For those of you who didn’t have the pleasure of attending this September’s Think Visibility conference then you sadly missed Glyn Wintle’s excellent talk on WordPress Security, cleverly titled “WordPress Security 101″. The talk was excellent and I came away thinking about all the tricks I had missed when securing my own websites, whether they be WordPress or something else.

After talking to a few people after the knowledge had been imparted upon us, I found that it was not what some people were expecting. Although the title of the talk did give the impression it was all about WordPress, the talk was a more well rounded “How to secure websites with a few WordPress specific examples thrown in”.

This for me was much more useful, but I do understand that some people going to learn how to secure their own WordPress website(s) may have left feeling a little confused.

So this is where this blog post (hopefully) steps in. I will be covering the points discussed by Glyn and hopefully elaborating a little so it becomes almost a check-list of things to do and how to do them. So let’s get started!

#1 Remove readme.html

Out of Glyn’s points, this is probably the simplest to change. Included with WordPress is a file in the root of your installation called “readme.html” that if viewed will show some information about the version of WordPress you are currently using. Although not directly damaging to your website, giving information about which version of WordPress you are using could help any person with malicious intent narrow their efforts to your specific version.

To rectify this, simply delete the file via (s)FTP or your host’s file manager.

#2 Stop WordPress displaying version numbers

Much like above, informing a user which version of any software you are using is not directly damaging, but can help someone if they did intend to do your website harm. WordPress by default outputs the version in the Meta information in the header of your website. Some themes disable this but you should check that yours does. If you have a line something like the following in your source code, it’s time to fix it.

To stop WordPress outputting this information in your header, open your theme’s functions.php file in either the wordpress back-end editor or via (s)FTP and insert the line below somewhere in-between the opening <?php and closing ?> lines.

#3 Moving wp-config.php

I see this step as more of an optional, as if a malicious user gets their hands on this file you’re probably already in trouble. For those that don’t know, wp-config.php is a file in the root of your WordPress install that contains all information on how your WordPress installation connects to your database and a few other things. Recent versions of WordPress now have the option to move this file out of the root of your website and so keep it a little more secure.

This is simple enough to do, just move the file one level up in your hosting. There may be some hosts that don’t allow you outside of the root of the website though, so you may have issues if this is the case with your host. If you’re ok, simply move the file via (s)FTP and ensure the copy that was in your website root is no longer there.

#4 Deny access to wp-admin

If you have a static IP and you know where you are going to be logging into the admin section from, this is a great update to your security that is very easy to do. By default, anyone from anywhere can go to YourWebsite.com/wp-admin/ and try to login. Since some WordPress websites only need the admin to login to the admin area then there is no need to show this area of your website to anyone BUT the admin.

This is accomplished via a .htaccess file that is uploaded to your website. If you already have a .htaccess file in your wp-admin folder, edit this one, if not simply create a new one with a text editor and upload it with the following content in it:

Just change xx.xx.xx.xx to your IP address and you’re done!

An alternative for this if you either don’t know where you will be logging in from or don’t have a static IP is to use an SSL certificate. This is more complicated to do and I don’t think I can add much more than the WordPress Codex already has so I suggest reading that if you are planning to do this.

#5 Keep wordpress up-to-date

This is another incredibly simple problem, but it still amazes me (and Glyn) how many people don’t keep their WordPress up-to-date. Each time WordPress is updated a list of bugs that the new patch has fixed is published. This is important for you as you know which problems have been fixed but also great for people wanting to exploit these bugs as they not only know which bugs there were, but what WordPress has changed to fix them. So in short, keep your WordPress up-to-date to avoid this as much as possible.

#6 Investigate your plugins

Plugin research is a little harder to do if you’re not a developer, but that doesn’t mean you shouldn’t try. Anyone can write a plugin for WordPress and submit it to the WordPress website. If I was a malicious person, it wouldn’t take me much effort to write a plugin that is seemingly harmless but email me a copy of your database in the background.

Other than this, sometimes developers have purely good intentions but their plugin may be vulnerable to some oversight meaning that once installed on your website, your website is also vulnerable.

Before installing anything on your website, read reviews, search Google and if you can, get a Developer to look it over. If it seems like it was made in a rush, or not very well, stay clear.

#7 Don’t be lazy

Is your username “Admin”? Then you better change it since I’ve already guessed it and I’m just writing a blog post, not trying to gain access to your website. Previous versions of WordPress created the account for the administrator with the username “Admin”, but now you can enter whatever you like, so I strongly suggest changing this to something more secure (and I don’t mean “Administrator”).

Other than username, the next obvious thing is password. WordPress has a password strength meter to help you pick a strong password but I would say it’s a little lenient, so if your password is not at LEAST classed as “Strong” by WordPress, you should think about changing it. As Glyn pointed out, this comic sums it up pretty well (even if it’s not 100% mathematically correct).

#8 Don’t give away so much info

The final point I am going to cover in this post (I may do more in a later post if people are interested) is to not give away too much information. When someone tries to login to a WordPress website with a fake or incorrect username, WordPress will inform you that the username is invalid. This is great for real users who have entered their username incorrectly but also great for someone trying to gain access to your website.

This error message shows a malicious person that the username they have entered is not valid, and so they move onto the next one. Without this message, then the malicious user doesn’t know if they have a valid username but the password is incorrect or an invalid username and so makes it much more difficult for the malicious user.

Unless all of your users login via your login page (ie not via facebook, twitter etc), this error message can be easily removed much like the WordPress version in your header. Add the following to your functions.php file:

#9 Final thoughts

Thousands of WordPress website’s are hacked each day, and I don’t know about you, but I don’t want to be one of them. For a couple hours of effort you can make it much less likely that you will be one of those websites and I can’t see any reason why you wouldn’t want to.

I’d like to thank Glyn Wintle for his excellent talk at Think Visibility and getting me thinking about this.

Any questions, please feel free to leave them in the comments or contact me.

Oh, and don’t use “princess” as your password.

http://blog.pushon.co.uk/think-visibility/think-visibility-live-blogging-march-2011/

http://www.distilled.co.uk/blog/seo/think-visibility-march-2011-the-jaamit-award-pick-n-mix/

http://www.keanrichmond.com/my-thinkvis.html

http://www.3wdl.co.uk/2011/03/07/getting-links-from-twitter/

http://www.stateofsearch.com/think-visibility-5-march-2011-the-one-with-the-panda-pick-n-mix/

http://www.vertical-leap.co.uk/blog/think-visibility-5-roundup/

http://www.davidnaylor.co.uk/what-a-weekend-thinkvis.html

Photo Credit: Sk8geek

Paddy Moogan

Link builder extraordinaire Paddy chose a selection of sites to analyse via their link profiles. Lots of tips were given for mining Twitter for data Use (use http://qwerly.com/), creating ego bait (not the dreaded linkbait) plus a couple of highly entertaining ‘shadier’ stuff which I’m afraid you had to be at the session to hear.

Jackie Hole

Photo Credit: Sk8geek

You can see the slides from Jackie’s presentation here

Paul Madden

What can I say about Paul – he always gives good presentation and he didn’t disappoint this time either. He let us in on some of the processes and companies he has been using over the past year in order to free up more of his time. He’s been successful but not without a great deal of preparation on his part, but does warn that it’s best to have ‘something’ to replace the time you’ll free up otherwise you’ll end up bored or doing as much work. Oh, and if you have a spare $5, head over to fiverr.com but try not to get that person arrested…..

Dixon Jones

I’m a huge fan of Majestic (now I’ve taken the time to learn how to use it properly LOL) so this was a really great presentation for me. Dixon fired off tips like they were going out of fashion but the real takaway for me was utilising the Google Customer Search Engine using data from Majestic SEO’s ‘Cliquehunter’ tool.

Photo Credit: Sk8geek

Finally, a huge congratulutions to Rhys for winning the first Jaamit award.

What a wonderful end to a great day. So, like I said, a short but (hopefully) sweet post on the day. A huge thanks to Dom & the team for making it so easy to sponsor (hint!), for supporting Jackie, for making us feel so welcome and for bringing so may like minded people together. Roll on September 2011…………

These days, there are hundreds of social networking websites available online – finding old friends or sharing interests with others is a major factor in their popularity. Many, many internet users have joined at least one of these social networking sites with one of the biggest being Facebook. If you own a business and you are targeting an 18 to 25 demographic to sell your products, Facebook could provide you with a ready market.

The great thing about Facebook is that it provides tools that can be used to effectively market your products and services, as standard. With over 62 million users worldwide, that’s a lot of potential clients to do business with. So, here are a few tips that can help you use this phenomenal site to market your products and services for free.

Make your profile strong and identifiable.

With a great profile, you will be able to attract more people to view it. Social websites like Facebook are all about connecting and interacting with other members, so the more relationships you build in Facebook, the more effective your marketing efforts will be.

Join Facebook groups or create your own group.

It can be groups containing members of your target niche and it can also be groups of internet marketers where you will be able to help each other out advertise your business or your products and services.

Add some applications (such as games) and syndicate your blog website using RSS.

Reach out to as many people as possible. In order for an online business to become a success, targeted traffic is the key and there is no better way than by using Facebook. So, if you think that internet marketing is not working for you, try a social networking site like Facebook and see if you can tap into its potential.

Contrary to those that know me, I don’t really believe that Twitter is the best thing to happen to internet marketing ever….honest. However, I do think it has an incredibly important part to play in an holistic search marketing campaign, if used with some thought and a clear strategy. Primarily a communication tool, ironically this represents both Twitter’s greatest strength and also its greatest weakness. Anyone with internet access can open an account in under a minute and tweet about anything and everything – and they usually do. The perception that Twitter is where people tweet about what they’ve just eaten is based on fact (hell, even I’ve done it!) but that doesn’t mean that serious users should shy away from participating. On the contrary, the fact that people are actually using Twitter at all means that anyone serious about internet marketing should be part of the process too. Why wouldn’t you want to promote your service or product in an arena where literally millions are ready to listen?

However, having millions ready to listen means there are millions of other Twitter accounts to compete against – so how do you make yourself or your client stand out from the noise?

• Get consensus on the public profile from the start from all parties concerned- agree on the corporate image you want to promote.
• Establish your online identity. Choose a user name that reflects your company name or one very close to it.
• Brand your profile page and update your Twitter icon. Use the Bio feature to establish your service or product and always link to a website if there is one.
• Consider using different Twitter accounts to feed into the main one if applicable, i.e. Customer Service, Technical Support, Promotional Offers. Make sure each are branded the same to ensure continuity.
• If you’re using just one account try and vary the tweets – a constant stream of promotion or sales pitches can be off putting to potential followers.
• If you or your client has a blog, tweet about and link to each new post.
• Always include a link back to the URL if you are promoting something on your website.
• Use keywords in your tweets so you’ll be found on searches (just like real SEO!)
• Twitter works best when its two way – follow people back, respond to their tweets, promote others.
• Take notice of the Trending Topics – these are the 10 or so most popular subject of current tweets. If you have something to say that fits in with a topic, just pop a hashtag followed by that subject on the end of your tweet. That way (for a few minutes anyway) your tweet will be on the front page of searches on that hashtag subject.
• Don’t wait to tweet until you have something to say – build up your following and then you’ll have an audience for that special announcement.

The world of social media is evolving at a crazy rate and it takes time and effort to build up a presence. However, the rewards could definately be worth it for a well executed and well maintained campaign.

There’s a reason why people like Stephen Fry and Jonathan Ross are reaping incredible PR benefits with their Twitter presence – they are an easy reference point for new users, a safe pair of hands, a trusted source. Make your social media campaign a point of reference for your customers and clients too and build up that client relationship in a unique and rewarding way.

Welcome to the Carnival, I guess you all know why we’re here!

Welcome to the new Carnival Creative blog, it’s here that you’ll see our up to the minute information on new developments in the company as well as advice, reviews and research on the latest technologies, developments and innovations in the world of SEO, PPC and Design, hell we may even throw in some industry secrets, just don’t tell THE INDUSTRY!

So roll up roll up (come one we had to say it just once) and visit our site regularly to see what we’re up to, who we’re up to it with and what we’re learning.

We may call ourselves experts but even we know that in this field you’re kept on your toes and constantly having to adapt new strategies in order to stay at the (big) top! So stay tuned and we promise you the best insights into our creative world. Of course, what we can’t promise you is no more carnival puns, they’re just too darn tempting!