Website Tech

Category: WordPress Consulting and Computer Help for Small Businesses

Migrated content from computerhelp.lc.lndo.site

  • Adding a Second Login to WordPress

    Logging in to WordPress is at the application level. You can also have a server login before getting to WordPress. This 2-step login makes your site much more secure.

    Once you know how, adding this server login is actually quite easy to do.

    Unlike plugins that might change parts of WordPress itself, this doesn’t change anything about WordPress; this uses the server’s security, so only people you say are permitted to execute programs.

    The most important folder to protect is wp-admin/ since it has, obviously, all the administrative programs for WordPress. Or, you can protect the wp-login.php file.

    One essential step is generating an encrypted version of the password you want to use. Then you have to know where to install the encrypted password, and how to tell your server to require the password for the files you want to protect.

    See my .htpassword tool for instructions and an easy way to generate the encrypted password your server would use.

  • PHP Accessing SSH functions

    If you don’t have SSH on your hosting account, here’s how you can do many of the Bash script functions, from within PHP.

    Alternatively, all the good Bash commands you do repeatedly, could be translated into a PHP program to do the entire sequence of steps automatically.

    I’m only showing ls and mysql --help but you could use any Bash script command that is supported in your hosting account.

    Go to my PHP site to see PHP Accessing SSH in action.

    Here’s how to have a Bash shell script run directly via a URL, see lc.lndo.site/date.sh:

    Here’s the Bash shell script referenced: (more…)

  • What Does “Unlimited” Hosting Mean?

    When you are searching for hosting accounts, you will often see “unlimited disk space” and “unlimited bandwidth” as top features. A few years ago, hosting providers would give you a clear limit on how much space and bandwidth they would give you; if you exceeded either one, your hosting provider would either a) charge a lot for more space or bandwidth, usually without even having sent you a message you were approaching your limit, or b) shut down your hosting account, again usually without warning. So “unlimited” was a really good thing.

    What Does “Unlimited” Mean?

    It means if you are using your hosting account for hosting a normal personal or small-business site, they don’t monitor your disk space or traffic. It doesn’t mean you can host a file sharing service for thousands of customers, or host thousands of hours of video for a movie rental business or porn site, or have millions of site visitors like a large business would.

    If you show up on their list of accounts using the most server resources, you may get instructed to reduce your usage. These resources include disk space, bandwidth (how many bytes are transferred and/or transferred at once), memory or CPU usage (a program running out of control), number of files stored (huge number of files slows down the server since the file index gets enormous, and operating systems limit how many files can be on a single hard drive).

    Host Gator says it this way:

    There are no set limits on the disk space or data transfer (bandwidth) that we provide in our shared and reseller hosting plans. We want you to have the resources you need to build a great online presence.

    That being said, we do require all customers to be fully compliant with our Terms of Service and utilize disk space and bandwidth in the normal operation of a personal or small business website. While it is rare, we may need to put constraints on accounts that are using resources that impact other customers on the same server.

    Typically, customers only run into issues if they use their accounts for storage or file sharing, which is not what our services are intended to support. In accordance with our Terms of Services the disk space and bandwidth you use must be integrated into the normal operation of your website.

    For Example, customers who are affecting other clients or are using 25% or more of system resources for longer then 90 seconds would be in violation. Please see our TOS or contact us for complete details and restrictions.

    If you need more bandwidth or disk space, pay your hosting provider for the extra amount you need. Don’t flame your hosting provider about “they said unlimited” when you’re using more resources than 99.9% of their customers. (more…)

  • Posting to Multiple Sites

    Generally writing the same thing on more than one of your sites is not such a good idea.

    But especially if you have custom post types, for example for products that you are selling, they may make perfect sense on more than one of your sites.

    With WordPress Multi-Site, making more than one site (in the same installation of WordPress) is very easy.

    How do you put a post on more than one site? Of course you can copy and paste the main text, and then manually enter all the other settings for the post (for example, SEO settings, and the many settings for your shopping cart system), but is there a better way?

    There is a Multi-Post plugin, http://wordpress.org/extend/plugins/multipost-mu/ but warning this plugin is no longer updated, probably should look for another.

    “Allow a WordPress MU site administrator to duplicate posts and pages to multiple sub-blogs at once.”

    Gives a simple list of checkboxes on the Post/Page edit page, for which other sites to also post to.

    Modify the Original page, and the copies reflect the change. Modify the copied one, and it is generated as a separate post, no longer linked.

  • Allow Multisite Administrator Rights to Individual Site Owners?

    I have a client (actually their IT guy) who is asking for “FTP” access to their WordPress site. He is saying the “client” admin role we have given him doesn’t allow him access to changes he wants to make for SEO, plugins, etc. Is this possible in our Multisite installation set up? We can’t give him the same Admin permissions we have because he would have access to all the sites.

    Absolutely no FTP access to the WP server. (Maybe give them FTP access to a very limited folder, but they can upload files directly from WordPress, it has media import features).

    One of the huge benefits of WordPress in Multi-Site mode is you as the Super-administrator control whether Administrators can install plugins and themes. (Installing plugins and themes are key source of security holes, system crashes, trouble.)

    SEO by Yoast is well recommended, and I’ve been using All-In-One SEO.

    There is an option where you can allow individual site administrators to enable plugins, from among the plugins that are installed by you.

    In /wp-admin/network/settings.php you can “Enable Admin Menus” that let a site owner change which of the installed plugins are activated.

    In /wp-admin/network/users.php, hover over a user and click Edit, to “Grant this user super admin privileges for the Network.” (use this for people in your company who are developers, never for customers)

    Normally users can only be Admin only for the sites where they are registered. See http://codex.wordpress.org/Roles_and_Capabilities for a Summary of Roles. Notice the differences in Roles for Multisite vs single site.

    Administrators in Multisite can activate plugins and change settings, but not install or update them. Create a user with Administrator rights for a site (do this logged in as a Super-Administrator), experiment with what they can access.

    If you really need more flexibility than the default, which I doubt, try the User Role Editor WordPress plugin.

  • Security for Hosting Accounts, for WordPress Sites

    There are many things you can do to make WordPress itself more secure, and I’ll cover those in another post.

    The first level of security for WordPress should be your hosting account, done at the server. But with almost all hosting providers, you have to install security; good security almost never comes with the hosting account — most hosting providers don’t know security, they know how to provide an account that matches everyone’s basic needs.

    There are major hosting companies that literally think they have good security because they have an armed guard outside their server room. Companies like these tend to have outdated server software; haven’t installed dedicated security software and dedicated someone to monitoring international security discussion groups for issues, haven’t done anything to counter these new issues.

    A few companies, such as Sucuri can help you identify if your site is compromised, and clean up the malware. You still should have good security in place, to prevent as many attacks as possible.

    You will likely have to make some exceptions to any security system, to allow requests for some of your pages. For example, ‘administrator’ is a common word targeted by hackers (for example, trying to get into database administrator tools), but also is legitimate for several non-computer web site topics.

    You can block bad people from accessing your site through bad characters or phrases in several places in the URL, (including some you might not expect); or through bad cookies, that you might not even see.

    You could detect them by the User Agent they use (though the smarter ones pretend they use a normal browser, many use the User Agent to brag about who they are).

    You could try to block them by their IP address, but hackers know how to constantly change their IP address, so this is a wasteful approach. You would have to constantly be updating your ‘banned IP’ list, and having your server check through the huge list for every request, just slows down your entire web site.

    Security experts have identified some very common methods of attacks, and nuisances that waste your server resources — and come up with very effective ways to block them.

    I added having my server keep a log of what pages where blocked And Why (what phrase or trick was thwarted by my security systems, and what part of the security script caught their foul deed) — so if the security is blocking requests for a real page on your site, you can easily make an exception to the rule, leaving the protection in place for all other pages on your sites.

    This is a big deal. When an important part of your site is blocked, you might not even know about it. Then you want to fix it quickly, not having to somehow guess right (literally, in the past I had to try removing large pieces of a security system, to hope one of the pieces was to blame, not a combination of security rules). Trying to fix a problem ‘blind’, in a very detailed technical part of your web site, under pressure, is No Fun.

    I’ll be writing how to stop each type of bad trick hackers play, so you understand how it works; and if you know .htaccess fairly well you can implement the security and reporting yourself.

    If you don’t know .htaccess well, or just want me to take care of it for you, contact me and I can probably set it up for you.

    You don’t have to leave security for your WordPress sites up to luck. Stop those bad people before they damage your site.

  • Display embedded YouTube videos on iPhone

    Open the Settings app, under General find Restrictions. Set the YouTube app to On.
    Unless you did a “jailbreak” that interferes with YouTube, your embedded video should display.

    Embedded YouTube videos not working on your iPhone? Try this fix

    For embedding videos on YouTube, use HTML like this: (more…)

  • PHP Unzip bug makes WordPress Updates hang

    I have been having problems with WordPress Updates for a while. No error messages, just the WordPress Update, or WordPress Plugin Update, hangs.

    Then I found out that the WordPress backup plugin I am using, BackWPUp, failed if I configured it to use any compression.

    Then I found out that the problems I had been having with random-seeming 500 Server Errors was from the WP-Super-Cache plugin configured with, hmm, compression.

    WordPress Updates would create new folders, but no files in them.

    I wrote a PHP program, outside of WordPress, to test if the problem was in WordPress, or in the version of PHP used on my server.

    The problem is in PHP. The PHP unzip routines lock up. No error message on screen, in the PHP log, or in the system log.

    WordPress 3.6.0 and 3.6.1, Multi-Site, Apache, PHP Version 5.2.17, [HTTP_ACCEPT_ENCODING] => gzip, deflate

    PHP itself has a bug in Zip/Unzip in old versions. Hangs without any error message displayed or in logs. Affects WordPress Update, and Plugin/Theme Updates, and any plugins that use compression (e.g. WP-Super-Cache or BackWPup)

    PHP Change Log http://www.php.net/ChangeLog-5.php#5.3.4 says
    PHP Version 5.3.4 released 09-Dec-2010 – Fixed crash in zip extract method

    Note: PHP versions are numbered so version 5.3.10 is higher than 5.3.9 (5.3.1 is lower)

    (more…)

  • Robots.txt Tips

    Each web site you write should have a robots.txt file in the main folder, to suggest to search engines which folders you want them to not scan or index.

    You can make this file in any text editor (but not a word processor, must be plain text).

    Comments start with #, so the first line is for your information, specifying which web site this is for. Comments can be after any directive.

    The Sitemap line (can be anywhere in the file, but I put it at top) is a way to tell search engines the full URL where your site map is.

    The “User-agent: *” line says “for all User Agents, this is for you” (The User-agent normally would be browser type, e.g. Firefox or Chrome or IE, but search engines also tell web servers some User Agent.)

    # robots.txt for yoursite.com
Sitemap: http://www.yoursite.com/sitemap.xml

User-agent: *    # all search engines should ignore the folders Disallowed below

# Maybe have one folder for site images that shouldn't be indexed
# another for photographs you want indexed by search engines
Disallow: /images/
Allow: /photos/

# Here are more examples, use the folders that apply to your site:
Disallow: /cgi-bin/
Disallow: /freecontactform/
Disallow: /junk/
Disallow: /newsfeeds/
Disallow: /oldboring/

    You can exclude individual files this way (but probably simpler for you to put files into a separate directory):

    Disallow: /test/junk.html

    If you have WordPress on your site, include these lines:

    # WordPress
Disallow: /wp-admin
Disallow: /wp-includes
Disallow: /wp-content/plugins
Disallow: /wp-content/cache
Disallow: /wp-content/themes
Disallow: /category/*/*
Disallow: /comments
Disallow: */comments
Disallow: /feed
Disallow: */feed
Disallow: /manager
Disallow: /trackback
Disallow: */trackback
Allow: /wp-content/uploads

    (more…)

  • Screenshots on Windows, OS/X, iPhone, iPad, Android

    Windows:

    On Windows, you can take a screenshot of the currently active window by pressing Alt-PrntScrn (aka Alt-PrintScreen, hold down the Alt key, press PrntScrn, release both) and the screenshot is put in the Clipboard, open up any image program (I like IrfanView best, get it on http://download.cnet.com) or even Word or WordPad, press Ctrl-V to paste. To get the entire desktop (everything showing on screen) press PrntScrn instead of Alt-PrntScrn.

    To capture menus, including right-click menus, it is usually easier to grab the entire screen (press PrtnScrn) and then crop the captured image.

    OS/X:

    On OS/X there are several keystrokes, to get different portions of the screen. The keystrokes put the screenshot into a PNG file on your desktop (PDF in Mac OS 10.3 and earlier). If you want it put in your clipboard instead, add holding down the Ctrl key also, e.g. Command-Control-Shift-3. (Note: http://www.osxkeyboardshortcuts.com/keyboard-symbols.html has a chart of keyboard symbols and the easy-to-type names used in documentation.)

    Entire Desktop: Command-Shift-3
    A portion of the Desktop: Command-Shift-4, position the mouse at one corner of what you want to capture, click-drag to the opposite corner, when you release the mouse button the area will be captured.
    A specific application window: Command-Shift-4, space, move the mouse pointer over the application window you want captured, click the mouse.
    To include the mouse pointer or a menu in your screen shot: use the Grab utility by selecting Dock > Utilities > Grab. Set the Grab Preferences to use the cursor icon you wish to have in your screenshot.

    iPad, iPhone or iPod Touch

    Press and hold the menu button (the main button below the screen), press the power/lock button (the switch on the top edge of the device). The screen will flash white and make a camera shutter noise, to indicate the shot has been taken. Release both buttons (holding too long will give the power-down confirmation). The screenshot is saved in the default Photos app in the “Saved Photos” or (depending on your device) “Camera Roll” album. Email the photo by clicking the Menu icon (rectangle with arrow coming out of it, bottom left corner of screen). Or, click the Menu button from an index page to select multiple pictures to email.

    Android

    Different devices use different buttons, most use one of these button combinations: Power + Home, or Power + Volume Down. Mine requires holding down the Power + Volume Down for several seconds until the screenshot appears half-size on the screen.

    Open the Gallery application, the file is in the Screenshots album. In Android 4.2 and later, your screenshot will appear in your notication bar, to open it in Gallery or to Share it.

    There are apps for screenshots, make sure an app specifically supports your device. Generally they give you more control over your screen shot than the built-in screenshot function.

    You can connect your Android device to your computer, take the screenshot with your computer, see http://www.wikihow.com/Take-a-Screenshot-of-an-Android-Device-%28from-a-Computer%29

  • Should You Use WordPress as Single- or Multi-Site?

    I recommend Everyone with a business install WordPress in Multi-Site mode.

    You might think you only need one blog. You definitely should focus on a single business at a time, and I bet you will find good ways to use multiple WordPress sites.

    If you are a good writer, each book you write would have a blog specific to the book, and the questions people have about the book, and how they’ve used what they learned.

    Or you could market to different groups of your customers. Let’s say you have a course or coaching for single parents. Maybe marketing separately to single moms and single dads would be more effective, or maybe some things you offer would be best marketed to both. The only way to know is to Test, find out what actually works better. The best marketers know that what they think will work is rarely what actually works; they write ads and sales letters that use their knowledge of what makes a good ad, write many of them that each could work well, and let the people tell them which ads are best by responding to the ads. (more…)

  • Starting and Stopping Xampp (Apache, MySql) in Windows 7

    There is a lot of confusion on the support boards, people saying they can’t get Xampp to stop, there “must be a bug in Xampp”, or they “had to kill the application with Task Manager”. No, they are trying an incorrect method for closing a Windows Service.

    Some versions of Windows (including Windows 7) prevent applications from starting or stopping services; you should use the Windows Services program to manage services.

    In the “Xampp Control Panel Application”, you specify whether to run Apache and MySql as Windows Services (by checking the “Svc” box).

    If Apache *is not* running as a Windows Service:
    you use the Xampp Control Panel Application to stop and start Apache.

    If Apache *is* running as a Windows Service:
    you use Windows Services to restart Apache. (Start button, search for Services; or Start, Control Panel, Administrative Tools, Services). Click on the Apache service (the version of Apache you are running will be in the service name), then click “Restart the service”.