Website Tech

Tag: WordPress Multi-Site

  • Is WordPress Multi-Site More or Less Secure?

    When looking at site security, is using WordPress Multi-Site more secure than using multiple installations of WordPress (in single-site mode) on the same hosting account? Is Multi-Site less secure? One thing to remember is that they are the same software with some configuration options changed. You don’t install “new software” to change from WordPress to WordPress Multi-Site; you add database tables for each new site, that’s all. The “network management” screen becomes available when you are managing multiple sites, there is an additional login permission (network admin); but the software is identical files on your server.

    “The more plugins you have, the more security issues you potentially open up. If 1 plugin from 1 site lets in hackers, they take over the entire set of sites you have installed. Then, secondly, you run into security issues that may be less common, but can happen when a person registers on 1 site and is able to cross over to another site with admin based security holes. If the core directory gets hacked, all websites hosted together will contain the hacked files, likely phishing sites, making a hackers job 30x more powerful and easy (if you had 30 sites).” http://sethmatics.com/2014/03/multisite-multisite-question/

    Let’s look at that, one item at a time.

    I completely agree with the first two sentences: “The more plugins you have, the more security issues you potentially open up. If 1 plugin from 1 site lets in hackers, they take over the entire set of sites you have installed [in your WordPress Multi-Site installation].”

    All plugins have direct access to the WordPress database manipulation functions. Same with all themes. Get plugins and themes only from major trusted sources (there are some free ones). Check the reviews. Check the support area. If there are reports of security problems, have they been addressed quickly? (Or, on the other side, are the reports debunked? Any site can have false negative reports…).

    Similar argument about plugins and themes having full access to the entire file structure, on your whole hosting account. (Apache has had secured cross-account access for several years. If your host has ancient server software, throw a fit! And, move to a host with good server software, proper update procedures, and always use web hosting with strong attention to security.)

    You must keep updated, every installation of WordPress on your hosting account, including that one tucked away in some folder that you have forgotten about, so go in FTP and look through all your folders. Update all WordPress core, plugins, and themes. If a plugin or theme is no longer being supported, you won’t be notified about it, so look (in FTP) for moldy plugins/themes. (Old doesn’t mean bad, it could be a well-written plugin that hasn’t needed any updates. But if it was written for an old major release of WordPress, e.g. if the current version is WordPress 4.4.1, a plugin written for WordPress 4.0 is suspect and don’t use a plugin written for WordPress 3.9.)

    This applies equally to WordPress in single-site or multi-site mode. (If you have 30 single sites, aren’t you highly likely to have most of the plugins on each of your sites?)

    One place where this is a concern is if you are a hosting reseller for many clients, and you let clients install plugins or themes. I advise hosting each on their own hosting account, to limit the affect one client can have on the others. Take advantage of the cross-account security the host provides! Many hosts will let you charge the clients, and you pay the host, but you pay for multiple accounts. Security is complex; few clients who would “have you take care of it for them” are competent to pick good plugins and themes. One of your services should be “you pick good plugins and themes for them”; but if not, host them separately.

    “secondly, you run into security issues that may be less common, but can happen when a person registers on 1 site and is able to cross over to another site with admin based security holes.”

    If a hacker gets into the network admin account of a multi-site installation, they don’t need to “cross over to another site” to affect all the sites on this installation; they already Are the admin. (WordPress multi-site admin permission is only on a single site, unlike the network admin.)

    Any (single-site or multi-site) WordPress installation is a possible source of infection of any other on the same hosting account. All PHP files installed on your account (and any other programming language, including JavaScript and Perl and C# etc.) have full access to the file system and databases on your account. (Unless you have a hosting account that has taken specific steps to block that, which would normally be implemented as you having separate accounts with single-billing and a management interface for all of them.)

    Passwords: Never use the password for your network administrator account, for anything else on the network. Never use your admin password for an account that only needs “editor” privileges. Use a password keeper software, such as KeePass or LastPass.

    Which is easier to infect? “Yes, no, sometimes, I don’t know”. Which has more impact? Since it’s possible that an infected installation won’t infect another installation on the same account, I’ll say an infected multi-site has bigger impact. Which is harder to clean? Since it’s possible that any infected installation can infect, and re-infect, every installation on your hosting account, and multi-site has fewer files that could be infected (but still several thousand files per installation), multi-site is easier. Recommendation: 1) don’t get infected, by having good security configuration (including WordPress iThemes Security or WordFence plugins, and Sucuri plugin) 2) have professionals clean your sites, e.g. Sucuri. Best time to have Sucuri on your site? Before you get hacked!

    What about another account on the same hosting company infecting your sites? If your hosting company doesn’t talk extensively and often about security, or “security” for them is only “backup diesel generators and security guard”, switch companies today. Server software that keeps hosting accounts completely isolated has been available for years, and is free and standard-issue and yet many hosting companies haven’t updated their software. The best companies have staff that Every Day check for globally-announced newly-found security holes, and add security rules. Check my page on selecting hosting providers, or my recommended do it yourself hosting, or WordPress Managed Hosting.

  • Does Using WordPress in Multi-Site Mode Slow Sites Down?

    If you have multiple WordPress sites, how should you set that up?

    Some people say to install each site on a separate installation of WordPress, keep each site lean and fast. Some people say WordPress in Multi-Site mode is fewer files, less administration, just as fast. Which is it?

    How does the use for your entire hosting account compare?

    Overall, keep your installed themes and plugins to the minimum you need; keep your unused themes and plugins “elsewhere”, for security and speed. In Multi-Site, only “network enable” the plugins you actually need on all or almost all sites. But does using single-site or multi-site change overall speed or efficiency or storage? (more…)

  • Check Plugins are Multi-Site Compatible

    As a WordPress Multi-Site administrator, make sure a plugin works with multi-site before installing it. Plugin authors should state if the plugin works with multi-site.

    Testing is best done on a separate installation of WordPress (the one good reason for having multiple WordPress installations), so if there is a problem it doesn’t affect your production site.

    Plugin Authors: If you have tested the plugin with multi-site, then claim the feature in your marketing. I would not use a plugin that doesn’t say it works on multi-site, since even though I am technically qualified to do that testing it is much too much work to have to do.

    Does the plugin always request the table prefix from WP? (One immediate clue is a plugin that uses ‘wp_’, the default, even though that isn’t what you used when installing WordPress; then WordPress appends the site ID to that prefix for all user data.)

    Does the plugin always request the folder locations from WP? In multi-site mode, each site gets a unique file upload location.

    Does each site of the multi-site get its own set of plugin tables, for plugin options and for user data?

    When a plugin is activated on an existing site, are tables checked for, and created if needed? (Or do thousands of error messages about missing tables clutter the error log? Yuck!)

    When the plugin is network activated, and a new site is created, does the plugin activation work? Is there a reminder in administration panels, to configure the plugin for the site?

    When a site is deleted, does the plugin deactivation work?

    If the plugin creates file (for example, a podcast creating plugin would have the podcast episodes listed in a .xml file), does each site get a separate result file, or separate collection of files?

    Improper multi-site use would assume the table prefix, or assume the folder locations, or use one set of plugin tables for all users, or use one folder for all user’s media files, or allow unauthorized people to include in their post or results some information from other users, or allow unauthorized people to modify someone else’s tables or files.

    Plugin Author: State in the installation instructions or FAQ whether the plugin is safe to use in a multi-site installation. State whether the plugin can be network activated or must be activated on each site. State in the change log when multi-site features are added or fixed.

  • Migrate All Your WordPress Blogs into Multi-Site and You’ll Save Lots of Time!

    Unlike most “solutions”, I bring over all your settings, configurations, customizations. Your blogs will look Exactly like before, and you’ll have much less administrative work.

    If you are considering using WordPress Multi-Site, you probably have some blogs already. In fact, you probably have some blogs with a Lot of posts.

    (If you’re just starting, WordPress Multi-Site is still good, it makes having more than one blog much easier.)

    Each blog most likely has a few widgets, and probably some settings on each post and page. Maybe you specified what image should be featured on the post. If you are marketing at all, you should have a custom search engine description and keywords for each post. Maybe you selected some Amazon books that go well with this page. Your sign-up form. Your latest Facebook or Twitter posts.

    When you want to bring blogs from WordPress (single site) into Multi-Site, you find there are tools to help with that. “Great, this will be easy”, you think. Then you find that only the text of your posts and pages and comments are migrated. (Unlike if you have me migrate your blog!) (more…)

  • Migrate All Your WordPress Blogs into Multi-Site and You’ll Save Lots of Time!

    Unlike most “solutions”, I bring over all your settings, configurations, customizations. Your blogs will look Exactly like before, and you’ll have much less administrative work.

    If you are considering using WordPress Multi-Site, you probably have some blogs already. In fact, you probably have some blogs with a Lot of posts.

    (If you’re just starting, WordPress Multi-Site is still good, it makes having more than one blog much easier.)

    Each blog most likely has a few widgets, and probably some settings on each post and page. Maybe you specified what image should be featured on the post. If you are marketing at all, you should have a custom search engine description and keywords for each post. Maybe you selected some Amazon books that go well with this page. Your sign-up form. Your latest Facebook or Twitter posts.

    When you want to bring blogs from WordPress (single site) into Multi-Site, you find there are tools to help with that. “Great, this will be easy”, you think. Then you find that only the text of your posts and pages and comments are migrated. (Unlike if you have me migrate your blog!) (more…)

  • Migrate All Your WordPress Blogs into Multi-Site and You’ll Save Lots of Time!

    Unlike most “solutions”, I bring over all your settings, configurations, customizations. Your blogs will look Exactly like before, and you’ll have much less administrative work.

    If you are considering using WordPress Multi-Site, you probably have some blogs already. In fact, you probably have some blogs with a Lot of posts.

    (If you’re just starting, WordPress Multi-Site is still good, it makes having more than one blog much easier.)

    Each blog most likely has a few widgets, and probably some settings on each post and page. Maybe you specified what image should be featured on the post. If you are marketing at all, you should have a custom search engine description and keywords for each post. Maybe you selected some Amazon books that go well with this page. Your sign-up form. Your latest Facebook or Twitter posts.

    When you want to bring blogs from WordPress (single site) into Multi-Site, you find there are tools to help with that. “Great, this will be easy”, you think. Then you find that only the text of your posts and pages and comments are migrated. (Unlike if you have me migrate your blog!) (more…)

  • WordPress Multi-Site Domain Mapping

    Important: This was written in 2012, when you needed to use a plugin for domain mapping. With version 5.something of WordPress, and with version 6+, domain mapping is built into the WordPress core.

    If you were using the obsolete plugin for domain mapping, you should document the exact domain names you were mapping to, for each site. Then, network disable it and then delete it.

    In new versions of WordPress, you simply put the domain name you want into My Sites, Network Admin, Sites, then hover over the site you want, click Edit, in the Info tab edit the “Site Address (URL)” field. Use the full URL, including https://

    You still have to set the DNS so the domain name points to your WordPress Multi-Site installation.

    With WordPress version 3+ or 4+ in Multi-Site Mode, and the Domain Mapping Plugin, you can map domain names to any of your blogs. I’ll walk you through the steps to install the plugin (you have to move a few files and edit some configuration settings). Then I’ll show how to specify the mappings you want. (There are several blogs with partial instructions, that didn’t explain the configuration settings and didn’t give examples of how to specify the mappings — but you won’t have to figure it out because I did!)

    (more…)
  • WordPress 3 (or 4) Multi-Site Installation, on Shared Hosting, Even with Existing Web Sites

    WordPress 3 (or 4) Multi-Site Installation, on Shared Hosting, Even with Existing Web Sites

    Here’s how to Install WordPress 3 with the New Multi-Site Capabilities — Even if you Already Have a Website in your Hosting Account. [Updated, works on WordPress 4 through at least WP 4.5)

    WordPress multi-site features let you very easily create blogs (now officially called “sites”).

    You can now have multiple blogs in WordPress with much less administration of WordPress updates, plug-in updates and settings, theme updates, etc. Multiple blogs, for each domain you are hosting, can be managed by a single installation of WordPress. (more…)