Blog - WP Support HQ

Top 4 recs for WordPress security and additional resources

Posted on August 26, 2017 by wpsupporthq

WordPress is already a very secure platform but it is also the target to a lot of attacks because of its popularity. Security has been covered in great detail by the resources below, but here’s our top recommendations.

Secure passwords!

Secure passwords should be over 8 characters and include numbers and symbols. We know it’s a pain! Services like LastPass and 1Password can help. Or if want to use a simple password, enabling 2 Factor Authentication (2FA) will add enough security that a simple password is fine. We recommend Google Authenticator and WP Google Authenticator.

Backups

You know this already, but having a backup is the best way to recover from an attack. Malware can be cleaned up, but it’s better to use a backup. Here’s an easy way to backup WordPress.

Updates

WordPress core should already be setup to update minor versions automatically. The Core team releases fixes really quickly so it’s important to make sure that setting is set.

Plugins and themes are also important to update often. A lot of attacks focus on out of date plugins. As a side note, you should only use reputable plugins and themes. Do some research on a plugin before you install it.

Hosting

Good hosting might be the most important thing on this list. You want to find a hosting company that keeps their servers up to date and follows the hardening recommendations for hosting WordPress sites. The Hosting WordPress[https://codex.wordpress.org/Hosting_WordPress] guide has lots of good info if you want to do it yourself.

Resources

If want to dig deeper here are a ton of resources to take a look at.

Hardening WordPress – Basic steps you should consider to make your site more secure.

Hosting WordPress – If you’re hosting is yourself on a VPS, this guide will get you started on securing the server.

Ultimate Guide To WordPress Security– A really in depth look at security with a bunch of good recommendations.

WordPress Security – A high level look at why WordPress sites are targets and the top attacks people use.

These are recommended by the WordPress Hardening Guide.

Tim Easley

Configuration & setup for new WordPress sites

Posted on August 5, 2017August 5, 2017 by wpsupporthq

When you setup your new WordPress site, there are a couple of things that will help make things more secure. You can do them later too, but it’ll require a bit more work.

First, use a different table prefix from the default ‘wp_’. It’s easy to change this is from the setup screen, but a bit harder later. Either way, it’ll make SQL injection attacks harder. The table prefix is a prefix WordPress uses for it’s database tables names. Using something like ‘wp_234a2234_’ is perfectly fine.

Secondly, don’t use ‘admin’ as the username. This was the default early on and now attacks often try this username. If you already have an ‘admin’ user, I’ll show you how to change it at the end of this post.

Now that the site is setup, you’ll want to do some additional cleanup by removing some of the install files that are no longer needed, updating the wp-config.php file, and adding some code to the functions.php file. Sounds like a lot, but it’s pretty easy once you have SFTP setup.

On the server

You’ll need SFTP access for these next steps. This guide will help you get going if you don’t already know how to use SFTP. I recommend FileZilla, it works on Window, Mac, and Linux You should use SFTP over FTP if you can. Most hosting companies have SFTP available. What’s the difference? Security!

Make sure you take a backup now!

The easy part… deleting the following files.

readme.html
wp-config-sample.php
wp-admin/install.php

Now you’ll want to setup custom salts and disable debugging support in the wp-config.php. This file is in the root of your website, usually in a http_docs or public folder.

Download the current file and edit in with a text editor. In the section that starts with define(“AUTH_KEY”), look to make sure there is random text for all the values. It should NOT look like this:

define('AUTH_KEY', 'put your unique phrase here');
define('SECURE_AUTH_KEY', 'put your unique phrase here');
define('LOGGED_IN_KEY', 'put your unique phrase here');
define('NONCE_KEY', 'put your unique phrase here');
define('AUTH_SALT', 'put your unique phrase here');
define('SECURE_AUTH_SALT', 'put your unique phrase here');
define('LOGGED_IN_SALT', 'put your unique phrase here');
define('NONCE_SALT', 'put your unique phrase here');

If it does, go here https://api.wordpress.org/secret-key/1.1/salt/ to create your own random values and replace the ones in your file.

Turn off debugging & web based file editing.

While helpful when developing or initially setting up your site. You should turn the following options off when you’re not using them. They can give attackers helpful information and access to files.

The add the following to the end of wp-config.php file, but before the /* That's all, stop editing! Happy blogging. */ line.

## Disable Editing in Dashboard
define('DISALLOW_FILE_EDIT', true);

// Enable WP_DEBUG mode
define( 'WP_DEBUG', false );

// Enable Debug logging to the /wp-content/debug.log file
define( 'WP_DEBUG_LOG', false );

// Disable display of errors and warnings
define( 'WP_DEBUG_DISPLAY', false );
@ini_set( 'display_errors', 0 );

// Use dev versions of core JS and CSS files (only needed if you are modifying these core files)
define( 'SCRIPT_DEBUG', false );

Here’s a quick video showing how to make these changes w/ FileZilla.

Advanced

This change after a site is setup require a bit more work. And are best done using SQL. What is SQL? It’s how you talk to databases. It’s not support complicated, but you can ruin your database, so make sure you have a current backup before hand!

Fixing admin login on an existing site.

WPBeginner has a good post with a few ways to change the username. I recommend method 3.

Changing the database prefix on an existing site.

WPBeginner has another good post outlining how to change the prefix.

You know backups are important, but do you have them?

Posted on July 30, 2017July 30, 2017 by wpsupporthq

Boring! I know. But you’ll regret not having them at some point.

Plus it’s pretty easy to get backups, either one-off or scheduled. You also want to make sure you store them offsite.

Offsite is more important than scheduled if you don’t make changes often. But you should make sure to run a backup after any significant changes to your site or content.

There are lots of ways to make backups. Plugins are the simplest way to get started. We recommend Duplicator and UpdraftPlus. Duplicator is the simplest solution for one off backups and migrations. Duplicator Pro and UpdraftPlus with some paid options allow for scheduled backups and offsite storage.

Why offsite?

Offsite just means not on the same server as your WordPress site. This is important because if the server is completely lost so are your backups. It’s also nice insurance if you want to change your hosting provider and they are not helpful in moving.

If you don’t make changes often, you can just run your backup and download the result after making changes. If you make changes often, you should do something scheduled and store them somewhere like Amazon S3 or Dropbox or any of the other storage options.

Here’s a quick video showing how to install Duplicator, create a backup, and downloading the backup files.

What does a backup contain?

Backups for WordPress consist of two parts. The files from the server, this includes WordPress, Plugins, and Themes. It also contains all your upload media. The second part is the database. The database contains all the configuration and content for your site. The database part is the most important part of the backup.

With backups you can make changes to your site without worrying too much if something goes wrong. It’ll be a bit of work to restore, but you’ll be able to get your site running again!

When should I backup?

The general rule is to backup before making any major changes AND right after making major changes. This includes adding content that you can’t easily recreate.

At WP Support HQ, we create daily backups for our clients and store them on Amazon S3. We also restore those backups when needed. Learn More

Patrick Lindenberg

How We Manage WordPress Sites at WP Support HQ

Posted on July 6, 2016 by wpsupporthq

When a new site signs up we do a number of things to make sure it’s backed up, updated, secure, and running smoothly. We think our WP management service is a great value, but we also think these are things every WordPress site should do. So for the do-it-yourselfers out there, here’s how we do today.

Setup

First thing we do is make sure there are backups so we can fix anything that might go wrong. It usually doesn’t, but a back up is nice. We use UpdraftPlus for all our backups. It’s a great plugin and stores everything to Amazon’s’ S3 storage solution for safe keeping. We configure it to automatically run every day.

Now that’s done, we see what needs updated. If the site hasn’t been updated in a while, then we need to do some research to make sure the plugins and themes will work with the latest stuff. Check the Updates screen and many plugins will state whether or not they work with the latest.

Compatibility with WordPress 4.5.3: 100% (according to its author)

For those that don’t, we find the plugin in the WordPress.org Plugin Directory. Checking the reviews and support tabs will usually surface any issues. If WordPress itself is really out of date, then the Directory is helpful to see if the current version is supported.

Next we check the theme. Although we don’t automatically update themes, it’s good to know if there are updates available and if they’ll work. This is something we just report on.

Next we remove any disabled plugins. They aren’t running on the site, but WordPress still loads them and they can be a security risk.

Are there any active plugins that aren’t used on the site? It’s pretty hard to tell without doing a more thorough audit. But sometimes there are obvious ones, like Hello Dolly, the sample plugin installed with WordPress. We disable and remove those too.

Next up is Akismet. Comment spam protection. If comments are turned off everywhere, then this can be removed. If comments are on and Akismet not set up with an API key, we set it up.

Anti-malware. We love the Anti-Malware Security and Brute-Force Firewall plugin and set it up next. Not only is it an amazing anti-malware scanner, it repairs issues it finds and also protects from some very common attacks, including Brute-force logins. Brute-force logins, arguably the most common way sites are hacked, are a program that just tries to guess the password by logging in over and over very fast.

Automation

To keep up on things we setup some automation. We already have the backups running every day. But what about updates and security scans?

WordPress core can automatically update itself and now that we’re starting from an up-to-date site, we make sure it does. In the wp-config.php file, we add the following if it’s not there.

define( 'WP_AUTO_UPDATE_CORE', ‘minor’ );

This allows WordPress to auto update any minor updates, this includes security fixes. We don’t enable everything in here, because major updates and plugin updates can break a site, we like to make sure that doesn’t happen.

For the rest of the updates we use MainWP. This keeps an eye on everything and lets us auto update plugins we’re confident won’t break a site. For everything else, we manually update and verify those once a month.

MainWP also includes some other great features, like fixing common security configuration problems and scanning the site with Sucuri.

Performance

Lastly we take a look at performance. The biggest things that affect performance are too many plugins, caching, and images.

We’ve already audited the plugins, but if there are still a lot, like 15 or more this could be an area of improvement.

Next is caching. Some hosting companies take care of this at the server level. For the rest a caching plugin is helpful. We use WP Fastest Cache. It’s easy to setup and works really well.

Lastly, images. Not everyone knows how to optimize images for the web, and big images can cause slowness. WP Smush will automatically optimize images and speed things back up.

Done. Almost!

With everything set up. We’re set until the next update cycle, except for one thing.

Watch for security alerts. These are usually bugs that allow attackers in so we want to catch them as soon as possible. Usually there’s an update that we can install, other times the plugin has to be disabled until an update is ready.

We hope you find this helpful to keep your site updated and secure. If you want us to handle it, you can sign up for WP Support HQ here.

Photo by Jamiecat *

WordPress News and Updates on Conversion

Posted on April 15, 2016 by wpsupporthq

As a business using a WordPress website, you want to get the most from your online efforts. You have invested time and money on the design and promotion of your website so that it gets traffic and converts well. However, if you aren’t using A/B conversion testing, your website is under performing in both the traffic it attracts as well as its conversion of that traffic.

If you are familiar with A/B testing, you may be wondering what testing has to do with increasing your traffic levels. If your web page or blog post titles don’t inspire traffic in the SERPs to click through, you aren’t getting the greatest return on your SEO efforts since that traffic is passing up your web page in favor of one of your competitor’s. Improving your titles with testing takes care of the problem.

Likewise, your web page design elements are under performing if you haven’t optimized them with A/B testing. For those unfamiliar with A/B testing, it means testing variations of different page elements to see which improve your conversions.

The fascinating thing about testing is that even small changes can cause big increases in conversion rates. For example, landing page conversion rates are substantially improved when they have images of people. However, you can’t know this for sure on your website without testing because the behavior of traffic can vary depending on the niche. You may also want to test images of different people to further improve conversions.

Nelio A/B Testing

One of the best and most comprehensive testing services for WordPress sites is Nelio A/B Testing. It doesn’t require coding or any other technical skill and works from within your WordPress dashboard. It can test your headlines, pages, posts, products, menus, widgets, and even themes.

The possible range of tests and experiments is enormous. It also includes heat maps that give you a better idea of which page elements produce the most interaction. If you have an e-commerce site based on WooCommerce, you can test product descriptions, images, and names. If you wish, you can allow the software to automatically select the winning test variation and update your website with it.

If you are worried about the processing power requirements slowing down your server, their plugin merely transfers the processing load from your server to theirs in the cloud. This is a service rather than a standalone product purchase. To learn more about its capabilities, you can test it out with their free trial. For more WordPress news and updates that make a difference in how you blog, contact us at WP Support HQ.

Media Salad; Health Food for Your Blog

Posted on December 17, 2015 by wpsupporthq

If you’re having a difficult time turning all of those analytical reports into actionable game plans, then take a bite of Media Salad. Puns aside, Media Salad compiles data from the stats of your social media accounts and creates press-worthy reports, unique blog content and action plans to increase your engagement and effectiveness.

Actionable Reports

The analytical aspect of Media Salad’s service is unique because they draw upon data from your WordPress traffic, Twitter, Facebook Analytics, LinkedIn, YouTube and Pinterest. Their reports are easier to read than raw stats because they use graphics that tell a story. This information helps determine what sort of content is most engaging to your readers and most effectively spreads your message.

Industry News Aggregation

In addition to monitoring your properties, Media Salad aggregates data from the rest of your industry to keep you and your site on the leading edge of new opportunities and trends.

On-Site Reporters

Media Salad has another unique service fueled by a network of journalists that can attend meetings, trade shows and conferences on your behalf and act as your “feet on the ground” during important developing events, creating reports for you and fresh timely content for your readers.

Business Writing

Grooming the growth of your business is important and Media Salad works to create attractive white papers, graphics and business proposals that help your business stand out. They also employ translators to reach clients in other languages.

Media Salad contracts with us to design simple, beautiful WordPress websites. Contact us to learn more about how this relationship benefits your growing business.

Keep Those Plugins Updated – With Caution.

Posted on December 17, 2015December 21, 2015 by wpsupporthq

Updates are important, but they can break your website, so many people just don’t update.

The problem is updates aren’t just about new features. Often they contain security fixes. Getting these security fixes is important because malware makers and spammers will scan the internet looking for “unpatched” websites. And since you now have backups, you don’t have to worry so much about updates breaking your site!

This one’s easy, here’s how:

Just go to Dashboard > Updates at least once a month and update everything.

Reminders From WP Support HQ:

It’s a good idea to make sure you have a backup before running the updates.
If you’ve made changes to your theme files, updating it will overwrite those changes. It’s probably a good idea to move those changes into a “Child Theme” before updating the theme. Updates to everything else should be fine, so don’t wait on those!

Bonus! Keep an eye out for important security updates and update as soon as you see them. These blogs are good sources to follow for security updates.

https://wordpress.org/news/category/security/
https://blog.sucuri.net/

We know this is a lot! But really, we think it’s the minimum you should do to protect the investment you’ve made in your blog.

WP Support HQ specializes in taking care of WordPress sites. We do all the things above, plus a few more to keep your site running smoothly and securely.

Photo by GotCredit

Build Great Content & Back it up!

Posted on December 10, 2015December 3, 2015 by wpsupporthq

But my hosting provider said the provide backups!

Did they? Is it a WordPress specific hosting provider? If so, you’re probably in good shape here. You’ll want to make sure they are running and you know how to restore those backups.

Not a WordPress specific host? No problem! There are a number of backup solutions out there.

What’s in a Backup and What You Need to Know About Backups.
WordPress is a set of files and a set of database tables, we’ll just call them the database.

Your backups should include all the files, this includes your plugins and themes, and it should include your database.

The database holds all your configuration settings, but more importantly, it holds all your content. Pages, Posts, Comments, everything. Each backup should include both, all the files and the database.

You Want your Backups Off-Site.
What does that mean? Basically, it means there should be a copy somewhere other than on the website server, on-site. This could be another server, like Amazon or Dropbox, or your local computer.

This is important because if something happens to your site and you need your backups stored on your site… you might be in trouble. The server could be down or malware could make the site un-accessable. Either way, having backups off-site will be a huge relief.

How to Restore Your Backups.
This is often an overlooked step, until it’s time to actually restore the backups. We’ve found the best way to do this is backup your site and then restore it! Either to the current site or on a sub-site or staging site.

WP Support HQ recommends one of the following backups.

– UpdraftPlus

This will allow you to create backups and download them to your computer as needed. The restore process is also good. They have a premium version that will handle scheduling backups and storing them off-site at a number of different storage providers.

– Duplicator

This is another great backup plugin. The free version allows manual backups that you can then download to your computer. They also offer a Pro version with scheduling and cloud storage.

Create Strong Passwords With “Brute Force Protection”

Posted on December 3, 2015 by wpsupporthq

Let’s make sure all users are using a strong password.

What’s all this about strong passwords? Well it’s not about people guessing your password, it’s about computers doing it.

Computers are fast, really fast, and guessing millions of passwords is pretty easy for them. The longer the password and the more types of characters in it, the more the computer has to guess. This is called a “Brute Force” attack, meaning the computer just tries everything until it gets it.

WordPress will now tell you how strong your password is. Here’s how:

– Login and go to “Edit my Profile” in the top-right menu.
You want something with 8 or more characters, including numbers and symbols. A pain, I know!

After setting up good passwords, installing Brute Force protection via a plugin of some kind will really help. There are different approaches, and they all slow the computers guessing way down.

WP Support HQ recommends one of the following plugins. Install and activate one, then make sure the brute force protection is on.

– Anti-Malware Security and Brute-Force Firewall

This is our favorite. It works great, is easy to setup, and includes one of the best Malware removal engines we’ve used.

– iThemes Security Pro

For even more security iThemes Security Pro is great. It has tons of options and may be overwhelming at first. Budget some time to read the documentation and understand the options as you are setting up the plugin.

Photo by christiaan_008

Help! I’m Getting a Bunch of Contact Form Spam

Posted on November 28, 2015November 28, 2015 by wpsupporthq

You just redesigned your site, or maybe just added a new contact form to your current site, and now you’re getting a bunch of non-sense emails. Contact form spam! A lot of people default to using a CAPTCHA to fight spam, those annoying puzzle image things you hate filling out. But there’s another way, a honeypot field!

A what?

A honeypot field is a form field that scripts don’t know they shouldn’t fill out, so they do, and in doing so reveal that they are in fact a script. The great thing is that actual users don’t see them and don’t have to do any extra work to contact you!

Let’s cover two of the more common form plugins, Contact Form 7 and Ninja Forms.

Contact Form 7

You’ll need another plugin for the honeypot field. Install and activate the Contact Form 7 Honeypot plugin.

Next, edit your contact form and add the honeypot short code. I usually add it next to one of the other fields and give it a name that sounds important, like age or recommendation.

[honeypot recommendation]

Save your form!

Ninja Forms

Make sure you’re plugin is updated. That’s it!

Ninja Forms includes a honey pot field on all forms now. If you have an Anti-Spam field setup, you can remove it from your form, unless you want extra protection from scripts.

This should be a nice balance of usability for your users and little spam for you!

Photo by freezelight