By releasing immediate security fixes they honour their end of the deal, but do we by upgrading our WordPress accordingly? I have to say, the majority of us don’t. Apart from upgrading WordPress, there are other server related issues which may look simple, but can be your saviour or doorway to destruction.

Exploits are inevitable; you will come across them every now and then. Exploits are an unavoidable by-product of major projects; they are part of the bargain: you fix them and move on. Here is what can be done to stay safe

• Subscribe to WordPress development blog . That should keep you alert of the latest security patches and versions. Don’t just read it act on it too. So, upgrade accordingly. Upgrading might force you to take down your blog/site temporarily for few hours, but it’s still better than your server being brought down for forever, right?
• Not only do you have to upgrade WordPress, keep an eye on your plugins. I had experienced persistent XSS Vulnerability (Plugin responsible-wp-feedstats 2.4) and SQL Injection Vulnerability (Plugin responsible- WP-Stats 2.01), fortunately these were taken care of.
• Stop anonymous comments and trackbacks, why? There’s history of WordPress Trackback Charset SQL Injection Issue and other Non-WP related spam flood.
• Check your server files and folder permission accordingly. Especially Config.php file, which is an open text based file in a Web accessible directory. Not only is it Web accessible, but it contains the login and password for your blog’s database. No need to be a rocket scientist to figure out what will happen if someone naughty can get access to that.
• Directories should have permissions of 755. NEVER 777. All files should have permissions of 644. If you do want to use the built-in editor; theme files should have permissions of 666. NEVER 777. Do not use any plugin that needs to write anything to the server. No matter how drastic it sounds, trust me it will save your ass.
• Last but not the least, if you are building your own theme/or asked someone to do that for you, please do try to consult/check for latest PHP security holes or common security flaws before using that as template.

All of the above do’s and don’ts are common sense, but unfortunately we get lazy and tend to ignore most of them. Learn from my mistakes.

Share it

My motivation for writing this post is not to step on Kamrul’s toes by providing tips for blog writers. It’s to ensure we don’t loose our readers’ interest after a recent influx of diverse topics being covered on this blog. So, I’m actually providing tips for readers by explaining how to find the content that interests them (you) most. That’s not to say that other blog editors won’t want to copy what we do to make subscription services more granular than most.

You can either read the posts on the blog itself, or subscribe to RSS feeds to have the posts delivered to you automatically. I’ve explained below, each method to help ensure you read only the content that you find interesting.

To receive automatic updates whenever a post is published

1. Click on the ‘Subscribe to blog feed‘ hyperlink on the top of the left sidebar. This will ensure you automatically receive all blog posts by RSS.
2. If you don’t like RSS, we will send you updates by email. Just place your email address in the box and select ‘Subscribe’. This option can also be found on the left sidebar. We will never give out your email address to anyone and we will never use it for promotional purposes.
3. Click on the orange icon beside the author you wish to subscribe to. The orange icons represent RSS feeds. Doing this will ensure you receive a notification as soon as a specific author has published a post.
4. Click on the orange icon beside the categories that interest you most to receive updates on posts that cover specific topics.

To find relevant posts on the blog

1. Visit this Web page on a regular basis
2. Click on the name of the author who you find interesting. For example, if you want to find tips and tricks on how to build blogs, click on Kamrul’s name. To find out what each person writes about, click on their name and see what categories they’re likely to cover. You’ll find the category names at the top of each post.
3. Click on a category name. This will list every blog post which has been tagged with that category, irrespective of who the author is.
4. Use the search facility. This is the most underused feature on any blog and one I highly recommend. It does what it says on the tin.

We also allow you to subscribe to comments on each post so you automatically receive an email whenever someone leaves a comment after you. That way, you don’t have to come back to our blog to check up on posts that you have commentated on.

Share it

A Poll is one of the oldest methods of collecting user opinions. An online poll is just the next generation of that. Most sites/blogs have a contact us section to reach the webmaster but we couldn’t rely on that to gather user opinions on a specific topic or subject.

To gather extensive user opinions we can conduct a survey but for a quick on-the-spot opinion we use a poll.There are several plug-in systems out there that let you add quick poll in your blog/website but what’s the use of a poll if a large portion of users cannot access them?

Today we will look at a few poll plug-ins and check out which is best for usability and accessibility. Our discussion will be limited to only WordPress plug-ins that can be used in WP blog/sites.

Poll Daddy

A widely popular hosted poll management solution. Creating poll is as easy as pie, just as simple as type in the question and answer. Poll Daddy offers variety of customisations like multiple choice, multiple votes, user’s answer, randomized answer, closing date etc. You also will have the ability to create poll that will be displayed in poll daddy site as well.

Poll daddy offers you 14 XHTML 1.0 compliant styled widgets which you can embed in your site or blog by way of JavaScript or Flash code snippets provided by them. You can also provide your user direct link to the poll where your user will vote directly in Poll Daddy site.

Poll daddy also allows you to create your widget style and offers RSS feeds for every poll you create. All in all so far sounds cool, doesn’t it? Well don’t get too high on that, here are some usability and accessibility issues that you should consider.

First the JavaScript, if the user has JavaScript disabled they won’t get the poll, they may even get warning message from their firewall application. That isn’t cool, because a lot of users set their firewall to block third part JavaScript and Cookies.

Second the Flash code snippet; it might be one of the rising elements of RIA (RICH Internet Application), but it has yet to fully support screen readers. So as you can see you are missing a huge potential portion of users who might be interested in your site/blog.

Democracy Ajax Poll

This nice little plug-in for WordPress does exactly what its name implies. A simple two step installation, you can even use it as a permanent sidebar element (additional tweaking required) to display an ongoing poll. Poll management is simple through WordPress admin panel. After initial configaration further CSS customization can be done to shape up the looks of the poll.

Just like other AJAX based applications this does have its accessibility issues. Another drawback of this plug-in is, occasionally it generates invalid code.

Democracy Ajax Poll is a great plug-in but only good for small scale polls with the obvious drawbacks.

WP-Polls

WP-Polls is probably the most widely used WordPress poll plug-in . Why? well, it gives you tons of customisation option which all validate to W3C. This cool plug-in adds an AJAX poll system to your WordPress blog. You can easily include a poll into your WordPress’s blog post/page. WP-Polls is extremely customisable via templates and CSS styles and there are tons of options for you to choose to ensure that WP-Polls runs the way you like.

Setting up WP-Polls is easy as two clicks. Poll management is so easy (via the WordPress admin control panel) that you can create the most basic poll to a complex poll on the fly.

You can create and maintain multiple polls simultaneously as well as having recurring poll to keep it ticking over.
Though WP-polls are AJAX based, in my test I didn’t came across with XSS or other slimy vulnerability so far. Java runs on server side. Strong CSS knowledge might be required for serious customization, cookie and IP setting may cause a warning massage through users firewall.

In a previous post Paul shared some information regarding increasing readership & accessibility. Apart from that information shared by Paul polls are also necessary in order to boost your readership. After all without user participation your blog is as good as dead static site.

Share it

There is no simple answer. Any CMS, whether Drupal or WordPress can experience the same issues caused by numerous reasons without anything to do with the core itself. I will keep the focus of this discussion on the WordPress (self hosted) related issues to narrow it down. Why dont we turn the spotlight onto the fundamental reasons first, so that it would be easier to eliminate them? Your WP (WordPress) powered site may experience sluggishness because:

• MySQL server or connection issues.
• PHP Memory Limit.
• Apache log rotator problem (for Apache server).
• Broken/Degraded PHP code in template/theme files.
• Excessive plugin uses/ use of plugin(s) with broken codes.
• Some particular third party widgets/ JavaScript codes.
• WordPress Dashboard’s display of RSS feeds.
• Pingback attempts when posting.

There are many other reasons which might trigger sluggishness, but they would be one way or another related to above mentioned causes. Now that we know what makes our WP site’s slow down (Back end or front end), let’s turn our focus on how to avoid these.

MySQL server or connection issues
Actually very little you can do about this, since your host can only resolve this. Most of the case this is a temporary issue, when your host is having an upgrade or downtime. Too many connections to your DBhost can also trigger sluggishness. Your WP back end can also slow down when MySQL Database is unable to keep up with the query demands.

Solution: Contact your server host if they are having an upgrade or downtime. Make sure your WP database isn’t shared with your other sites. Check with your hosting company regarding your DB statistics, if needed do an upgrade or change host. No use sticking to a host just because they are nice but can’t meet your technical demand.

PHP Memory Limit
The heartbeat of WP is PHP, so obviously when something goes wrong with that you will have issues. By default PHP is a beast with all kinds of nasty modules it thinks it needs to load. So the more it’s loading, the more memory you need. Why not control what to load? Disable as many extensions you are not using to save memory. There is a very useful guide on PHP configuration optimization.

Solution: Optimize your PHP configuration, avoid loading unused modules.

Apache log rotator problem (for Apache server)
This happens when your site is hosted on Apache server. When a log rotator script breaks, your server log files start growing huge in size. Meaning your server has to deal with hundreds of Megabytes excess log files that will slow it down to the point of instability.

Solution: Contact your server’s technical support. You may also check and make sure the files/directory of log files should be only server writable.

Broken/Degraded PHP code in template/theme files
Many WP users experience sluggishness for this reason as their site gets bigger. You will come across hundreds of beautiful, stunning looking WordPress themes on the web, but how will you know the PHP codes are optimized on the back end? WordPress has some basic guidelines/ requirements for theme submission, but a PHP code check isn’t one of them (Checking each themes code isn’t practical either). But, from the user’s perspective you need to make sure your themes code is optimized, as that code is the framework of the whole site.

Solution: First use wp-cache plugin (included with latest WP version installation pack). It’s the classic caching solution. It also knows how to update itself when comments are received, etc, so your site is always the most up to date and requires less load time. Second (optional) why recompile scripts every time, when you can save the bytecode? There is an extension called eAccelerator, its uses a bit of disk space but also optimizes the opcodes and saves you from having to recompile a script every time. It can shave up to 5000ms off your loading time, depending on the php code. Third switch your themes to some standard theme (for example-WordPress default theme) with all the plugins active and test the performances. If the performance remains sluggish, your problem isn’t in theme/template codes.

Excessive plugin uses/ use of plugin(s) with broken codes
This is the second most probable cause for WP to slow down. Just like above problem, this is also caused by broken PHP code or degraded MySQL queries, but in this case within the plugin files.

Solution: Don’t use a plugin when you can do it easily without the use of plugin. Activate only the plugins you want to really use, or best still, remove the non active plugins. Now deactivate all plugins and clear your browser cache. Activate one plugin and clear the cache again and check the performance, lastly clear cache again. Repeat the process until you experience slowness or finish activating all required plugins. There are ways to identify slow/degraded MySQL querries, which I will discuss in next blog tip.

Some particular third party widgets/ JavaScript codes
Oddly enough this is a random problem, meaning different people experience sluggishness with different types of third party scripts or widgets. So, why am I saying the reasons are problematic codes, where it’s random? For most cases the problem is resolved when those scripts or widgets are removed, they must have been the cause .

Solution: Most commonly these third party scripts/widgets have issues with new version of WordPress (reason unknown)-Snap preview anywhere, MyBloglog widget (javascript version of mybloglog) (surprisingly the slowness disappear when you manually coded the non javascript into your template), Advertising networks JavaScript codes (I experienced some of the ad networks ad script brings down your site to its knees), few dozens others. The smartest move will be keeping only the necessary ones (if possible non JavaScript version).

WordPress Dashboard’s display of RSS feeds
If you find that editing posts/templates or logging into WordPress takes a long time, the culprit is probably the WP dashboard. This is the “home” of the administration section, displays links to your latest posts, upcoming posts, comments, and incoming links. Unfortunately, it also displays a number of RSS feeds related to WordPress. While this sounds like a good idea, it often takes 30 seconds or longer to load the page because of delays fetching the RSS files, and they rarely have anything new and relevant. Two ways you can avoid that-

1. Avoid loading the Dashboard page (index.php) at all. Instead of using the “Login” link in the sidebar, you may use link that goes straight to /wp-admin/post.php. This brings you straight to the posting interface, which loads instantly, and you can use the links to reach other parts of the console, including the Dashboard if you need it.
2. If you still want to use the standard login feature, install Angsuman’s Dashboard hack, which replaces the RSS section of the dashboard with more useful links within your site.

Pingback attempts when posting
This is a random cause of your slow WP posting interface, especially the editing part. While the actual posting process is instantaneous, the delay is caused by two parts of network activity-

• WordPress attempts to use Pingback to notify every URL you’ve linked to. If you find yourself linking to WordPress blogs often, this is actually a useful feature-otherwise, it’s a waste of time. In my experience, attempts to Pingback non-blog sites are the cause of most of this delay. Lastly please for heavens sake do not use any plugin such as default trackback, because you don’t want your server to spend 40-45 seconds to trackback something that isn’t relavent to your posts.
• WordPress uses Ping-o-matic to notify search engines of your post. This is a very good thing, but occasionally causes delays. Rarely, Ping-o-matic causes a delay when posting. To eliminate this, you can remove rpc.pingomatic.com from the list of Update Services in Options -> Writing. You can even use other ping server instead of pingomatic. Here is the list of some useful ping servers which can be used instead of pingomatic.

As you can see most of the cases for slowing down a WP site isn’t WP related at all. A little bit of workaround and tricks can be just enough to avoid these.

Share it

I was first prompted to write this post when one of Segala’s Certified Partners directed me to their ‘blog’. I can’t remember why, I think it was regarding the design and it was asking us to review it for accessibility standards compliance.

I was bemused when I was unable to converse with the author by leaving a comment. It wasn’t the first time I witnessed this, but it was the first time it (almost) frustrated me. All I could think of was ‘why?’ Why not just call it a Personal Web site?!

A few weeks later a Microsoft colleague directed me to the same agency’s white paper on Web 2.0 as he found it very interesting. So, here’s an agency that clearly understands Web 2.0 but yet, wasn’t sure whether to enable comments on its ‘blog’ or not. I was delighted to see comments later enabled as a direct result of my personal feedback on the subject though.

Personal Web sites have been around for a very long time. Running commentary on subjects such as movies and sport isn’t a good enough reason to call your Web site a blog.

As Wikipedia states

A blog (a portmanteau of web log) is a website where entries are written in chronological order and commonly displayed in reverse chronological order. “Blog” can also be used as a verb, meaning to maintain or add content to a blog.

Blogs provide commentary or news on a particular subject such as food, politics, or local news; some function as more personal online diaries. A typical blog combines text, images, and links to other blogs, web pages, and other media related to its topic. The ability for readers to leave comments in an interactive format is an important part of many blogs. Most blogs are primarily textual, although some focus on art (artlog), photographs (photoblog), sketchblog, videos (vlog), music (MP3 blog), audio (podcasting) or sexual topics (Adult blog), and are part of a wider network of social media.

The bit that interests me most is, “The ability for readers to leave comments in an interactive format is an important part of many blogs.”

Calling a Web site which allows two-way conversations a blog, is a way of benchmarking time, technology and/or techniques. The very same can be said for Web 2.0. Although, Web 2.0 principles have been around longer than the term itself, Web 2.0 enables us to talk about the same stuff, well, sort of. Most of the confusion in my opinion, appears to be around whether people are talking about technology or marketing.

One could argue that if your comment is worthy enough, it should in fact warrant its own post on your own blog, thereby mitigating the need for comments in the first place. However, this is a cop out and doesn’t counter my argument to use the term ‘blog’ when referring to Web sites that enable comments from readers.

Sethi Godin, Dave Winer and Russell Beattie are just 3 people who call their Personal Web sites blogs. Perhaps people like Winer can get away with it as people are very likely to write posts on their own blogs and then link back to his original article.

Perhaps a few people should be given a ‘get out of jail free’ card? Can they get away with being an exception to the rule?

For me, ‘blog’s without comments is just evil 99.9% of the time. There must be a very good reason not to have comments on a full time basis.

Share it

Like most, I wrongly assumed that the vast majority of our readers fully understand RSS and how to subscribe to our blog. I’ve been asked on a number of occasions however, how to subscribe, so I thought it was worth sharing the different options with everyone. I intend to highlight/remind readers of the different options available at the bottom of each post for a short while.

Subscribe only to content that interests you

Subscribe to specific authors

Like our readers, my team and I have different areas of interest, so we provide the option for you to subscribe by author. That is, you can choose to receive updates from specific writers whilst paying less attention to others.

Subscribe to topics of interest

You may wish to receive updates on specific topics irrespective of the author. For example, you may wish to receive updates about my shenanigans, or be notified about subjects such as Web 2.0, Mobile Web, Social Media, Web accessibility or Content Labels.

Subscribe by email

If you’re not keen on RSS, then why not subscribe by email. We will automatically send you updates each day. Just type your email address in the field on the left sidebar and hit subscribe.

Get updates when other comments are left after yours

When you leave a comment on our blog, we’ll notify you whenever someone leaves a comment after you. We do this because other commentators may comment on your view and not just the original author’s. This also helps you get to know other readers who are likely to have similar interests.

Share it

So, I’ll try my best to upload my talk (with text to contextualise it) on Wednesday.

Share it

I’m presenting at the Online Marketing show next week and would like to solicit your opinion.

Please let me know what your thoughts are and I’ll naturally reference whatever tips etc. you provide.

When I ask the question ‘can you make money from blogging’, I’m not just talking about ads, I’m talking about how brands can leverage blogs to ‘make money’. Personally I think it’s mostly indirect/discrete brand awareness stuff but I’m very keen to hear what you think – however broad or narrow.

The title is purposely vague as I’m likely to modify my talk based on what people want on the day. Many thanks!

My talk is at 3pm on the June 26th. Feel free to drop by an heckle, so hope to see you there. Please let me know in advance if you’re going to be around.

I’ve also asked the question on Facebook.

Share it

Yes it may be true that 80% of computer user’s desktops are one way or another dominated by Microsoft, but when it comes to the Web, Microsoft’s plays a leading lady role at best. Perhaps going after Adobe’s biggest success “Flash”, is just a sign of Microsoft’s preparation for a Web domination campaign. Anyway “Silverlight”, is a browser plugin that will allow Web content providers/publishers to offer rich video and interactive media experiences directly within their Web sites. Wondering which browser? According to an official statement issued by Microsoft (unable to find the resource at the time of writing this post), Silverlight will be compatible with Internet explorer, Firefox and Opera initially.

Silverlight, formerly code-named WPF/E uses the same technology which leverages Vista’s new graphics framework Windows Presentation Foundation (WPF). As you can guess, Microsoft’s key target audience/consumer group are content providers that want to distribute video and rich media over the Web, designers and developers who build rich media content or applications and last but not the least, end users. Until now almost all of the news sites like Cnet, ZDnet, Reuter’s etc. use Adobe’s Flash as the key technology to show interactive media/content. Microsoft’s Silverlight objective is to take away that dominance. Obviously Silverlight has the good looks and an abundance of creativity enrichment.

The coolest part of “Silverlight” is that it delivers a similar user experience on both IE 7 running on Windows Vista and Firefox running on an Apple Mac computer. This means it is OS independent (cross-platform) and more importantly, end users will not have to download different video player technologies to view online media based on what OS they are running. Well that is one feature that Adobe Flash doesn’t have.

Here are some of the cool features of Silverlight

• It supports playback of WMV files on both PC and Macintosh.
• Silverlight and HTML integrate seamlessly together. Every XAML element can be accessed or manipulated from the same client-side JavaScript that would be used to interact with any DHTML element: there are no artificial boundaries or barriers, and you can even overlay HTML elements on top of Silverlight content (simply by creating a windowless frame).
• Full runtime interactivity with Silverlight generated content. The content of the XAML file can be completely server-side generated.
• Silverlight is blindingly fast – trust me it is. You just go and play the same video with Flash and Silverlight and you will see.
• Silverlight is almost 100% upward compatible with WPF. Animation, 2D vector graphics, media, text.
• This one is the coolest of all: Simple integration with existing Web technologies and assets means Silverlight works with any back-end Web environment or technology. No “rip and replace” required. Silverlight integrates with your existing infrastructure and applications, including Apache, PHP, as well as JavaScript and XHTML on the client.

There was no indication if “Silverlight” will be able to eliminate the key accessibility issue of Flash objects that is to say the lack of device independent navigation. In Adobe Flash created objects, you can bring good looks, but you can’t bring device independent navigation/control, you need a mouse for that. I’m hoping they have an answer for this. We’ll just have to want and see the final product.

Microsoft delivered a beta of Silverlight at its MIX 2007 conference at the end of April. So have your fingers crossed and wait to see the battle of rich media content generators .

Perhaps our friends at mydeo can tell us more.

Share it

All the proceeds from the 11,000 foot Skydive go to the National Council of the Blind of Ireland. At least €600 (£406 / $800) needs to be raised before I get my hands on a parachute. Everything above that is a much appreciated bonus for a very worthy charity.

Thanks for the help! I’ll make sure the photos get posted if I make it back in one piece. (Paul Walsh says – “I’ll post more photos if his shoot doesn’t open).

For anyone interested in jumping themselves visit the charity jumps Web site for all the information and to register.

Share it