Category: WordPress Plugins

  • Display Markup on WordPress

    To display a Markup file inside a WordPress page, you can use the Markdown block or a Markdown editor plugin. For the Markdown block, navigate to the page or post editor, click the plus icon, and search for “Markdown” to add the block. Then, you can write your Markdown code directly in the block.

    Alternatively, you can use a Markdown editor plugin like WP Markdown Editor (formerly Dark Mode). To install a Markdown plugin, go to Plugins > Add New, search for “Markdown,” and install the desired plugin. Once installed, you can use the plugin to write and edit Markdown content on your posts and pages.1

    For adding schema markup, you can use custom fields. Navigate to the post or page where you want to add the schema, click on Screen Options, and check ‘Custom Fields.’ Then, create a new custom field named ‘schema’ and enter your JSON-LD code. After adding the custom field, you’ll need to edit your header.php file to ensure the schema code is loaded with your post metadata.3

    WordPress Markdown Editor
    wordpress.comMarkdown Block – WordPress.com Support
    hostinger.comWhy You Need WordPress Schema Markup and How to Add it to Your Site
    wordpress.comCustom HTML block – WordPress.com Support
    How to display Markdown files from other sites in WordPress – Christian Specht

    When I created the pages for my existing projects on this blog, I decided that I’d prefer to directly display the content of the readme files from Bitbucket (where all of my projects are hosted), instead of just copying the content.

    How to Style Using Markup

    To see the full range of Markdown formatting, see Markdown Extra.

    from https://wordpress.com/support/wordpress-editor/blocks/markdown-block/

    Markdown SyntaxOutput
    **Bold Text**Bold Text
    *Italic Text*Italic Text
    [Link](https://example.com)Link
    # Header 1Header 1
    ## Header 2Header 2
    - List Item• List Item
    1. Numbered Item1. Numbered Item
    `Inline Code`Inline Code
    `Code Block`Code Block

    For example, in Markdown, to emphasize a word, you wrap it with an asterisk on both ends, like this: *emphasized*. When your writing is published, it will look like this: emphasized. Similarly, two asterisks denote strong text: **strong** will be published as strong.

    To indicate links, use regular and square parentheses. Wrap the text you want to link in square parentheses, and immediately after it, insert the link target wrapped in regular parentheses. The actual Markdown could look like this: [WordPress.com](https://wordpress.com/). When published, it will be a standard link: WordPress.com.

    Writing with markdown. On the left: using Markdown to compose a post in the fullscreen editor. On the right: The published post.
    Examples of Markdown formatting. Note: that should be “# Writing with Markdown” to have it show as a H1

    The original Markdown text you write will always remain in Markdown, so you can go back and edit it using Markdown. Only the published document – the post or the page – will be converted. If you write a post in Markdown, it will be published as a fully formatted post on your blog, but when you go back and edit it, it’ll still be in Markdown.

    /markdown

  • How to Integrate Site Editing Navigation Block with Elementor (Free Version) Page Header, in WordPress 6.5+

    TwentyTwentyFour child theme, Site Editor, Navigation, I have a menu defined.

    I was looking for a way to have that menu display in the free version of Elementor, in the page header.

    The first solution I found that looked good was the Elementor Header & Footer Builder plugin. It isn’t perfect, so when I find a better solution I’ll make a note here.

    Elementor Header & Footer Builder wants to use the old-style menus. There is no Appearance, Menus anymore — that is not for WordPress 6.5.4 block themes. (It is, of course, still the way to use menus for classic themes).

    When in Elementor Header & Footer Builder I try to add a Navigation Menu, EHFB (at least June 2024) gives you an error on screen about nav-menu.php and says “Your theme does not support navigation menus or widgets.”

    How do I get a header in Elementor Header & Footer Builder with a menu, since Navigation blocks are not available?

    Temporary workaround

    Install Max Mega Menu https://wordpress.org/plugins/megamenu/ which adds Appearance, Menus and a menu editor, so the Elementor Header & Footer Builder’s Navigation Menu works.

    You might also want to make a Mega menu. I haven’t tried that, but it looks like a nice plugin.

    What’s Next?

    Since the documentation and the support explanations for EHFB are terrible, please let me know if you find a plugin that is better, specifically for reading the Site Editor’s Navigation blocks and importing them into the format Elementor or this Elementor header/footer plugin want.

  • Optimizing Wordfence Settings for Enhanced WordPress Security: A Configuration Guide

    Introduction to Wordfence

    As a WordPress website owner, one of your top priorities is ensuring the security of your site. This is where Wordfence comes in.

    Wordfence is a comprehensive security plugin for WordPress that provides a range of features designed to protect your website from hacks and malware. It offers a Web Application Firewall (WAF) that identifies and blocks malicious traffic, a malware scanner that checks core files, themes, and plugins for malware, bad URLs, backdoors, SEO spam, malicious redirects, and code injections, and a suite of additional features like live traffic monitoring and login security.

    Wordfence is designed to be user-friendly, even for those who aren’t tech-savvy. It’s easy to install and set up, and once it’s running, it works in the background to keep your site secure, giving you peace of mind and letting you focus on what you do best – creating great content and engaging with your audience.

    Now, let’s dive into how to access and navigate through the Wordfence settings to ensure optimal security for your WordPress site.

    Accessing Wordfence Settings

    To access the Wordfence settings page, follow these steps:

    1. In your WordPress dashboard, locate the main menu on the left-hand side.
    2. Click on “Wordfence”. This will open a sub-menu.
    3. In the sub-menu that appears, click on “All Options”.

    And there you have it! You’re now on the Wordfence settings page, where you can configure Wordfence to best protect your site.

    Wordfence License

    No configuration needed.

    View Customization

    • Check the box for “All Options” menu item for easy access.
    • Disable “Blocking” or “Live Traffic” menu items as they are not frequently used.

    General Wordfence Options

    • Update Wordfence automatically: Enable this for automatic updates.
      Note: If you’re using a LiteSpeed server, you will get a message to ensure the “noabort” environmental variable is set. Ask your website hosting company how you should (or better still, how they should) configure this.
    • Where to email alerts: Enter the email address of your webmaster or whoever should receive technical emails about security issues and plugin updates. You can add multiple email addresses separated by commas.
    • How does Wordfence get IPs: Use the recommended setting. If there’s a discrepancy between the “Detected IP(s)” and “Your IP with this setting”, contact your hosting company or technical person.
    • Look up visitor IP locations via Wordfence servers: Keep this enabled.
    • Hide WordPress version: Keep this enabled to make it harder for hackers to know your WordPress version.
    • Disable Code Execution for Uploads directory: This is crucial for security. It prevents anything in your uploads directory from being executed, protecting against potential malware uploads.
    • Pause live updates when window loses focus: Enable this to conserve server resources.
    • Update interval in seconds: A setting of 2 is good, but longer might be better.
    • Bypass the LiteSpeed “noabort” check: This is only needed if your server uses the LiteSpeed cache. Check with your hosting company about the LiteSpeed settings.
    • Delete Wordfence tables and data on deactivation: Leave this unchecked unless you’re deleting the Wordfence plugin and want to delete the data. (No, you don’t want to delete the Wordfence plugin!)

    Dashboard Notification Options

    • Updates Needed (Plugin, Theme, or Core): Enable this to stay informed.
    • Scan Status: Enable this to stay informed.

    Email Alert Preferences

    • Email me when Wordfence is automatically updated: Uncheck this unless you want to be notified.
    • Email me if Wordfence is deactivated: Check this. WordFence should never be deactivated without your knowledge.
    • Email me if the Wordfence Web Application Firewall is turned off: Check this. The firewall should always be active.
    • Alert me with scan results of this severity level or greater: Set this to Medium to avoid an overload of low-level alerts.
    • Alert when an IP address is blocked: Don’t enable this as your website likely blocks several IP addresses every hour.
    • Alert when someone is locked out from login: Enable this. It could be a customer who forgot their password or a hacker.
    • Alert when someone is blocked from logging in for using a password found in a breach: Enable this. It could be a customer who needs to be informed about the importance of using unique passwords.
    • Alert when the “lost password” form is used for a valid user: Enable this. It’s a common hacker trick to request a password reset.
    • Alert me when someone with administrator access signs in: Disable this if you regularly check for unauthorized administrator access.
    • Only alert me when that administrator signs in from a new device: Enable this. A new device in a different part of the world could indicate a stolen password.
    • Alert me when a non-admin user signs in: Disable this. You want people to be able to sign in.
    • Only alert me when that user signs in from a new device: Disable this unless you know your users well enough to tell if this is from a different part of the world.
    • Maximum email alerts to send per hour: Set this to 2. You don’t want to be overwhelmed with emails.

    Activity Report

    • Enable email summary: Set this to “Once a week” and review it every time. Get to know what a “normal” one looks like so you can spot anything unusual.
    • List of directories to exclude from recently modified file list: Exclude directories that you know are okay, such as those used by a plugin for its CSS files.
    • Enable activity report widget on the WordPress dashboard: Enable this on most sites, but disable it on sites where you want to minimize plugin resources.

    Basic Firewall Options

    These sometimes require account-level changes. Work with your technical support person and hosting company.

    • Web Application Firewall Status: When first installing Wordfence, set this to “Learning Mode”. After a learning period, Wordfence switches to “Enabled and Protecting”. Set this to the default that Wordfence suggests, most likely 7 days from now.
    • Protection Level: Enable Extended Protection.
    • Real-Time IP Blocklist: This is a premium feature. Free accounts have an IP Blocklist from the Wordfence network that is not updated as frequently.

    Advanced Firewall Options

    • Delay IP and Country blocking until after WordPress and plugins have loaded (only process firewall rules early): Leave this un-set.
    • Allowlisted IP addresses that bypass all rules: You shouldn’t need to bypass all rules for any IP addresses. If necessary, you can bypass a specific rule.
    • Allowlisted services: Enable for Sucuri and Facebook. Also enable for Uptime Robot, StatusCake, and ManageWP if you use these services. Enable for Seznam Search Engine if desired.
    • Immediately block IPs that access these URLs: You likely won’t need to specify any URLs here. Let Wordfence block via its normal methods. Keep these IP lists short, if not empty.
    • Ignored IP addresses for Wordfence Web Application Firewall alerting: This could be your IP address, but only while you are testing something on your site.
    • Rules: Leave all rules turned on unless advised otherwise by a Wordfence support person.
    • MANUALLY REFRESH RULES: This lets you get the latest rule set, even if you have the free version of Wordfence. Do this before running a manual scan.

    Brute Force Protection

    • Enable brute force protection: Always enable this.
    • Lock out after how many login failures: Lower this to 10. If you can’t get your password right in 10 tries, you’re doing it wrong.
    • Lock out after how many forgot password attempts: Set this at 5. This is how many times your “Forgot password?” form can be used.
    • Count failures over what time period: Set this to 4 hours. Some hackers try to fool website security by spreading out their attempts, so increasing this to 1 day is fine too.
    • Amount of time a user is locked out: Set this to 12 hours. Some hackers will try passwords rapidly, so this really thwarts them.
    • Immediately lock out invalid usernames: Enable this. The list of “invalid usernames” should include “admin”, “administrator”, “webmaster”.
    • Prevent the use of passwords leaked in data breaches: Set this to ‘For all users with “publish posts” capability’.
    • Enforce strong passwords: Set to ‘Force admins and publishers to use strong passwords’.
    • Don’t let WordPress reveal valid users in login errors: Enable this to make guessing your login much harder.
    • Prevent users registering ‘admin’ username if it doesn’t exist: Enable this to avoid confusion and potential security issues.
    • Prevent discovery of usernames through ‘/?author=N’ scans, the oEmbed API, the WordPress REST API, and WordPress XML Sitemaps: Enable this to make password crackers have to guess your login name.
    • Disable WordPress application passwords: Enable this. Application passwords allow a third-party site or application to access your site as your own login, but with a separate password.
    • Block IPs who send POST requests with blank User-Agent and Referer: Enable this. All web browsers and services are supposed to say “who they are” and what URL they are referred by.
    • Custom text shown on block pages: Leave this blank unless you want to give some message when a visitor gets blocked.
    • Check password strength on profile update: Enable this. This notifies you if someone is using a weak password. You can then train them to use strong passwords.
    • Participate in the Real-Time Wordfence Security Network: Enable this. This lets Wordfence on your site take advantage of knowledge from the entire network, especially bad IP addresses and malware detection.
  • Plugins and Tools to Install for Every WordPress Site

    Here is the wp-cli command to install my list of “always install” plugins (see below for “in WordPress” installing):

    wp plugin install --activate --skip-plugins --skip-themes accessibility-checker ai-engine akismet autodescription flamingo google-site-kit instant-images media-library-assistant redirection relevanssi svg-support the-seo-framework-extension-manager ultimate-addons-for-gutenberg updraftplus wpforms-lite wp-mail-smtp ws-form

    If you edit themes, child themes, theme.json

    wp plugin install --activate --skip-plugins --skip-themes wppusher

    WPPusher loads your theme from your GitHub account, if you don’t want to use Git to load it.

    For most online stores

    wp plugin install --activate --skip-plugins --skip-themes cartflows surecart

    CartFlows is for tracking how people use your site, “flow” from page to page during the shopping process. You can find out if something in the shopping process isn’t working, or can be improved. You can send reminders when people have something in their shopping cart but don’t purchase.

    SureCart is a simpler, faster online store than WooCommerce is. You will likely find SureCart is much easier to set up, unless you have a more complex store than most people would need.

    For online courses

    Install the plugins for online stores and:

    wp plugin install --activate --skip-plugins --skip-themes lifterlms

    For complex online stores

    If you run a store needing product variations, multiple currencies, multiple shipping options, multiple sales tax zones, use WooCommerce instead of SureCart.

    wp plugin install --activate --skip-plugins --skip-themes woocommerce woocommerce-payments woocommerce-paypal-payments

    For site security, use WordFence and a password manager.

    A password manager aka password keeper, can store any information you want to keep encrypted and want to access online, with structured fields for things like FTP connections, SSH keys, credit cards, software licenses.

    Password keeper is probably included with your Windows anti-virus software.

    For OS/X and Linux, any of the free password keepers will work. (And install a free anti-virus program, to scan occasionally for files with Windows viruses; you don’t want to give those files to anyone else.)

    The Best Antivirus Software for 2023 | PCMag
    The Best Free Antivirus Software for 2023 | PCMag

    The password keeper I use is LastPass. LastPass is cross-platform, free version probably has everything you need, paid version is inexpensive and has access from multiple devices (e.g. desktop computer and mobile phone). I rarely need it on my phone, so I use phone’s web browser instead of the phone app.

    For Manual Installing in WordPress

    These are the plugins I install on almost every WordPress site.

    accessibility-checkerAccessibility CheckerAudit and check your website for accessibility before you hit publish.
    In-post accessibility scanner and guidance.
    ai-engineAI Engine: Chatbots, Generators, Assistants, GPT 4 and more!Add AI into WordPress! Chatbot (ChatGPT), content and images generators, copilot, model training and much more! Highly customizable, sleek UI. You will love it!
    akismetAkismet Anti-spam: Spam ProtectionUsed by millions, Akismet is quite possibly the best way in the world to
    protect your blog from spam. Your site is fully configured and being protected, even while you sleep.
    cartflowsCartFlowsCreate beautiful checkout pages & sales flows for WooCommerce.
    flamingoFlamingoA trustworthy message storage plugin designed for Contact Form 7. But it works great with most form plugins or forms in page builders.
    instant-imagesInstant ImagesOne click image uploads directly to your media library from Unsplash,
    Openverse, Pixabay and Pexels.
    lifterlmsLifterLMSComplete e-learning platform to sell online courses, protect lessons, offer
    memberships, and quiz students.
    media-library-assistantMedia Library AssistantEnhances the Media Library; powerful mla_gallery, mla_tag_cloud, mla_term_list, taxonomy support, IPTC/EXIF/XMP/PDF processing, bulk/quick edit.
    media-syncMedia SyncSimple plugin to scan uploads directory and bring files to Media Library.
    phoenix-media-renamePhoenix Media RenameThe Phoenix Media Rename plugin allows you to simply rename your media files, once uploaded.
    redirectionRedirectionManage all your 301 redirects and monitor 404 errors
    regenerate-thumbnailsRegenerate ThumbnailsRegenerate the thumbnails for one or more of your image uploads. Useful
    when changing their sizes or your theme.
    relevanssiRelevanssiThis plugin replaces WordPress search with a relevance-sorting search.
    google-site-kitSite Kit by GoogleSite Kit is a one-stop solution for WordPress users to use everything
    Google has to offer to make them successful on the web.
    ultimate-addons-for-gutenbergSpectraThe Spectra extends the Gutenberg functionality with several unique and
    feature-rich blocks that help build websites faster.
    surecartSureCartA simple yet powerful headless e-commerce platform designed to grow your business with effortlessly selling online.
    I prefer it over WooCommerce for all but the most complex stores.
    svg-supportSVG SupportUpload SVG files to the Media Library and render SVG files inline for
    direct styling/animation of an SVG’s internal elements using CSS/JS.
    autodescriptionThe SEO FrameworkAn automated, advanced, accessible, unbranded and extremely fast SEO
    solution for your WordPress website.
    the-seo-framework-extension-managerThe SEO Framework – Extension ManagerAdd more powerful SEO features to The SEO Framework. Right from your
    WordPress dashboard.
    updraftplusUpdraftPlus – Backup/RestoreBackup and restore: take backups locally, or backup to Amazon S3, Dropbox, Google Drive, Rackspace, (S)FTP, WebDAV & email, on automatic schedules.
    woocommerceWooCommerceAn eCommerce toolkit that helps you sell anything. Beautifully.
    (I prefer SureCart for all but the most complex stores.)
    woocommerce-paypal-paymentsWooCommerce PayPal PaymentsPayPal’s latest complete payments processing solution. Accept PayPal, Pay
    Later, credit/debit cards, alternative digital wallets local payment types
    and bank accounts. Turn on only PayPal options or process a full suite of
    payment methods. Enable global transaction with extensive currency and country coverage.
    woocommerce-paymentsWooPaymentsAccept payments via credit card. Manage transactions within WordPress.
    wpforms-liteWPForms LiteBeginner-friendly WordPress contact form plugin. Use our Drag & Drop form
    builder to create your WordPress forms.
    I usually use WS Form LITE.
    wp-mail-smtpWP Mail SMTPReconfigures the wp_mail() function to use Gmail/Mailgun/SendGrid/Brevo/SMTP instead of the default mail() and
    creates an options page to manage the settings. Those email hosts will get your emails delivered better than any website host will, with full validation that you are the authorized sender.
    wppusherWP PusherPain-free deployment of WordPress themes and plugins directly from GitHub.
    ws-formWS Form LITEBuild Better WordPress Forms. Designed for low resource use, at enterprise-level demands.
    wordpress-seoYoast SEOThe first true all-in-one SEO solution for WordPress, including on-page
    content analysis, XML sitemaps and much more. (I prefer The SEO Framework)
    The plugins I use, with their wp-cli name, title, and description.
  • GPLDL free vs Donate vs GitHub

    AstraPro – GPLDL donate (but same company makes Spectra One theme and Spectra Page Builder, free and oh so close to the same features).

    LearnDash – GPLDL donate ($15 one month GPLDL Premium Membership, a total of 200 Downloads; or $100 for a year)

    Yoast SEO – GPLDL free, all paid add-ons
    But look into SEO Framework – Fast, Automated, Effortless it has a much easier user interface.

    CartFlows WooCommerce Checkout & Funnel Builder by CartFlows – Create High Converting Stores For WooCommerce
    CartFlows Pro WooCommerce Extension, GPLDL free
    CartFlows – WooCommerce Cart Abandonment Recovery Extension, GPLDL free

    Jordy Meow – AI Engine: Chatbots, Generators, Assistants, GPT 4 and more!
    AI Engine ChatGPT Chatbot, Content Generator, GPT 3 – 4, Ultra-Customizable (Pro) WordPress Plugin – GPLDL Donate. I love the free version.

    Sensei LMS Premium WordPress Plugin (by Automattic) and extensions, GPLDL free

    LifterLMS Get Free Plugin https://lifterlms.com/free/ (only manual payments) or $199/yr with support and Ecommerce Add-Ons for Stripe, PayPal, or WooCommerce

    LifterLMS not on GPLDL

    Other plugins in the LifterLMS GitHub, either theirs or related, that I’m interested in (there are many more): 

    lifterlms https://github.com/gocodebox/lifterlms

    lifterlms-lite-lms-progress-tracker https://github.com/gocodebox/lifterlms-lite-lms-progress-tracker

    lifterlms-blocks WordPress Editor (Gutenberg) blocks for LifterLMS. https://github.com/gocodebox/lifterlms-blocks

    lifterlms-cli CLI commands for LifterLMS https://github.com/gocodebox/lifterlms-cli

    Facebook-Pixel-for-Wordpress Forked from facebookincubator/Facebook-Pixel-for-Wordpress A plugin for advertisers who use WordPress to enable them easily setup the facebook pixel. https://github.com/gocodebox/Facebook-Pixel-for-Wordpress

    camptix Forked from Automattic/camptix Simple and Flexible WordPress ticketing plugin brought to you by WordCamp.org https://github.com/gocodebox/camptix

    markdown-html Forked from pwlmaciejewski/markdown-html Command line tool for markdown to html conversion. https://github.com/gocodebox/markdown-html

    action-scheduler Forked from woocommerce/action-scheduler Action Scheduler for WordPress and WooCommerce https://github.com/gocodebox/action-scheduler

    AffiliateWP Forked from JustinSainton/AffiliateWP Affiliate plugin for WordPress https://github.com/gocodebox/AffiliateWP

    lifterlms-surveymonkey https://github.com/gocodebox/lifterlms-surveymonkey

    Chart.js Forked from chartjs/Chart.js Simple HTML5 Charts using the <canvas>