preferred tool for winkling out broken links and fixing them. It will monitor your WordPress site for broken links, missing images, and redirects. Broken links can be edited from the plugin’s admin page, which makes it really easy to quickly get rid of all the broken links on your site.

While Broken Link Checker is sufficient for most link-fixing purposes, sometimes I want a more comprehensive view of the link structure and health of website. For that, I turn to Screaming Frog, a web crawler used by many SEO professionals. Screaming Frog will crawl a site and report any 404 errors and redirects, but it will also find duplicate content issues, problems with page titles and meta data, and it can create XML sitemaps.

My usual workflow is to use Screaming Frog when I begin work on a site, and then use Broken Link Checker every few weeks to catch any new 404 errors.

Posted in:
Content, WordPress

Source link

How Does Premium Managed Hosting Improve Your WordPress Site’s Performance?

WordPress PerformanceIf you have a WordPress website, you need web hosting built to support the WordPress application. A web host provides the server a WordPress application runs on and the network that connects it to the internet.

It’s not difficult to install WordPress onto a server. It’s not something that should be attempted by someone with no experience of servers and web applications, but if you know how to do it, a WordPress site can be installed and serving users in no time at all.

What’s more, WordPress is free and so is all the software it depends on. PHP is free. MySQL is free. The Linux operating system is free.

If all this software is free and it’s not rocket science to get a WordPress website up-and-running, does it really matter which web hosting company you choose?

I often come across WordPress users who ask this question. They want a WordPress site, and they want to spend as little as possible on the hosting. They don’t understand the difference between a $3-a-month WordPress host and a managed hosting provider like Hostdedi.

For the rest of this article, I’d like to discuss some of the reasons a premium managed WordPress host is worth paying for.

Scale

As I’ve said, it’s easy to throw WordPress onto any old server. It will even perform reasonably well if the site gets next to no traffic. However, if traffic levels peak — if the site publishes an article that gets a lot of attention — a low-powered server simply won’t cope with the load. Latency steadily increases until, eventually, the site stops responding altogether.

Installing WordPress is easy. Making WordPress consistently fast at scale is hard.

Hardware

Cheap hosts use cheap hardware. Enterprise-grade servers are more expensive because they’re more powerful, more reliable, and less likely to develop faults.

It’s possible to take a five-year-old server, cram hundreds of WordPress sites on it, and charge next to nothing, but performance is woeful.

We choose our hardware to maximize the performance of the sites that it hosts, but most importantly, for reliability. Our WordPress hosting servers offer consistently superior performance across the life of a site.

Fair Division Of Resources

If you have a few servers and want to make as much money as possible from them, you aim for volume — to squeeze as many WordPress installations on each server as possible.

Low-end web hosts go a step further: they deliberately overfill their servers. In essence, they sell the same server resources twice (or more). They gamble that most of the sites hosted on the server won’t use all the resources their owners paid for and that sites will have traffic peaks at different times, so it all evens out in the end.

Quite often though, it doesn’t work out and some sites take more than their “fair share” of resources, negatively impacting the performance of everyone else on the server.

We make sure that our shared WordPress hosting clients have the resources they need by limiting the number of sites we install on each server.

Network

A WordPress site’s connection to the network influences its performance. Lots of factors affect network performance: the network interface of the server, the switches and routers in the data center, the data center’s connections to its bandwidth providers, the reliability of those bandwidth providers, the efficiency with which packets are routed, and so on.

Getting all that right is both complex and expensive. We have invested time and money to build extremely reliable networks based on premium Cisco networking hardware connected to several of the best-regarded Tier 1 bandwidth providers in the world.

This is a fraction of the work we do to make WordPress fast and reliable at global scales. You can see more of our optimizations here. This effort makes our WordPress hosting slightly more expensive than the cheapest WordPress hosting on the market, but it’s a small price to pay if performance, reliability, and committed support matter to you.

Posted in:
Content, WordPress

Source link