Smackdown: WordPress loser on security

I’m such a fan of WordPress, I’m speaking at the 2010 UK Wordcamp – and I’ve met Matt Mullenweg (founder of wordpress, who I found inspirational). In fact I advocate WP nearly whenever I can for small / medium sites.

The bits where WordPress are great on  is flexibility and massive community, so tons of great add-ons.

But where I work, we are obsessed with security and because WordPress is  moving so fast, every change on the CMS means a security review and every change on a plugin means another minor review. That’s fine, except it’s lots of reviews and so lots of time spend rubberstamping.

The other BIG issue is the security gap betweenWordpress and MT - the article explains it in more detail. I don’t have up to date info on WordPress and security holes, but I imagine it has improved a lot over the last 2 years.

Wordpress V MT security

Another reason I’m not a fan of WordPress for enterprise blog / news publishing is that MT can handle hundreds of users across hundreds of blogs in a single instance of the CMS. Of course you can say that WordPress  MU will do it, but from what I can understand, its a whole world of complxity and hacking to make it work well. Forinstance, things like extensive role management are native in MT, in WordPress the role manager is a 3rd party addon.

With Movable Type as you may know, it renders static files with a few dynamic elements. In other words you get a server full of flat HTML files that don’t need a database to render them. Of course WordPress for the most part is dynamically rendered.

This is important because its nearly impossible to do a cross side scripting attack on Movable Type. This is demonstrated by their security record. More secure = happier ‘powers that be’.

WordPress gets upgraded about 3 times more frequently than MT and if you don’t upgrade, you are likely to get hacked. Upgrade = security review because its new. And on it goes.

So there you go…I still love WordPress, but for BIG multi user, multi blog I’m waiting for a little more maturity.

Well worth 5 minutes of your time:

thanks Fi for the vid

The BIG thing was community. WordPress has tons of it.

WordPress makes it easier to publish online. This in combination with Google means more useful opinion and information can be found more easily . This free flow of information makes the world a more open place. And that hopefully means more knowledge, truth and so power to the citizen.
I know its lofty thinking, but when you hear Matt Mullenweg speak, his vision and everyone’s combined commitment will help the flow of knowledge. Yes WordPress is more than some php code.

This gives you an idea of how he thinks:

“Matt Mullenweg, founder and lead developer of the WordPress publishing platform, explains how the open source philosophy and “Golden Rule” apply not only to technology — but to such fields as politics, economics and environment. Recorded at Wordcamp Montreal 2009 by Christian Aubry. Licence: Creative Commons BY-SA.”

The Event
There were about 140 people at wordcamp uk. Of those I would say 50% were developers, 35% semi technical / marketing and the rest a mixed bag of site owners and the curious.

Wordcamp UK

I did 2 sessions, one on SEO and wordpress (see below) and another session: Web Doctors fix it session, where a bunch of us went through a group of sites including:

• http://www.realfresh.tv
• http://www.martinbloomphotography.com
• http://www.p45camp.com
• http://www.bristol247.com
• http://www.curiousfu.com

My SEO slideshare:

Having been to a number of big conferences, the ones that cost about £1200 for 3 days… I thought wordcamp was way beyond anything ive been to in terms of:
- community togetherness
- sharing of knowledge
- networking
– enlightenment (yes big big word, but relevant here)

I felt privileged being in the company of so many bright people who understood the true nature of the Internet and its capacity for change. In conclusion I reckon I’ve learnt some more about the spirit of the people who drive the Internet. As a marketing person, this is invaluable.

Kudos to everyone actually, since we all made this work.  But how about a few names…

• Tony Scott
• Hayley Niuserre
• Mike Kimb Jones
• JONNYA
• P45 GUY
• VIXX
• CHI CHI
• Dave Mee

For more feedback on the event: http://wiki.wordcampuk.tonyscott.org.uk/Main_Page#WordCamp_UK_2009_event_reports

Principles by which to live by.

I had been asked to come up with a guiding set of principles for social media. Short is sweet.

1. Be engaging:?  helpful, entertaining, useful, likable.
2. Listen:?  listen to your community.
3. Participate and contribute:?  get in there and get involved in the discussions going on among the blogs and sites of others.
4. Be real:?  transparency pays off and no one likes a fake.
5. Give: whatever you have of real value to others – give it away if you can. You will be rewarded many times over.

As ever I’m constantly impressed with wordpress as a versatile and useful blog tool, but did you know it makes a great CMS?

In fact wordpress is now my cms of choice for static sites, simply becuse its so easy to install and to configure. And then you have the plugins!

This is a villa rental site I’ve done recently, its for rentals in Italy in an area called Piemonte.

The main features are the easy theming, the configurability and of course the plugins!

Main stars are:

• FLIR for the pretty fonts
• Flickr tag for making images embedding a whole lot easier ( my rationale: use services that do what they do really well. Flickr is genius on images and its free!
• All in one SEO pack
• and all the usual indispensable features like Akismet

Here is some intersting stuff on wordpress as a CMS

I had a post written about my presentation and mercifully its a positive review!

There was a very interesting discussion around SEO, on which I made some notes on this blog. The key message was to make sure your content is well written and interesting. There is still a lot for government to learn about this stuff, as Paul Canning often says – maybe we should call it findability or something, though.

More here

And this

Highlight presentations for me personally were Nick Garner from BetFair on SEO

More here

And this:

Aside from the tips on plugins, backups and content management systems, one line stood out for me ?€œIf you?€™re a web developer get to know a journalist. We need them. And they?€™re cheap.?€

The quote came from Nick Garner, head of search marketing for Betfair. He was talking about search engine optimisation (SEO), in particular the practice of link building – increasing the number of links to your site through a range of activities including posting on forums and in blog comments, buying linked text ads on popular websites and blogs, and writing link-ridden articles which are then ?€˜given?€™ to popular websites and blogs.

More here

And a complete run down of the whole event here

As I said before – this was the first go at a presentation like this, so there is much room for improvement. Lets hope i can come back again and share some more at the next workcamp.

One thing I hope we can do next?  year? (if I’m invited back) is?  to have some ‘interests’ streaming, where attendees specify their core interests and skill levels beforehand so speakers can gear their presentations better to the audience.

But all in all – its been great!

I felt I jumped around too much and didnt keep on a tight enough track with my powerpoint presentation, but it was bouncy and seemed to keep everyone interested.

The guy I went to this with, gave me a 7/10, so not bad for my 1st speaking engagement!

General thoughts

I think the most significant thing was the sense of common identity amongst us all…after all, were all wordpress people. And this ‘geekyness’ was cool.

it was this sense of community that really impressed me. It is why the internet is so special and in many ways it was a vivid manifestation of why the Internet is so powerful, i.e.

• the idea of collaborative working for a greater goal
• a sense of shared identity
• an interesting cross section of people from teccies to writers coming together
• a sense that in some way being part of the blogging community can make a difference to the world ( I really believe it can!)

I hope to be a part of forthcoming wordcamps, since this was a great ‘recharger’ and a good way to give back some of the knowledge and ‘good stuff’ I have enjoyed along the way.

So thanks to Tony Scott and all the others who helped make this happen. (thats Tony Below)

me!!!

but my luck is in and here is the perfect tutorial for that ‘end user client’ you?  have, who needs hand holding

http://edublogs.org/eduvideos/postsandpages/postsandpages.html

There are a couple of plugins that are ‘must have’ for title tag optimsiation

Reordering the tag?  so that the name of the post comes 1st and your site title comes second. the ideas is that the words at the front of the tag more more important than at the end.

? http://elasticdog.com/2004/09/optimal-title/

And then taking th etitle tag optimisation thing to another level there is?  http://www.netconcepts.com/seo-title-tag-plugin/

This allows you to edit title tags so they can deviate from teh title of the post you are writing. I hav’nt used this one yet, but i expect i will in time.

ref this page for the original advice : http://codex.wordpress.org/Category_Templates and go half way down the page for this.

Instructions : (wordpress version 2.1)

in the Archive template just above…

<?php $post = $posts[0]; // Hack. Set $post so that the_date() works. ?>

Use this code

<?php if ( $paged < 2 ) { // Do stuff specific to first page?>
<?php if ( is_category() ) : ?>
<h2 id=”category-name-header”><?php echo $cache_categories[$cat]->cat_name ?></h2>
<?php add_filter(‘category_description’, ‘wpautop’); ?>
<?php add_filter(‘category_description’, ‘wptexturize’); ?>
<div id=”category-description”>
<?php echo category_description(); ?>
</div>
<?php endif; ?>
<?php } else { // Do stuff specific to non-first page ?>
<?php } ?>

To be able to use HTML go to :

wp-admin/admin-db.php

and edit out
//$category_description = apply_filters(‘pre_category_description’, $category_description);

As I have done

then go into your category editor and edit whatever category you like and add the relevant HTML into the description and save

and now you have fixed content for a linked to category page !

Nice

My test site is www.anorak.co.uk

As you may know, in a typical install for wordpress you assign stories to categories and if you have lots of stories, then you probably would set up subcategories for those stories. BUT the problem is that folder ‘maincategory’ will also show subcategory stories. = duplicate content.

So i’ve found a plugin HERE which only shows stories actually assigned to that particular story – so each category home page only shows stories from that category.

for example :
http://www.anorak.co.uk/reality-tv/ only shows reality TV stuff and no big brother stories
and http://www.anorak.co.uk/reality-tv/big-brother/ only shows big brother stories

I’ve also worked the anorak robots.txt file so I stop indexing of the RSS pages (im sure you have seen these around the place on searches) and im blocking the archive pages from the engines idea being i funnel them to category home pages

I’ve also manipulated the footer pagination, so the spiders will crawl deeper via the category pages as opposed to the index page – ive added a no follow there.

The strategy is to get the category home pages ranked along with the main index page – so its all about diverting the bots in the right way and overcoming the issues associated with link churn

My next task is to do a script which presents a static include on the category home pages, which does not repeat in the archive pages

here is what I have done:

1. set up xaamp on my local machine (i do this usually becaseu it speeds up site theme building)
2. build the CMS, whatever flavour for the purposes of this blog post
3. download and install winhttrack
4. copy the local site onto a server where there is no ability to have a dynamic site… but where you like most of the dynamic stuff i..e navigation and so on

I’m doing all of the above on a client site.
Now here is the trick with winhttrack…

- you need to use your machines IP address as the source http:// location and make sure you do the same in your cms, so instead of the site being located in http://whatever it will be he IP address you have got from doing a check on your machine.

- make sure under the> set options > spider > 2nd drop down box > set the rule to no robots.txt (xaamp prevents the winhttrack from fully spidering the site)
IP lookup for pc’s : see here

winhttrack : see here

xaampp : see here
cms’s to try and download : opensourcecms.com