This means don’t blindly follow what other bloggers recommend in online community groups or add a plugin because some other blogger recommends it. Unless they know what they are saying, they are most likely just re-telling something someone else told them.

Most bloggers don’t have the time or desire to learn WordPress security’s ins and outs to know what is and isn’t good advice. Can you risk taking the opinion of someone who’s perhaps no more skilled in WordPress than you? 

 If I’ve learnt anything in all my years around blogging, most people fake it till they make it, and online community groups are full of questionable advice daily. 

Why Website Security is Important for WordPress Bloggers

As a blogger, you pour your heart and soul into creating valuable content for your readers, turning your blog into your source of income.

What blogger isn’t aiming to meet the entry requirements for Mediavine or Raptive’s ad networks to start earning some real money?

But have you considered the security of your WordPress website when aiming for that goal? Protecting your website from malware or being hacked is crucial to ensure your blog’s livelihood and to maintain your audience’s trust.

WordPress is not immune to security vulnerabilities. Security issues are reported daily. Suppose you wake up tomorrow to find your blog hacked, corrupted or, at worst, deleted. Could you recover it quickly enough to avoid negatively impacting your revenue, its SEO potential and future traffic growth?

Below are the best WordPress security tips for bloggers. I believe they can set you on the right path without overly complicating how you blog or by putting the fear of god into you with endless alert emails. They are by no means the perfect setup but they are a good middle-ground. If you run any form of e-commerce on your blog, the below is the minimum you should be aiming for. 

Common WordPress Security Threats

WordPress security threats can come in various forms, including malware, brute force attacks, and phishing scams. Some of the most common security threats include:

• Outdated plugins and themes: Outdated WordPress plugins and WordPress themes can contain vulnerabilities that hackers can exploit to gain access to your website.
• Weak passwords: Weak passwords can be easily guessed by hackers, making it easier for them to gain access to your website.
• Malware and viruses: Malware and viruses can infect your website and cause significant damage, such as stealing personal information or crashing your website.
• Brute force attacks: Brute force attacks involve hackers attempting to guess your login credentials by trying numerous password combinations.
• Phishing scams: Phishing scams involve hackers sending emails or messages that appear legitimate but are designed to trick you into providing personal information.

Securing Your WordPress Site

Securing your site isn’t complicated, despite what you might read online. And yes, you can take things much further than I’m highlighting in this article. But as a blogger who is most likely managing your blog by yourself, you want the best bang for your buck, so to speak. Preferably free, or at least until you start making an income.

Choosing a Good Hosting Provider

Choosing a good hosting provider is the first step in keeping your WordPress site safe. Look for a hosting provider that charges more than you’d pay for a couple of coffees at the local cafe monthly as a starting point.

If the hosting is cheap, the host will care very little about the security of your site. Not to mention, cheap hosting is always underpowered and will lack any good built-in security and performance options you need.

Your web host is the foundation you build your site from. Don’t cut costs here, or you’ll be chasing your tail not only with security but also site speed and day to day frustrations just using the site.

Look for a WordPress hosting provider that focuses on WordPress or provides WordPress-specific hosting. The good ones aren’t cheap. There’s a reason for that. 

Some of the better ones to look at are:

• Rocket.net
• Big Scoots
• Assistant WordPress Hosting (My hosting service, which is packed full of security and performance options out of the box)
• Cloudways 

Keeping WordPress Updated

Keeping your WordPress site updated is required to maintain its security. WordPress releases regular updates that include security patches and bug fixes. On top of that, plugins and themes also get regular updates weekly or even daily. Make sure to update your WordPress site, plugins, and themes as soon as new updates become available.

And yes, some WordPress updates might change the admin dashboard or how your blog works, but is staying on an old version of WordPress where there might be security vulnerabilities the best decision? We all hated the Gutenberg block editor, but these days, most new bloggers don’t know any different. Don’t let your routine or comfort factor drive your WordPress security.

Do you avoid running updates for fear of breaking your site? Here are a few reasons why dealing with that is better than the alternative:

1. Security patches: WordPress updates often include patches that address known vulnerabilities. By keeping your WordPress version up to date, you can protect your website from potential attacks.
2. Bug fixes and improvements: Updates include bug fixes and improvements that enhance your website’s overall performance and functionality. By staying updated, you can ensure that your site runs smoothly and efficiently.
3. Compatibility: Updating WordPress ensures compatibility with the latest versions of plugins and themes. Using outdated versions may lead to compatibility issues, which could compromise the security and functionality of your website.
4. Stay ahead of hackers: Hackers are constantly looking for vulnerabilities in outdated versions of WordPress. By regularly updating your website, you can stay one step ahead and minimize the risk of being targeted.

Strong Passwords and User Permissions

Using strong passwords is a non-negotiable for securing your blog. Choose a strong password that includes a mix of uppercase and lowercase letters, numbers, and special characters. Additionally, limit user permissions to only those who need access to your site. This reduces the risk of unauthorized access and helps keep your site safe and secure.

Did you add a VA to help on the site, but they no longer work for you? Delete them. Get tech help from someone? If you no longer work with them, delete them.

Who’s to say, while your password is secure, that theirs is? And maybe they used the same password on multiple sites?

A strong password is not the name of your pet, your favourite football team, your favourite band or a dessert. 

Use the below as a guide on how to create a strong and secure password:

1. Length and Complexity: Make passwords at least 12 characters long or longer. Use uppercase and lowercase letters, numbers, and special characters in your password.
2. Avoid Common Patterns: Avoid easily guessable patterns such as “123456” or “password.”
3. Unique Passwords: Don’t use the same password for multiple accounts online. If one account gets compromised, all other accounts could be at risk.
4. Password Managers: Use a password manager to generate and store all your passwords securely. This way, you don’t have to remember all your passwords. I use and love 1Password for this.
5. Update Passwords: Update your passwords regularly. Every three to six months is a good rule of thumb. This reduces the chances of someone gaining unauthorized access to your website.
6. Two-Factor Authentication (2FA): Enable two-factor authentication for extra security. This requires users to provide a second verification step, such as a unique code sent to their mobile device and password manager.
   
   Note: Sadly, most 2FA plugins for WordPress are insecure and can be hacked as after all they are just a plugin too. But having one is a better deterrent than nothing at all. And it gets you into a good habit since most online services need this now.

Don’t Use WordPress Security Plugins

Yep, you read that right DO NOT use a WordPress security plugins to secure your site. WordPress security plugins are rubbish. They slow down your site, send you endless scary email alerts that you might not understand, have confusing admin interfaces and bloat out your WordPress database, making backups larger, and your web host complain.

They are just plugins open to being hacked and compromised like all other plugins. All the popular WordPress security plugins have been compromised in some way, shape or form. 

For those who run a WordPress security plugin, think back to the last time you took action based on one of those emails. Have you ever?  

Also, did you know that all those security plugins are stealing resources from your hosting server to process potentially hundreds of millions of suspect hits to your site each day? You know that web host you only pay $10 a month for that you find slow all the time? Find yourself hitting your web host’s resource limits often…

Save your sanity, and just don’t install them. I don’t run any big security plugins on my client’s sites, and we get by just fine. Why? Because there are better, more proactive ways to manage and improve the security of your site.

Regularly Backup Your Website

Backing up your WordPress site is the ultimate security insurance for your blog. It provides a safety net in case your website gets hacked or experiences technical issues. With a backup, you can easily restore your site to its previous state, minimizing downtime and potential data loss. If you run ads on your site, you want it up at all costs. A few hours of downtime might be a lot of money for you.

Secondly, regular backups protect you from human error. If you accidentally delete an important file or make changes that negatively impact your site’s functionality, having a backup allows you to revert those changes quickly.

There are several methods you can use to back up your site. One option is to utilize a backup plugin such as UpdraftPlus or BackWPup, which automates the backup process and allows you to schedule regular backups. These plugins also offer options for storing your backups on cloud platforms like Dropbox or Google Drive.

Another method is to manually back up your site by exporting the WordPress database and downloading all the files from your website’s hosting control panel. This approach requires more technical knowledge but gives you full control over the backup process.

Don’t rely on your web host to maintain backups, either. Especially on cheaper hosting (I’m looking at you HostGator and Bluehost). Many provide backups but don’t guarantee them, so if you have a backup from your web host, download it or restore a file now and then to be sure it works.

Regularly backing up your WordPress site is the best insurance you can get for your blog. It could be the difference between having your blog and a potential disaster where your blog is gone for good overnight due to a security breach.

Implementing Advanced Security Measures

For those of you more comfortable with the technical side of your blog or just know how important security is to your blog. Here are some of the best security measures I think bloggers can implement to ensure the safety of their WordPress site that won’t cost you a cent.

Two-Factor Authentication

Two-factor authentication (2FA) is an additional security layer that requires users to provide two forms of identification to access their accounts. By enabling 2FA, bloggers can prevent unauthorized access to their WordPress site even if their login credentials are compromised.

There are several 2FA plugins available for WordPress that you can install as a plugin. But as I mentioned above, be aware these are just plugins that can be compromised like all other plugins on your site. Once you are hacked, all plugins on your site become open to exploitation. So your 2FA plugin becomes unless at that point in time.

Cloudflare

Cloudflare is free to use and can help boost your site speed and provide an amazing firewall between your blog and the greater internet. Aside from the speed benefits it affords you, the web application firewall (WAF) offers amazing site protection.

Think of this as doing the job of one of those WordPress security plugins at a level before that sort of traffic even reaches your blog. 

If the bad attempts on your login page are stopped before they even reach your site, you don’t need as much complexity on your blog or server. This also means less bad traffic to your blog, so your hosting server isn’t working overtime, serving rubbish requests. This means a faster blog, and we all love a fast blog.

The settings I set for my clients in Cloudflare that are above the default are:

• Custom page rule applying additional security to the WordPress login and WordPress admin page of the blog. This stops many of the bad login requests, or brute-force requests your blog gets daily.
• Firewall rules to block specific countries from loading the site. If your blog has no need for an audience from China, you can just block all traffic to it from there.
• Block bad bots or web crawlers from overloading your site with hits. 
• Add extra protections to the comments section of your site to avoid mass comment spam.

All of that can be done on the free tier of Cloudflare and goes above and beyond what your average website security plugin offers. And as I said, all these blocking requests happen before the traffic reaches your blog. Keeping it safe from unnecessary load or traffic.

The 7G Firewall

The 7G Firewall is a block of rewrite rules you save into your website’s htaccess file (if your host supports it) that can block malicious requests to your site. 

It offloads many security tasks a security plugin does to your hosting server. So, while not as good as using Cloudflare mentioned above, it still performs faster and better than running a plugin on your site. The server can process these requests much quicker than WordPress does, as it runs on top of the server.

Think of it as a series of layers; the deeper you go, the slower it gets. WordPress is the last layer. Your server is a layer above that, and Cloudflare is at the top layer. The further you block something from WordPress, the better.

I will say, however, that this isn’t for everyone and is best added to your blog by a WordPress developer or support person. That is because editing your htaccess file incorrectly can stop your site from loading correctly. And some rules it actions do not always play nice with your plugins and theme code on your site.

Dealing with Security Breaches

You should always be prepared for security breaches. Even with the best security measures in place, a hack is always possible. If a security breach happens, you should immediately minimize damage and prevent further harm.

Identifying a Hack

The first step in dealing with a security breach is identifying that a hack has occurred. Some signs of a hack include:

• Unusual activity in the website’s logs or WordPress dashboard. Maybe a new plugin has appeared?
• Unexplained changes in the website’s appearance or content
• Strange pop-ups or redirects
• A sudden drop in traffic or search engine rankings

If you suspect that your website has been hacked, take immediate action to investigate and confirm the hack. I recommend hiring a WordPress support professional or contacting your WordPress developer for assistance.

Resolving a hacked site is often complicated, and you risk making it worse by attempting it yourself.

Recovering from a Hack

Once a hack has been confirmed, here are the steps to recover the website and prevent further damage:

1. Identify the source of the hack: This can be done by reviewing the website’s logs, looking for suspicious files or code, or using a security plugin to scan the website. Best done by your WordPress developer, support person or 3rd party security firm.
2. Remove the hack: Once the source of the hack has been identified, remove the hack by deleting any malicious files or code and restoring any damaged files or content.
3. Change passwords and update security measures: After removing the hack, change all passwords associated with the website and update all security measures, such as plugins and themes.
4. Notify users and search engines: If the hack has affected users or search engine rankings, notify affected parties and take steps to restore trust and credibility. Check Google Search Console notices and validate any security concerns. Otherwise Google might warn readers that your site is not safe in search or via their web. browser.

Want The Best Security and Hosting For Your Blog?

Here at Assistant, we’ve just finished testing a far more secure 2FA and overall security setup that I’ll encourage all clients to take up. It provides real protection without the bloat or performance impact. This can be set up with all clients signed up to our WordPress Care Plans or just WordPress Hosting.

We pair our custom hosting servers with four security-focused modules to add 2FA login protection, brute force login protection, enhanced password security and login session protection. So should the worst really happen to your blog and it does get hacked, the hackers still won’t be able to take over your site, install plugins or do as they please.

If you’d like to learn more about the services we offer, get in touch today.

The post Best Website Security Tips for WordPress Bloggers appeared first on Assistant.

1. Set your permalinks

Permalinks control what the URL’s for your blog posts will look like. For this, I recommend you pick the “Post name” option. This avoids unnecessary wording in the URL and helps keep your URL’s that bit shorter and easier to read and remember.

To set your permalinks on your website, click “Settings” and then “Permalinks” in your admin menu to the left. Then, select “Post name” from the list of radio boxes and save changes on the setting page.

2. Set the website name, tagline and timezone

If you don’t set these up correctly, you may find the wrong name showing up on your website in searches or when a post is shared online via social media. And with the timezone, you’ll end up with scheduled blog posts getting published at the wrong time of day.

To set these, navigate to “Settings” and then “General” in your admin menu. At the top, you can set the title and tagline of your site. Think of the tagline as a short few words that sum up what your site is all about.

Then set the timezone to help you correctly scheduled posts to go live and so you can know what time of the day (or night) you are getting comments and interactions on your WordPress website.

3. Remove default content

When you start to set up a WordPress website, it comes with a dummy blog post titled “Hello World!” and a page called “Sample Page“. They exist as placeholders to welcome you to the post/page editor. But their content isn’t relevant to you, so we want to remove them before you start adding your own content.

To do that, click on “Posts” and then “All Posts” from your admin menu and then hover your mouse over the title of the post. You’ll see a menu appear below the title where you can click “trash” to remove it. You can also check the box next to the title, and from the “bulk actions” drop-down, select “Move to trash” as well.

Then do the same process under the “Pages” menu item to remove the sample page from your site.

An additional tip if you ever import demo content from a theme you install on your site. The theme will import several posts and pages to help get the design right on your website. Once you’ve mastered how the theme works and started adding your own content, be sure to remove all the leftover pages the theme demo import left behind.

4. Edit default category

WordPress comes set with just one category for your content, “Uncategorized“. As part of mapping out the content you write on your blog, you’ll need to set categories to label/assign your content into different sections on your site for readers to find.

That default category will become your go-to option should you forget to tag blog posts into a category, so it’s good to rename it to be something a bit more relevant to your site. I often change this to be something like “News” or “Updates” to feel more welcoming.

To rename the default category on your site, go to “Posts” and then “Categories” from your admin menu. Click on the “Uncategorized” category listed to the right to edit it. Then rename its name and slug to your chosen option.

5. Complete your profile

Every website needs an author or two, so it’s good to make sure you fill yours out correctly. You want your name and biography description showing on your articles if your theme supports it. Your readers will want to connect with you, the writer, so getting to know you is key.

To fill out your user profile, click on “Users” and then “Profile” to edit your user account. Here make sure you fill in your name, nickname (usually your prefered first name you are known as), along with the display name that will show next to all your articles on your site.

Then scroll down and fill our your biographical info as well. Once installed, some themes will have their own section for an author box in here as well, so once you have a theme set up, come back and ensure any other fields related to you are filled out.

It’s also a good tip to link the email address you use on your user profile with the Gravatar service. This ensures an image of yourself is associated with your chosen email address. What this does is that if you comment on your blog or other WordPress blogs, a little image of yourself shows up next to your name.

6. Install these must-have WordPress plugins

One of the great things about WordPress is extending it with plugins to add new features. The options are endless and, at times, just confusing. So we’ve collated a list of must-have WordPress plugins every blog should be adding as part of how you set up a WordPress website.

7. Install a theme

There are a million and one different themes for WordPress. The right one for you is the one you like the look of the most and feel will offer you the best jumping-off point to start your blog. While there are plenty of free themes on offer, I’d suggest spending a little bit of money on a paid theme.

A paid theme will give you support to help set it up, which can be invaluable as a new blogger. On top of that, paid themes usually come with more features, are more customisable and will often have a community of customers who all use the same theme so you can network with and learn from them as well.

The key to finding the right theme is picking one that does not require you to spend too much time getting it looking perfect. You don’t want to waste weeks trying to tweak it. You want something you can install today and be writing content for the world to read by next week.

Please keep it simple for your first theme as well. You’ll change themes several times over the life of your website, so while you are still learning to blog, don’t expect to find “the one” theme you’ll build your brand on at the beginning.

8. Start producing content

With all of the above done, you can now start writing, and I mean writing. Without content, you have nothing for people to visit your website for. Jump into working with the post editor under “Posts” and then “Add New” and start producing content.

The posts won’t be perfect, and you’ll look back in 12 months and think, “what was I doing” in those early blog posts but don’t worry. Everyone starts at the beginning. Push on and write because people don’t come to see how pretty your logo is or what colour you chose for your theme at the end of the day.

They come to read what you have to say.

And that’s how you go from a fresh install of WordPress to blogging in no time.

The above is an oversimplification of all the steps I know, but keeping it simple is the key to enjoying blogging long term.

The post 8 Steps For After You Install WordPress appeared first on Assistant.

I define a must-have plugin as one that you’d install as soon as you set up your website. One that has to be there from the beginning because without it, you need to go back and update all your content or could in some way suffer major damage to your site without it being there.

So what are these must use WordPress plugins you ask?

1. An SEO Plugin

The very first plugin I install on a new site is an SEO plugin. Getting your site set up so search engines and social media networks can correctly read and display summaries of your blog posts is a must. Without a clear guide letting them know what image and descriptions to focus on, they’ll grab whatever they like.

Not only that, but SEO is confusing and, for many, a big unknown. All good SEO plugins provide you with clear guides to steer you in the right direction. All while handling the more complex coding outputs for you.

This makes SEO so much easier to grasp and allows you to get on with writing that next hit article without the fear of overcomplicating how it should be written.

Some of the top SEO plugins you can install on your site are:

• Yoast SEO
• Rank Math
• SEOPress

2. An Image Optimisation Plugin

The second plugin I add to a new site is one to help improve the optimisation of images uploaded to blog posts. Images are one of the biggest factors impacting the speed of your site and the most common item not addressed correctly by new website owners, making it a must-have plugin in my mind.

With Google putting a bigger focus on a websites page experience as a whole (you can learn how to assess your websites page speed here), getting this simple task wrong can leave a lasting impression on the performance of your site.

The great thing about these plugins is they work in the background for you once set up. And while they’ll never replace you spending time editing/cropping/resizing your images before uploading to your site. They do make a great catch-all option to avoid massive images ending up on your site.

Image optimisation plugins worth taking a look at:

• ShortPixel
• Imagify
• Compress JPEG & PNG images

3. A Backup Plugin

No matter how careful you are, at some point in your blogging life, you’ll accidentally delete something, have your site hacked or need to migrate your site from one web hosting provider to another.

Some might say a backup plugin isn’t really a must-have WordPress plugin, as your web host will most likely be taking backups of your site. And that’s true most do, but as far as I’m concerned, having a backup of your site is the best insurance you can get for a website and the more of them you have, the better off you are.

If you find yourself in a position where your blog is making you enough money to live off, and it gets hacked or, for some reason, is deleted. You want to know that you have a copy of it that can be quickly restored to get you online again.

Three different backup plugins I find most commonly used are:

• UpdraftPlus
• BackWPup
• BackupBuddy

4. A Spam Prevention Plugin

Spam emails invade our inbox daily, so as expected, you need a WordPress plugin to handle the spam comments your website is likely to receive.

Short of disabling comments on your site, you need a plugin to hold back the flood gates of spam your site will receive, or you’ll end up spending all day every day managing some of the rubbish that will come flooding in.

A spam plugin will auto classify the worst of the spam and delete it for you, leaving anything it’s not 100% sure of for you to moderate as you see fit. Having fixed sites that had no comment spam protection, the minimal cost of what these plugins save you makes them a must-have plugin to get installed as soon as your blog is online.

Both of these end up being paid offerings but when it comes to spam its worth the small cost:

• Akismet
• Cleantalk

5. A Caching Plugin

A slow website will turn readers away, impact your ranking in search engines and frustrate you as you work on your website. To help improve it, no matter who you use to host your website, a caching plugin can dramatically boost your performance.

When a reader visits your site the server processes the request and pulls together your images, written content, plugin and theme coding to create the page you see in your web browser. Now every time a visitor comes to your site your web server has to handle all those processes each time.

What a caching plugin does is save that fully generated page the first time its visited. Next time someone comes to visit that same page, instead of the server doing all the work to create the page again the caching plugin says “hang on use this saved copy instead“.

Think of it as taking a photocopy of that original creation of the page and sending that to everyone else who asks to see it. Instead of hand writing the content for each person that would like to see it.

By not having to re-create the page again, you save your server work and, in turn, make it quicker to show the page to your reader.

There are so many caching plugins but these three have more often than not given me the results I was after:

• Cache Enabler
• WP Rocket
• WP Fastest Cache

Which Plugins Do You Recommend?

I know you don’t want to see a list of plugins and not get a clear recommendation on which one from each category you should use.

So here are the 5 must-have WordPress plugins I personally use from the above lists.

1. Yoast SEO – Has been a bit of a standard in the industry for some time now. Does the job without too many other extra options that can distract. However, SEOPress has piqued my interest more and more of late.
2. ShortPixel – We’ve written about image optimisation with Shortpixel before. It’s a great plugin that has time and time again got the job done where some others failed. I recommend you take out a paid plan with them to get the best value.
3. Updraft – Backups are insurance for your website. I like Updraft as it allows a simple setup to send your site backups to online cloud storage locations. Meaning if your web server goes down, your backup is saved safely away from it, and it can then be used to restore as well.
4. Akismet – But only just. It’s starting to get that bit more pricey for those selling products or running ads on our sites. May very well be swapping to Cleantalk soon.
5. WP Rocket – It’s so much more than just a caching plugin these days. With Googles push to a mobile-first internet, you want to ensure you are doing everything you can to ensure your site speed is on the money.

And there you have it. My take on 5 WordPress plugins you just need to have installed on your site to set it up for success.

While there are many others you can use, the above categories of plugins can be used on any niche or type of site with a great deal of success. Which is why they are my must-have options for any WordPress website.

The post 5 Must-Have WordPress Plugins appeared first on Assistant.

And then there they sit without much attention or waiting for their turn to shine. Some, you might have registered with your web host because it was free the first year when you signed up. Others are with a more traditional provider like Godaddy or Namecheap. You end up with domains spread out across providers without any real governance or recollection of where and how to find them.

I see it all too often and here’s why you need to take better care of them.

You see, for the lifetime of your site, you are almost guaranteed to move web hosts multiple times as your site grows, you get fed up with the support offered and/or the price becomes overwhelming. Each time you change your web host, you need to update the records on your domain to reflect this change. Knowing where to update the nameservers on your domain is a required part of a web host move.

Domain names also don’t just renew for free. You have to ensure your payment details are updated. Having your credit card expire and the details not updated with the domain name registrar is one of the common reasons to see your website go offline. An expired domain can take up to 24 hours to come back to life after fixing the billing issue.

Many of us are also guilty of having just one too many email addresses. Say you registered your website using an email address that you no longer use, were hacked or can’t remember the login anymore. You then miss the renewal notices, and your domain expires. You can’t log in anymore to pay the renewal as you forgot the password, and all the password reset emails go to that email address you can no longer get into. Getting your site back online from this point could take days to resolve.

While it’s never quite as disastrous as that last example, any sort of combination of the above can easily sneak up on you without a little organisation and planning.

So here’s a few tips to avoid ever having problems with your domain names again:

1. Always keep your domain registrations with the same provider. This ensures you know where they all are and makes managing renewals far easier to track. Even create a spreadsheet with all the details for extra organisation.
2. Set up reminders in your calendar to go off 2 weeks before a domain is set to expire so you can be sure your domain will never expire by accident.
3. Transferring domains between providers is easy to do, paying only for an extra years renewal as part of the transfer process. So don’t leave domains spread out as you think it’s too difficult.
4. Be sure to review your contact details on your domain registration. You must legally provide an address and contact info (phone/email address) for your domain name. By making sure this is correct, you can easily recover access if you ever get disconnected from your domains.
5. Always get whois protection for your domain name. Without this, your address, phone number and email address are visible to the world. Ever wondered why you get weird phone calls about your domain just after you registered it? This is why. Getting that protection hides your important details from the world.
6. And finally, don’t keep your domain registrations at the same place as you host your website. You will swap web hosts, and moving your website to a new provider is a lot easier than moving your domain names each time. It also works out far cheaper to register them with a dedicated domain registrar than a web hosting provider.

Now, who do you choose as your all-important keeper of domains? Everyone has their favourites for various reasons but my personal favourite is hover.com.

I like their clean, simple interface and the fact they bundle whois protection into the pricing, so I don’t have to think about it. They won’t be the cheapest provider you can pick from, but at least you won’t be bombarded with a million upsell options each time you go near your account like some others.

Organising your domain names is a really dry boring part of running your website business but you have to remember if your domain name goes down for non-payment your website and your email address goes down with it. That can be far more costly than making sure to pay the $15-20 a year fee to have it.

The post Organising Your Domain Names appeared first on Assistant.

In reality, it’s a bit more complicated than that.

Security breaches come in all shapes and sizes, and while the above will hold you in good stead there are many more than you just cannot fully plan for or be available 24/7 to babysit your website to keep it safe.

So in addition to the above common sense options here are my 5 extra tips to ensure your WordPress security is that bit better than the average blogger.

1. Have Really GOOD Passwords

I know you think I’m just re-hashing the first point, but hear me out. How many of you have passwords that you can easily remember? Exactly, good passwords are not written like “13CuteBears” a good password looks like this “xWi_eqhx@4*9bit_8JVAR7kdDwp7U”.

And then do you use a different password for your email account, WordPress login, web host login, domain registration login etc. It only takes one of the many online services we use to get compromised and your single-use password for all the internet can bring you down.

A good way to make passwords easy, is to use a password manager like 1Password or LastPass.

2. Protect Your Login Page

Protection on a login page sounds over the top but it’s really good practice to stop those brute force attacks on your site. A malicious attack on your login page can quickly cause an overload to your hosting server. That gets the hosts attention and they start to slow your site or block it for using too many resources. If all those attacks hit a password prompt or challenge request instead of your site it’s a huge resource saver to your server.

The easiest way to combat this is to run Cloudflare as your DNS provider and set up a page rule to protect the site. The page rule can be configured to use Cloudflare’s under attack mode so they weed out all the bad requests before it even gets to your server. To set up the rule, log in to your account at Cloudflare and click on the”Rules” option at the top.

Add a page rule where the url matches the below (substitute your domain name in where mydomain.com is mentioned)

https://mydomain.com/wp-login.php*

Then from the drop down option select the “Browser Integrity Check” and turn it on along with setting the “Security Level” option to the max of “I’m Under Attack”

What this does is leans on Cloudflare’s security options to filter out all the bad or suspicious traffic to your login page so only legitimate requests get to your site and server. You’ll still see people try to login to your site if you log that sort of data, but it will stop the bulk of the obviously malicious traffic coming in. Best of all, all you’ll see when you load your login page is a short delay screen from Cloudflare before getting redirected to your login page.

If you don’t currently use Cloudflare on your sites I highly recommend it. Their free yes I said free plan offers some great protections that makes them a no brainer for your site.

3. Have A Good Web Host

This sort of goes without saying I feel but if you are paying $5/$10/$15 a month for hosting your website, then don’t expect the best level of care to be given. You are just a number among many many many others on the same web server as you. Big corporate hosting providers provide the bare minimum in terms of meeting specific WordPress security metrics and best practices.

You ideally want a host that focuses on WordPress hosting (like we do). This way you know setup wise your host is looking after your best interests. They set up extra out of the box security options like automated SSL certificates, actively block malicious attacks and ensure server wise you run the latest versions of PHP and caching systems.

I’m purposely glossing over all the things a good host does as it gets a bit technical. Just know that the more bespoke and WordPress focussed hosting providers are far better setup to protect you and grow your blog.

4. Have And Check Your Backups

I’ve harped on about having a website backup before and you probably don’t think a backup is a WordPress security feature. Your right it’s not, having a working backup is the insurance that if something terrible does happen to your site, you can fix it quickly.

You can’t protect yourself from all the evils on the internet but you can have that backup sitting there at all times should you ever need it. I hope it’s the one thing you spent time setting up and testing but never have to ever use. But if the proverbial does hit the fan you want to know you can recover from it.

5. Audit Who Has Access

Over the life of your blog, I’m sure you’ll have added admin users to your site for various reasons. You’ll have shared logins or granted access to your web host or domains as well to facilitate work on your site. How often since then have you reviewed who has access to what in your business?

Had a tech guy do some work but never removed their access once they were done? Hired an SEO to look over your analytics and site but never revoked their access to your data once they finished?

You have no idea how secure they keep their end of things, so if they get compromised it could, in turn, impact you as well.

The less exposure you can give to your site to be compromised the better off you will be. So spend 5 minutes reviewing who has access to what and remove anybody that doesn’t need to be there. For the ones who do need to stay, prompt them to update their password or better yet change the password for them and they can reset it next time they need access.

6. Bonus Tip

You can’t watch your site 24/7 so set up an uptime monitoring service like UptimeRobot to help tell you when your site goes down. Usually, a few seconds of downtime here and there is nothing (server restart or network issue) but your site having multiple downtimes for minutes at a time can be a sign of problems to look into.

7. Extra Bonus Tip

There are some great services out there that can provide WordPress security protection for your site and/or repair your site if it is compromised. I’ve touched on Cloudflare as an option that’s free to help prevent issues with bot/malicious attempt protection.

Others to look at that are far more involved in what they can do for you are:

• PatchStack
• Sucuri
• Malcare

And one final note. If you ever suspect something is not quite right with your site, or a reader emails to say they saw some nasty popup or a blog post show up that isn’t written by you. Get your site looked at by a professional or professional service. If you just restore a backup you are not fixing the problem, just undoing it till it happens again.

It might also be that your site was compromised some time ago and so restoring a backup won’t help and your site needs to be cleaned. Once you start moving files around and restoring backups it makes it almost impossible to help pinpoint the cause of the problem.

And as always if all of this sounds too difficult to set up or you just want someone to manage all the technical side of your site we have WordPress Care Plans that have you covered.

The post 5 WordPress Security Tips You Can Do Today appeared first on Assistant.

Here’s the thing, you run a website and it makes you money. Maybe even enough money to live off which is amazing. But what happens if your website gets hacked or for some reason is deleted off your web host. How quickly could you get your site up and running again? Within the hour, a few hours, a few days or even a week?

Now I know most of you will say “but my web host runs a website backup and they will fix it”. And for the most part they do run backups (some with conditions) and can restore it for you. But how much do you trust the host you are paying maybe $5 or $10 a month to have your best interests at heart?

What if your site was hacked and you never noticed for a month or two. It happens a lot more than you’d like to think sadly. Now your web host only keeps backups for the last 30 days on average so even if they do restore any corrupt files, you’ll still be hacked. Meaning you will be forced to have the site professionally cleaned and some files or site content might be lost for good.

Another scenario, you’ve assumed your web host is running backups but never checked or tested them. One day you need to run a restore to fix an update gone wrong only to find out that due to the size of all your sites files (all those amazing outfit/travel/DIY photos took up over 10gb of storage) the backup hasn’t been running as it exceeds your hosts backup limits.

I could go on but I think you get the picture. Having a website backup that you control is the best insurance you can get for your site. Not just because you control it either, but because you are responsible for it meaning you can set up reminders to test your backups, download a copy for safekeeping and just be more informed about how well its working.

So how do you backup your site?

As a general rule you want a minimum of 2 backups for your site (if we manage and host your site we maintain 3 copies). Your web host is running one, so that leaves you to setup a backup plugin on your site to handle the other.

My preferred backup plugin is called UpdraftPlus and their free version is more than enough to get most people setup and going. What I like most about this compared to many others is the ability to backup and restore your site from a backup file.

Once installed you can access the settings for the plugin under your Settings -> UpdraftPlus admin menu.

From there everything you need to set up your backup can done from the “Settings” tab.

On this page you want to set your files and database backup schedules first.

For the Files Backup, running that weekly catches most of your site files minus anything new posted that week. There may be a little bit of work to re-add any lost images but overall this reduces the stress a large backup puts on your hosting server each time it runs. I like to keep a minimum of 6 copies of these files but if you have a large remote storage location to save to you can keep more.

The Database Backup should be run daily. It contains all your written content along with comments on your site. Unlike plugin or WordPress files this is much harder to rewrite if it gets lost so we run it daily. Database backups are also a lot smaller in size than all your uploaded image files etc. I like to keep a minimum of 2 weeks worth of database backups.

Next we need to set a remote storage location to save your backups too. Web hosts don’t like you saving copies of your site locally to your hosting account (all those unlimited storage offerings on your plan aren’t really unlimited). In addition, if your backup is saved in the same place as your site it’s not the most secure setup should your site get wiped or hacked as it could be lost too.

Dropbox or Google Drive are common options to go with as most people maintain an account with one or the other. Follow the prompts to connect your chosen remote storage location and then scroll down to fill in the last setting before saving.

We need to set what extra files should be included in the files backup.

Now for this I tend to only include the Theme and Uploads folders in my website backup as that contains all the images I upload and my theme I use on the site. Plugins can be easily re-downloaded if need be and excluding them reduces how big your backup file needs to be.

With all that set you can save your settings and you are good to go. For those that like to get email updates on your backup there is also an option you can check to get an email after each backup is complete. Handy when you forget to check on your backups.

How do you monitor your backup?

Checking in on your backup is something to create as a habit. Just like you need to check on updates to run on your site so to should you check your backup is running ok.

As mentioned above you can get email logs each day it runs or just set your self a calendar reminder to once a week drop into the Updraft plugin settings page and check the backups have saved and uploaded to your storage location. in the beginning it will seem like an annoying step until it just becomes second nature to do.

I’d also recommend making time to check your web host backup is running now and then as well. While you will have your own backup via the plugin, making sure your host is doing the right thing by you is worth the time too. Each host has different setups so refer to their knowledge base on how you can see if your backups are successful or not.

How do your test your backups?

Just having a backup and knowing its running isn’t enough, you need to know it works and can be relied on in times of need.

A simple test is to download a copy of your backup zip files from the main Backup/Restore tab in the UpdraftPlus settings page. Once downloaded try to unzip the files and see if you can view the saved data. Your database backup will just contain a single file but your files backup will have all your images saved to the wp-content/uploads/ folder so you can browse into them to open the images you’d uploaded to your site.

The more robust test (albeit a difficult one to set up initially) is to configure a development or new install of WordPress somewhere to test a restore of your site. Doing this locally on your computer is best using tools like LocalWP or XAMPP as it keeps your test sites away from search engines. To restore your site you would setup one of these programs, install a new copy of WordPress along with the UpdraftPlus plugin and upload one of your saved backup files to it to restore your site.

Should either of these tests fail then you need to review your setup and see if the backup process has been logging errors to find out what is going wrong.

Overall a website backup is something you NEED but hope you’ll never have to use, just like Insurance.

If looking after your website backups seems too difficult or you don’t want to be responsible for such a technical task we here at Assistant include a backup service as part of all of our WordPress Care Plans we offer. Just signup and well make sure your backups run, work and can be relied on in a time of need.

The post Don’t Forget to BACKUP! appeared first on Assistant.

But by not taking that time to edit, crop or resize (and rename the file for SEO benefit) your images before adding them to your blog you are directly contributing to how fast or slow in this case your blog is going to load. A blog post with say 5-6 images uploaded from your camera without any optimisations can quickly mean a page size of over 10MB and that can directly impact your site speed and SEO configuration.

Then consider that over the age of your blog you may have 1, 2 or even 5 years worth of images all contributing to bringing down the value of your site. Not to mention creating some rather large backup files to manage but that’s a story for another post.

When reviewing your website site speed one of the most common problems to fix is large images taking too long to load. But fixing all the images manually for a blog that is say 5 years old would be impossible without some sort of automated tool. And that’s where ShortPixel comes in.

ShortPixel can be added to your WordPress website via a plugin and linked up to their optimisation service. You then configure its settings to allow you to bulk optimise all the images already uploaded to your site. Along with having it run across all new images added as well.

The plugin can be installed directly via the Add Plugin feature just search for “ShortPixel Image Optimizer” and install it.

The service has a free pricing tier of up to 100 free image compressions a month. That’s not a whole lot but a great starting point to let you at least start compressing the current images you are uploading to your site and see how they look. I would suggest taking up a monthly plan (costs as low as $4 for 5k images a month) or at a minimum, one-off purchase of credits to bulk optimise your entire media library.

Setup wise once you have a registered account with them you want to configure a couple of options to get the most out of the plugin.

On the main General Settings page you enter your API key at the top.

You want to look at making sure you set the options to include your thumbnails so all images on your site get the optimisation treatment. Now keep in mind 1 image credit covers one image file. If your theme for instance creates 5 versions of the 1 image you upload to provide different sized images for various places on your site then every single image you upload could use 6 credits with Shortpixel.

Depending on how much you trust the plugin to not mess with your images, you can leave the backup images option checked or not. For nervous clients or real image purists, I like to leave the backup option on just in case you need to roll back. Long term though once you are happy with the image quality I’d turn this setting off.

Removing EXIF from your images takes out the metadata of the image to help get the file size down. Unless you need that data in there for copyright or specific use cases I’d have that removed as well.

Moving onto the advanced setting tab there are 2 settings you can configure, the rest are best left at their default.

First up is the option to convert your images to be WebP images. Webp is a modern image format that is said to be smaller in size than your traditional JPG and PNG files of old. Given this is a free feature and it can help your site speed it’s worth having this turned on to review how much it helps your performance.

The second option to turn on is allowing the plugin to optimise media on upload so all new images added to your site get compressed for you automatically.

Just adding the plugin isn’t going to magically make things better though. Having this plugin on your site doesn’t allow you to get out of editing the images locally on your computer first to resize and crop it to the perfect size. The ShortPixel plugin is there to get the most out of your images so they are as small as they can be without dropping quality.

If you don’t currently have a program on your computer to allow you to edit and crop images I recommend taking a look at a program called PhotoScape. The plugin is free and works on both Windows and Mac making it a good all-round option.

By following a simple process of editing your images locally on your computer and allowing ShortPixel to help get that bit more out of your image compression you’ll be well on your way to ruling out images as a speed problem for your website.

The post Image Optimisation with ShortPixel appeared first on Assistant.

Core Web Vitals completes their push towards a mobile-first search experience. So while desktop still has its place, from now on assume mobile is the king for your website and desktop is the annoying cousin that still hangs around but you wish would just go away.

Readers are after all short on time and patience (and at times bandwidth on their mobile device), so if your site isn’t loading instantly they’ll go somewhere else. I know you do it, I do it too. As soon as you see the page failing to load up, that page is closed and your back looking at the next result that showed up in your search.

So how do you test your site speed with the Google’s Page Speed Insights tool? And even more importantly, decipher the report you are shown once it’s finished?

The how is pretty simple, open up the website and drop your website url into the search box and click analyze.

Now when you run a test be sure to test more than just the homepage. Readers to your site will most likely arrive via a blog post but often people will only test their homepage and think if it’s good the rest of the site is too. It’s not.

So test a whole bunch of your blog posts. I recommend picking 5 different blog posts to get a good sample size along with your homepage.

Another good way to find URLs on your site that might be underperforming is to look up your Core Web Vitals score in your Search Console dashboard. The data found there will be the most complete in terms of what pages are good and what is bad for you to work from.

You can’t just run the test once and call it a day either. I like to test a site over a couple of days and at different times of the day to get an idea of the average rating for the site when really digging into the speed of a site. This helps to weed out general fluctuations in your server and overall internet performance.

With the tests run you’ll see a pattern as to which items might be giving your site the most problems broken down in both Mobile and Desktop instances. We are only going to concern ourselves with Mobile performance, fixing it will also fix the Desktop concerns.

At the top of the page, you’ll be given an overall score out of 100. Obviously the higher the better here.

The data of the report below that number is what we are more interested in and will be presented to you in this not so simple table of information full of big words that don’t make a lot of sense to the average blog owner.

Let’s try and decipher some of these field titles so you know what is important and what isn’t before getting to the rest of the page’s information.

Field Data

Reports back on real-world data gathered by Googles Chrome User Experience Report for that specific page. This data is collated from people who have “opted-in to syncing their browsing history, have not set up a Sync passphrase, and have usage statistic reporting enabled” in their Chrome browser. Unless your site is generating a lot of pageviews it’s common to see this not report data for every page of your site.

Origin Summary

Your origin summary report however will give you feedback from the last 28 day collection period as an aggregate for your whole site as opposed to an individual page. This is Google lumping all the pages on your site into one averaged result from the data they have collected. That collated data is then used to say if you pass or fail the Core Web Vitals test.

Lab Data

This is your performance as analysed by the site speed test you’ve just run. You’ll find this data can vary greatly from the origin summary above. And is again a reason we test multiple pages on your site to help find the slower pages that might be dragging your average down. So pick your test pages well from the variety of blog post content you have. Grab a page with a video on it, a page with lots of images etc.

Out of all of the data reported, we care the most about the following 3 metrics and how they will affect our page speed performance (often denoted in a speed test with the little blue flag).

Largest Contentful Paint (LCP) – Represents the time it will take to load the largest element on the page. This could be an image, video or some other content element. You want this to be loaded within 2.5 seconds or faster.

First Input Delay (FID) – Represents the time it takes for a user to be able to interact with your site. As in click a link or menu item and have the site respond to that request. Here you are looking for a reaction time of less than 100 ms.

Cumulative Layout Shift (CLS) – Represents the amount of moving around elements make as they load on the page. You often see this as ads or images load on a page and push text down out of the way when they appear. For this, you are looking to score at 0.1 or lower.

Now that we know generally what’s going on with a page speed report and what we do and don’t care so much about, how do we fix it?

Let’s take another look at the rest of the page speed report data we gathered from our scan. This is a break down of our site content and how specific elements are impacting your site.

For reference, the most common “Opportunities” as they are called that you may see in a page speed scan are below, but as you can see from above there are many others along with Diagnostic data as well that starts to get really tech-focussed. The main ones below tend to have the biggest impact on your site and can be most easily fixed:

• Reduce initial server response time
• Eliminate render-block resources
• Remove unused JS or CSS
• Properly size images

All of that translates into the below items that may be having an impact on your site speed.

• The performance of your web hosting server might be suffering or not performing well
• How much Javascript and CSS styling your theme, plugins or 3rd party services (ads, tracking scripts etc) might outputing at the top of the page
• Javascript and CSS from your theme, plugins or 3rd party services that are not being used on that specific page
• The size of images you upload to your site. Both in data size and canvas size

OK let’s bring it all together into something you can action on your site knowing which opportunities will improve the key metrics we really care about.

Improving your Largest Contentful Paint Score

As we highlighted above your LCP score is tracking how long it takes to load the largest elements on your page. So to improve that you want to work on reducing the impact delays and large elements have on your site.

To do that make sure you have a good web host ($5 a month hosting is not what would be considered great) and that you are hosting your site as close to the bulk of your readers as possible. If all your readers are based in Europe for example but your host your site in America consider moving it to Europe instead.

Lazy load your images and embedded videos so only the images or videos you see as soon as you land on the page appear. As a reader scrolls down the page, the other elements will begin to load the further down you scroll. This can really improve a users mobile experience on image-heavy posts.

Compress/resize/crop your images before uploading them to your website. Don’t just drag the image off your camera and upload to your blog. By creating a good workflow for image editing you not only improve your site speed but it allows you the time to crop an image for the best impact on your site as well.

Minify Javascript and CSS code on your site by using a caching/optimisation plugin that supports this feature.

Improving your First Input Delay Score

FID measures the delay between when a user can first click on a link or button and your browser responds to it as the page is loading.

The main cause for a delay in response time is Javascript loading on your site. This could be from a featured image slider, ad code, 3rd party tracking scripts loading up or email popup and chatbots. Where possible limit these elements on your site unless needed.

Taking it a step further also try to only load Javascript code and any specific code really on the pages it’s needed. If you have an email popup that only works on the homepage make sure that code only gets output on the homepage and not loading its styling and code in the background on the other pages as well but being blocked from showing since it’s not the homepage.

The less reliant you are on code loading from other websites and fancy effects that require Javascript to work the better your user experience will be with your site too.

Really large images or large javascript library files will also have an impact on your FID as the files need to first be downloaded before they can be executed by your browser.

Improving your Cumulative Layout Shift Score

Layout shift on a web page as it loads is possibly the most annoying of them all. You go to click a link and all of a sudden its moved down and something else has appeared in its place (usually an ad) and thats what you’ve accidentally clicked instead.

Reducing the impact of CLS on your site means ensuring all elements on your site have defined sizes so they keep their size even if the actual ad, image or video is yet to fully load on the page.

When you insert an image via WordPress it should have its size defined for you unless you’ve placed the image manually via custom html. Videos that are often embedded via an iframe may need some extra html applied to ensure they get their correct sizing.

Ad blocks are one of the main offenders to this layout shift you see. Thankfully many of the big ad networks have started to address this issue. As you enable those options on your ad profiles you should start to see an improvement in your CLS scores.

That’s a lot to take in and many of you might be thinking, there’s no hope for me this is all still just too confusing. As such, I also want to mention that while site speed is important content is and will always be king. The fastest and cleanest site is nothing without well researched and valuable content to share with the world. After all, we use a search engine to find the answer to a question so that means having content. Don’t feel like you have to go all-in on the speed of your site or feel like you’ll be left behind, it’s just not true.

The key takeaway I want to leave you with is to keep a balance in mind and optimise your site by fine-tuning what you can while staying true to your site and the brand you have built.

If working on your site speed is something you want or need to do but are just not confident enough to undertake yourself then we have a service that can audit your site and help you improve it. Head over to our Site Speed Audit Service page and signup and we’ll be in touch to help you out.

The post Tips on Running a Google Page Speed Test appeared first on Assistant.

So let’s start with the who, why and what we are all about here.

Who

My names Chris and I’m the owner of this little WordPress agency. I wasn’t always a WordPress guy, for many years I worked for a small IT firm consulting with small business, managing their office computers and networks.

It was here where I spent a LOT of hours providing both onsite and remote support. The things I fixed for our clients near and far taught me a lot about customer service. You learn patience when talking someone through fixing their computer or installing a printer when all you can do is talk to them on the phone.

Along the way, the lure of travel captured my heart and I took a break to backpack my way around Europe and set up a life in London for two years.

To this day I still say it was THE experience I needed to better myself at the time. When you can travel a country where you don’t speak the language and still find a way to communicate and get around it can make many things you once thought difficult at home seem like nothing.

My love of Travel and IT lead me to start a humble little travel blog to document my experiences and that is where I found WordPress.

Why

Being an IT geek I took to WordPress far easier than many of my blogging peers. As we networked, had meetup’s and got to know each other I found myself lending my knowledge to my friends. We had formed a community of bloggers all helping each other, it was an exciting time to be a blogger.

First I helped friends I’d met up with and then I was helping their friends who I’d never met and it grew and grew from there.

I’d never meant to turn into this WordPress guy for bloggers but the longer it went on, the more complex things I helped with and it became clear this WordPress thing was taking off and I had a knack for helping people fix their problems.

Most importantly I felt a sense of joy in being part of another person’s little world, each blog is after all its own living and breathing entity.

What

This WordPress Agency has been through a few iterations in my time as I’ve grown the business. I like to think those were my growing up years as the business grew from its humble beginnings to supporting website owners and bloggers all over the world.

Now it’s grown into its adult years and all the learnings and experiences from that time have lead to this.

We don’t want to just be some WordPress business or the tech people you call when something breaks. We know the pain and work needed to run a website. We want to be part of your team helping your blog grow, be the boots on the ground watching over your site and not just the people you call when something breaks.

Our WordPress Care Plans are structured so we can do just that.

And this is just the beginning. We have so many exciting initiatives lined up to help you run and grow your blog no matter your niche or budget.

So get signed up to our newsletter and strap in, we are determined to give back far more to the blogging community than we take out.

The post The Beginnings of Something Great appeared first on Assistant.