The new menu system alleviates a lot of these problems and gives us easy control over our menus. With multiple menu support, drag and drop ordering and easy title changes it is hard to imagine needing much more.

The new system even addresses a challenge I have always had with Wordpress, and that is of using link descriptions. Link descriptions typically are one or two lines of descriptive text below a primary navigation item used to  describe the section or link. They are a nice visual touch and can really enhance usability in a significant way.

Until now there wasn't a great way to do this, even with the use of plug-ins. Even with the use of custom fields and some hacking it was never perfect.

The new menu system allows us to do a bit more customization to our menus, such as adding custom classes, titles and even including a description.

Working with Link Descriptions

The first step is of course enabling custom menu support through your theme. This can be done with the following simple code in your functions.php file:

add_action( 'init', 'register_menus' );
     function register_menus() {
           register_nav_menus(
                array(
                     'primary-menu' => __( 'Primary Menu' )
                 )
            );
      }

You will then find a "Menu" link in your appearance tab with in the Wordpress administration interface. Once clicked on make sure that you turn on "link description" with in the Screen Options.

At this point we can now define where we would like our menu to display in our theme by adding the following function to our theme files:

<?php wp_nav_menu( array( 'theme_location' => 'primary-menu' ) ); ?>

This will output the menu with our defined order and menu titles. It won't however output the description by default, in order to do so we will have to take advantage of the $walker function with in Wordpress.

This is done by creating a custom class in our functions.php, such as the following:

class My_Walker extends Walker_Nav_Menu
{
	function start_el(&$output, $item, $depth, $args) {
		global $wp_query;
		$indent = ( $depth ) ? str_repeat( "\t", $depth ) : '';

		$class_names = $value = '';

		$classes = empty( $item->classes ) ? array() : (array) $item->classes;

		$class_names = join( ' ', apply_filters( 'nav_menu_css_class', array_filter( $classes ), $item ) );
		$class_names = '';

		$output .= $indent . '<li id="menu-item-'. $item->ID . '"' . $value . $class_names .'>';

		$attributes  = ! empty( $item->attr_title ) ? ' title="'  . esc_attr( $item->attr_title ) .'"' : '';
		$attributes .= ! empty( $item->target )     ? ' target="' . esc_attr( $item->target     ) .'"' : '';
		$attributes .= ! empty( $item->xfn )        ? ' rel="'    . esc_attr( $item->xfn        ) .'"' : '';
		$attributes .= ! empty( $item->url )        ? ' href="'   . esc_attr( $item->url        ) .'"' : '';

		$item_output = $args->before;
		$item_output .= '<a'. $attributes .'>';
		$item_output .= $args->link_before . apply_filters( 'the_title', $item->title, $item->ID ) . $args->link_after;
		$item_output .= '<span>' . $item->description . '</span>';
		$item_output .= '</a>';
		$item_output .= $args->after;

		$output .= apply_filters( 'walker_nav_menu_start_el', $item_output, $item, $depth, $args );
	}
}

This will add the description with in a span element when we tweak our template code to the following:

<?php
       $walker = new My_Walker;
	wp_nav_menu(array(
                'theme_location' => 'primary-menu',
		'walker' => $walker
	));
?>

Tada, now we can have menu descriptions such as on this Buddypress project we worked on here.

However one of the great presentations from the conference reminded me not only how easy they are to implement but also reminded me of the benefits as well. As a result I have started to write them into the web development standards at 3.7 and have also posted an article with more information on the company blog. If you are at all interested in Microformats give it a read.

While you are upgrading to Wordpress 3.0 don't hesitate to install these plugins as well.

Custom Post Type UI

One of the powerful new features to Wordpress is the ability to create custom post types. This has long been a lacking feature in Wordpress. The custom post types allows you to define custom "types" of content such as listings, locations, employee bios, etc...

The usage of custom post types is not exactly straight forward however. You have to be pretty comfortable working with your functions.php file and even then it is time consuming. Custom Post Type UI allows you to easily define and customize your post types through the Wordpress administration panel using a GUI. Clearly an essential plugin for Wordpress 3.0.

Download Custom Post Type UI Here

WP Post Type UI

Inspired by Custom Post Type this plug-in takes the same concept to the next level and gives you additional control and customization.

• True WP user interface look and feel
• Add/Edit/Delete dynamic "Post Types" and "Taxonomies"
• Search "Post Types" from name and description
• Search "Taxonomies" from name and "Post Type"
• Matching labels when creating records
• Shows post and active taxonomy count
• Advanced "Post Types" and "Taxonomies" options

Download WP Post Type UI Here

GD Taxonomies Tools

The ability to define custom tags and taxonomies opens up endless possibilities for Wordpress. We can now use Wordpress to develop custom taxonomies like colors, sizes, locations, etc... Again, list custom post types it can be a bit complicated to figure out and work with. This plugin adds many tools including custom post types and taxonomies management and widget for taxonomies terms cloud.

Download GD Taxonomies Tools Here

WP Multi Networks

While Wordpress Multi User has been around for awhile the new Wordpress 3.0 has merged the two versions of the site and allow the easy development of networks of sites. This plugin is able to turn your multi-site installation of WordPress into many multi-site networks, all surrounding one central user base.

WP Multi Network allows cape wearing super admins to create new network collections of sites, allowing for infinitely extensible site, network, and domain arrangements.

Download WP Multi Networks Here

WP Title 2

Once you take advantage of Wordpress custom post types and the menu management tool you are very likely to run into a situation in which you want the title of the page and the title used in the menu would be different. Some content management systems already take advantage of this and now with this plug-in Wordpress does too.

WP Title 2 lets you easily define a different menu label than your page title. This makes the site easier to administer and can improve usability of the site as well.

Download WP Title 2 Here

Post Type Switcher

Have an existing post that you want to change to a different custom post type? Rather than deleting and recreating simply use this plugin that gives you the capability to switch between posts, pages and custom post types.

Download Post Type Switcher Here

Multi Post Thumbnails

While post thumbnails were introduced earlier this is still a great plugin. If you have ever wanted the ability to have more than one post thumbnail than this plugin is for you.

Download Multi Post Thumbnails Here

Now pair Google Analytics with another free (and this time open source) solution like Wordpress and well, it is hard not to get a warm fuzzy feeling.

What you may not realize is that you can get a lot more out of this Google and Wordpress pair than simply sticking the tracking number into the footer. There are quite a few rocking Google Analytics plugins that really kick up the functionality of your Google Analytics up a notch. Check them out.

1. Google Analyticator

This is my favorite plug-in in this area. Not only does it add the javascript needed to start tracking your site, it turns your Wordpress site into a tracking monster! Rather than just tracking the normal "default" elements it also covers:

• Outbound link tracking of all links on the page, including links not managed by WordPress
• Download link tracking
• Event tracking with outbound links / downloads instead of the old pageview tracking method

It also has plenty of great additional features such as a dashboard widget, front-end visitor widgets, localization and more...

Download Google Analyticator Here

2. Ultimate Google Analytics

This plug-in is on par with Google Analyticator in that not only will it put the necessary google analytics javascript on every page, but it also will track outbound links, downloads and mailto: links. While the default configuration will work for 90% of the users it pays to go through and customize it for your own needs, everything is customizable for your specific situation or need.

The plugin is highly configurable. Read trough the list of features below to get a feeling of what this plugin can do. You can enable and disable all features individually, although the default configuration will suffice for 90% of the users.

Download Ultimate Google Analytics Here

3. RSS Link Tagger for Analytics

On many blogs the conversion point is getting new subscribers. Even with services like feedburner you don't always know what is most effective in getting new subscribers as there is no clear way to track an RSS subscription. However with RSS Link Tagger you can actually track your RSS feed using Google analytics to get a better idea as to what types of articles and posts are most effective in recruiting new subscribers.

Download RSS Link Tagger Here

4. Google Analytics for WordPress

Much like Ultimate Google Analytics and Google Analyticator this plugin automatically tracks and segments all outbound links from posts, comment author links, links within comments, blogroll links and other downloads. It even lets you track Adsense clicks! This plugin is great for tracking downloads as it allows you to specify what types of file prefixes should be used as downloads.

Download Google Analytics for Wordpress Here

5. Google Analytics Dashboard

This would be my favorite plugin for client sites. Rather than trying to teach your clients how to login and use Google Analytics (which is an extra step and cumbersome) this plugin puts a view of your analytics data right from your Wordpress dashboard.

Even for savvy users this plugin is a great way to keep track of your sites performance with out having to log into Google Analytics every day.

Download Google Analytics Dashboard Here

Minimalism is great for several reason, it puts more emphasis on what elements you DO keep on the site, it makes using the site easier and is distraction free.

One of the interesting trends that has come forward with the minimalist look is the use of simple and complete circles in web design. For some reason these were far from common through most of the history of web design. Maybe it is because it is so much simpler to design on the web using boxes and hard angles (due to the limitations of technology). Or maybe it is just a design trend that was popular in previous decades and is just now resurfacing.

Either way there are designers who are putting plenty of personality into their designs with a "circle accent." Take a look at the following:

1. Monk Design

2. Daring Fireball

3. Cool & The Guide

4. Tobiashlin

5. Design Schneider

6. Effektive Design

7. Thorsten Van Elten

8. 70 Folk

9. Mighty

10. MIX Online

11. Kha Hoang

12. Sort

13. Jax Vineyards

14. Things

15. iLTD

16. Extra Polish

17. Simon J. Hunter

18. Frank Chimero

19. Indextwo

20. Lecia

21. IO

22. Alex Cornell

23. Royale

24. Reknit

25. Concentric Studio

26. Mercy

27. Behind My Scenes

28. Oliver James Gosling

29. The Import

30. Digital Podge

31. Rebecca Berry

32. Jay Hollywood

33. Digital Mash

One of my main issues with most content management systems is that they are simply too large, bloated and complicated for 90% of the sites out there. They focus too much on functionality and not how it is executed. The result is bloated code, poor administrative interfaces and complicated configuration. With Wordpress this is not the case, out of the box you can build and manage a simple site and when needed you can extend it to do anything from run a social network, do e-commerce or work as a full functioning web application.

In order to fully harness Wordpress for my projects (and my company projects) it is critical that I have a clear and efficient understanding of what Wordpress can do. From there it is also important that my employees have the capability to develop with the Wordpress platform to make this happen. Now I could come up with a training program or try one of the off the shelf books (which I have read through and were not impressed), but I have found Digging Into Wordpress to be an excellent solution.

What You Get

Digging into Wordpress is available as a PDF download or as a print version. If you are like me and have no problem reading through a book on screen, the PDF version is an easy reference guide and has the added feature of searching and chapter click through. However I am sure there are plenty of people who would rather have a hard copy to reference while they are working away on their computer.

The book is a whopping 434 pages of content and on a broad level covers critical Wordpress concepts such as:

• How to set things up
• Building themes
• Keeping sites secure and optimized
• Making the most of Wordpress

More specifically the book has chapters on:

• Wordpress basics (how to install, optimize and maintain it)
• Setup and optimization (permalinks, categories and tags, publishing, users, themes and plugins)
• Building Wordpress themes (Theme files, page views, header, the loop, comments, sidebar, foots, functions & search)
• Advanced theme design (customizing the loop, sidebars, footers, side content, child themes, styling, widgets)
• Functionality (plugins, custom functions)
• Wordpress as a CMS (custom content, page templates, dynamic menus, roles & permissions, great Plug-ins)
• Working with RSS Feeds
• Comments and customizations
• Search Engine Optimization (duplicate content, permalinks, appeasing google, tracking)
• Maintenance (security, comment spam, upgrades, backups)
• Bonus Tricks (option panels, free themes)
• Wordpress Updates

As you can see the book is packed with just about anything you could possibly want to know about Wordpress. Well Beyond what I had the time to read and learn about my first time through, but I am sure there will be instances where I will need to know how to really customize my RSS output and this book will be the perfect reference manual to do so.

The Excellent Points

There are several incredible parts of this book regardless of your skill level. Having used Wordpress for about four years now I have gotten to a fairly high level of fluency, however I still found lots of great information about how to do things that I either didn't know how to do or wasn't even aware was possible. However there is plenty of great content for beginners as well, I was able to hand the book over to one of my new interns and by the end of a few days she had developed her first Wordpress theme. Considering it was the first "non-static" site she had ever worked with this was extremely impressive.

Additionally the book does a great job of not only teaching the technical elements of Wordpress, but also the practical elements as well. You will learn how to maintain, protect and optimize your blog for faster page loads, higher rankings and more stability. All of these are critical elements to the success of a site after it has been developed and launched (the longer portion of the site life cycle).

What Could Be Improved

The book is a huge wealth of information, that is for sure. However I wonder if this made it difficult to organize. There were more than a few points where the book seemed to jump around a bit in terms of the content and how it all fit together. The first chapter for example, seems to cover a bit of a variety of different topics that range from beginner to advance despite it's label of "Wordpress Basics." That being said I would rather have more information and have to hunt a little bit for it than getting a book that left me searching the internet for what I need to know.

Overall...

If you do ANYTHING in Wordpress you really should purchase this book. You will not find a more comprehensive reference guide or set of tutorials anywhere. The small cost of $27 will be outweighed by the time saved and the increased capabilities you will gain by reading through and understanding the book.

The Voices That Matter team contacted me about going and also wanted to provide an offer to readers of this blog for early bird registration. See the details below:

New Riders’ Voices That Matter: Web Design Conference, now in its fourth consecutive year, will take place June 28-29 in San Francisco and the timing couldn’t be better! Web design is undergoing an historic transformation: while the basics of HTML, CSS, and JavaScript haven't changed, the new and evolving functionality in the HTML5 and CSS3 specs, the number of new ways in which people access the Web, and the rise of social media mean that Web designers need to know more than ever.

Don’t miss this opportunity to meet face-to-face with industry greats and discuss Web design’s most critical topics! We’ll open with a keynote address from Jesse James Garrett, author of The Elements of User Experience: User-Centered Design for the Web and close with a keynote address delivered by Steve Krug, author of the well known book Don't Make Me Think and the brand new book Rocket Surgery Made Easy: The Do-It-Yourself Guide to Finding and Fixing Usability Problems. From start to finish this conference will blow you away.

SPECIAL SAVINGS! As someone that reads this blog, you can save $150 off the conference fee by providing priority code WBNBLGA when registering. Register before May 14th and save $250 as this $100 discount is combined with the early bird pricing!

If you plan on going let me know so that I can plan to say hello and thank you for being a reader of this blog!

I have had to go the extra mile on a few projects in regards to security and Wordpress, and after a clients website got hacked it made sense to compile all the methods of securing Wordpress into one single document. Since Wordpress is open source, I figure I might as well make the document open source as well.

You can download the PDF version of the document here, or simply read through it below.

Server Level Security

1. Disallow bots from scanning the important Wordpress directories

By using the Robots.txt file it is always a good idea to block the wp-content, wp-admin, etc... directories. This can be done by adding the following line:

Disallow: /wp-*

2. Turn off directory browsing.

Many servers by default allow you to browse the listing of files with in a given directory. You may have come across this before when a page is missing or there is no index to a directory. The server outputs a listing of the files in the directory instead. This is particularly important in regards to plug-ins. If someone can see which plugins you have on your site they might be able to see which ones are venerable.

This can be done through your .htaccess be using the code below:

Options All -Indexes

3. Protect your wp-admin folder

The wp-admin folder is a critical security point with in Wordpress. Denying access to this folder (as well as the wp-config.php file) goes a long way to ensuring that your Wordpress site is secure.

This can be done in several ways and you may want to do all of them.

3.1 Limit access to your wp-admin folder by IP Address

If you know that you are on an IP Address that doesn’t change you can prevent any intruders by blocking every IP but your own. The drawback here is that if you are traveling, are off site or trying to update the site from a location that is not your typical one you will be denied access as well.

This can be done through your .htaccess by using the example code below:

<Limit GET POST PUT>
order deny,allow
deny from all
allow from 12.345.67.890
allow from 890.67.345.12
</Limit>

3.2 Limit access to your wp-admin folder through password protection

While not as secure as the IP Address method, it can be extremely effective to simply password protect your folder on the server level. This can also build upon the security enhancement of 3.1. For example if someone is able to spoof your IP address they still would need to hack your password to break in.

The easiest way to setup password protection is through the Wordpress htaccess Password Protect Plugin.

3.2 Limit access to your wp-admin folder by hiding it

There is no reason that your wp-admin folder has to be called wp-admin. Hackers look for this administration folder in this location. One easy way to eliminate hacking of your site and administration area is simply rename the folder to something else. Simple enough?

4. Protect your wp-config.php file

The password to your database is stored in plain, readable text in your configuration file (wp-config.php). Access to your database gives hackers control over your complete site, so to say you need to protect it is an understatement. The first and most obvious step is to ensure the permissions are set correctly.

Some servers set the wrong permissions by default which allows anyone who wants to the ability to read the contents of that file.

The permission should be set using SSH or through an FTP client to 640

chmod 640 wp-config.php

Additionally you can actually move the wp-config.php out of the main Wordpress directory and still have everything function properly. This way hackers don’t know where to look for the file. For example if your wp-config.php is located in /public_html/blog/wp-config.php you could move it to /public_html.

5. Install the 3G Blacklist

A lot of Wordpress installations are hosted on an Apache server. If your site is on an Apache server then you can improve the security (not just Wordpress) by installing the 3G Blacklist. The 3G Blacklist is:

“a concise, lightweight security strategy for Apache-powered websites...the 3G Blacklist serves as an extremely effective security strategy for preventing a vast majority of common exploits. The list consists of four distinct parts, providing multiple layers of protection while synergizing into a comprehensive defense mechanism.”

Find instructions and usage information on the 3G Blacklist here.

Wordpress Level Security

1. Remove the Wordpress version number from the META tags

Some hackers target specific versions of Wordpress because of known open venerability's.  An easy way to prevent your site from coming up as a target is to simply remove any indicators of the software version.

In older version of wordpress your theme file would hav the following code in the header.php that generates a simple tag that outputs the current version:

<meta content="WordPress &lt;?php bloginfo(’version’); ? /&gt;" name="generator" />

You can prevent this from being an issue by simply deleting that line of code.

Newer versions of Wordpress output the version automatically through the wp_head(); function. You can remove these by installing the Secure Wordpress plugin.

2. Disable the “Admin” account

By default Wordpress creates an “admin” account every time you install it. While the passwords are generated randomly it is never a good idea to let people know the login of your most powerful account. Because all Wordpress installations have the same username for the master account you are doing just that.

Simply changing the username from admin to something less obvious will improve the security of your site.

This will have to be done through the database as Wordpress won’t let you change or remove the account through the administration interface. The account is located in the wp_users table, and you can simply change the account name, display name, etc... to that of your choosing.

3. Change the Wordpress table prefix

All installations of Wordpress use the same name for all of the tables on the database. The problem with this is that if a hacker is able to use a SQL injection exploit they know exactly which tables to change data on. If you use an alternative prefix when you install the software this is prevented.

Already have a Wordpress installation? The WP Security Scan plugin can help you switch.

4. Use secure connections when connecting to the ADMIN pages

To prevent data being intercepted between your computer and the server hosting your website you can actually force a secure connection to all of the administration panels. This will require that you purchase and implement a SSL certificate from your host first, but once you have done this you can add the following code to your wp-config.php file to activate secure administration:

define('FORCE_SSL_ADMIN', true);

5. Use Security Keys

Wordpress doesn’t require that you take advantage of their “security key” tool that better encrypts cookies, there by better protecting your passwords. Using security keys is a simple process where you generate a key and make some simple modifications to the wp-config.php file.

You can generate Wordpress security keys on this website.

Wordpress Security Plugins

1. Login Lockdown Plugin

This simple plugin will record the IP address of every failed login attempt. If there are too many failed attempts from one IP address the login function will be disabled for that IP range. This prevents brute force password break-ins.

You can download the plugin here.

2. Invisible Defender Plugin

This plugin protects registration, login and comment forms from spambots by adding two extra fields hidden by CSS. The idea behind Invisible Defender is simple: SPAMBOTs either fill every form field they find (generic spambots) or fill WordPress-specific fields only (spambots which will recognise WP or are targeting WP only).

You can download the plugin here.

3. Maximum Security

You can perform and identify a lot of the problems outlined in this document automatically through this full featured and robust plugin. It can identify permission issues and has an intrusion protection system.

You can download the plugin here.

4. Secure Wordpress

Little help to secure your WordPress installation: Remove Error information on login page; adds index.html to plugin directory; removes the wp-version, except in admin area.

You can download the plugin here.

5. Secure Admin

Secures Login and Admin pages using Private or Shared SSL.

You can download the plugin here.

Security Best Practices

There are plenty of good security practices that you should follow that are not specific to Wordpress.

1. Pick your passwords wisely

The first step to being secure is to ensure your passwords are well formed. A strong password contains upper and lowercase letters, numbers, punctuation marks and are not a common dictionary word. This should be tested on every aspect of your website from your SFTP / FTP account, database password and user accounts.

You can test your passwords using this handy website.

2. Only use secure connections

Most website owners and developers use FTP connections to access the files on their server. This is all good and fine except that the transmission is not secure and is open to security holes. Instead setup an SFTP account which will encrypt your connection and prevent stolen information.

3. Keep your software up-to-date

Any software should be updated as frequently as possible. Updates often fix security holes among other things (performance enhancements, new functionality, etc...) This certainly is the case with Wordpress. Now that the system has automatic upgrades there is no excuse to have out of date software.

This is not limited to the Wordpress core software either, you should also upgrade your plugins as often as possible as well.

4. Backup often

While it is not going to directly improve the security of your site, the only thing worse than getting your site hacked is getting it hacked with no way of restoring it. You should not only backup the actual files of the site but the database as well.

With the WP-DB-Backup plugin you can automate this process and even have it e-mail a copy of the backup to you on a regular schedule.

You can download the plugin here.

Have a hard core an intensive Wordpress site? You can even backup the important parts of your Wordpress installation to Amazon S3 servers through the WP S3 Backups.

You can download the plugin here.

5. Secure your MySQL Database

Not specific to Wordpress but you can make a lot of strides to improving the security of your MySql database server. I won’t go into the specific details in this document but you can get more than enough information from this detailed website.

Anything Else?

Did I miss something? Have any better ways to perform any of the security items I mentioned? Feel free to leave them in the comments and I will update the post!

According to the release notes the new version has the following new features:

• Insane new SEO controls and detail
• Options Manager
• Completely reorganized options pages
• Increased efficiency from every angle
• Include a slew of JavaScript libraries!
• New home page controls
• Flexible new comment system
• Easy 301 redirects for affiliates!
• New hooks
• New headline filter
• Beefed-up internationalization
• Improved core element defaults
• Dramatically improved code quality

Quite a long feature list, I will be installing the new version on a few sites later today to check them out in more detail.

If you are interested check out the Thesis site for more information.

To say that the golden rectangle is powerful is an understatement. Powerful and skilled designers can use this ratio to improve their designs dramatically, and what is amazing about it is that people won't be able to directly place their finger on how or why the design is so effective.

The Golden Rectangle Explained

The golden rectangle is a rectangle with its sides in the 'Golden Ratio' or 1 : 1.618. Where most people get this wrong with they might account for the ratio to divide a canvas horizontally (ie: into two columns) but they don't account for the fact that the ratio also specifies a height (vertical divisions). Failing to account for the vertical ratios will reduce the impact and effect of using this tool for visually pleasing designs.

The Photoshop Guide

To make it easier to use this principal we have created a simple tools that lays out a golden rectangle and it's divisions (on all four corners) that you can overlay onto any of your designs. While it is originally designed for a 960 pixel wide canvas, it was created using vector shapes so it can be easily re-sized to any dimension with out losing any quality.

It also is organized based on folders so you can hide / show any portion of it to best fit your design needs.

Downloads and Suggestions

I am open to all suggestions, thoughts or improvements. I am releasing this under the creative commons, so if you choose to post it somewhere or repurpose it please do the right thing and at least attribute me with a link (or two).

Download the golden selection PSD guide here and let us know what you think!