Blogger vs WordPress Blog

WordPress has often been seen as the unofficial scapegoat to blame various security breaches on. Like many other popular web applications, WordPress is an attractive target for attack. Obviously, the security in WordPress, as with any application, needs to be put into context. Luckily, WordPress benefits from a wide variety of security configuration options and third party plugins to help satisfy those who are looking to increase their overall security.

In this article, I'm going to add to Tim Carr's 10 Tips to Secure WordPress with even more ways you can help secure your site, starting prior to the WordPress installation.

Clean Your Computer

Before starting the WordPress installation, be sure that your computer is malware/virus free. It might sound obvious, but it's critical that your system is free of malware and in a trusted state.

If your computer is infected, every security related measure of yours could be futile. It is suggested to protect your systems with antivirus, to keep all the malware and viruses at bay.

Install WordPress in Another Directory

The WordPress core files can happily exist in another location, other than the root directory. This technique is often debated, so your mileage may vary. Scanners and attackers can still find out where WordPress lives, however we thought it's worth mentioning since the topic does come up often.

Even if this doesn't directly provide additional security, it will definitely help keep your server organized which is also very important.

For example, if your site has the domain www.example.com, it would be preferable to install WordPress in something like www.example.com/directory.

The next step is to copy the index.php and .htaccess files to the root directory. If the .htaccess file is invisible, you have to make hidden files visible in your FTP/SFTP/SCP software or in your cPanel File Manager.

Don't worry about the error you'll now get if you browse to your site. Go to index.php and modify following:

require('/wp-blog-header.php');torequire('/directory/wp-blog-header.php');

Now your login URL will be www.example.com/directoy/wp-admin.

After installation, you should go to your WordPress settings in the admin panel and change the WordPress URL, so that it points at www.example.com/directory and blog URL www.example.com.

Change the Database Prefix

By default, WordPress creates the database with tables prefixed in wp_. The thinking is that spammers and hackers that are using automated tools know your database structure. Having a default database prefix makes their life much easier. This is another topic of debate, however as with installing WordPress in another directory, it's a question that comes up frequently.

During wp-config.php configuration in the installation process, change the table prefix to something random and unique like wp_Df3R_.

To organize your tables in a more efficient way, start the prefix with wp_ and end it with _. You may use numbers, letters, and underscores.

Secure wp-config.php

As the most important file in WordPress, it stores valuable information like database, username, password and authentication keys, nobody should have direct access to wp-config.php.

As mentioned above, we can store wp-config.php outside of the root folder. Now we'll add an additional layer of security to it.

To deny access to this file, you should add the code below at the top of the .htaccess file:

<files wp-config.php> order allow,deny deny from all </files>

This file shouldn't be modifiable or writable by others. To prevent other users from reading it, the file permission should be 440 or 400, however you should consult your host to check this.

Remove the WordPress Version Number

Sometimes leaving the WordPress version number can be a security risk, especially if WordPress isn't updated regularly. Of course, we strongly recommend regular updates, as with performing other regular WordPress maintenance tasks.

The code that generates the WordPress version is in header.php:

<meta name="generator" content="WordPress <?php bloginfo('version'); ?>" />

To remove the WordPress version number, you should add the following line to your active theme's functions.php file:

<?php remove_action('wp_head', 'wp_generator'); ?> Use Secret Keys

Using Secret Keys plays a role in WordPress security. These security keys help encrypt the data stored in the cookies WordPress uses. Without knowing these keys, attackers will have a harder time entering your WordPress site.

WordPress creates these for you at the time of installation, however these values might not exist with older sites or if the wp-config.php file has been manually replaced.

By default Secret Keys are listed listed in wp-config.php, like the following:

define('AUTH_KEY', 'put your unique phrase here'); define('SECURE_AUTH_KEY', 'put your unique phrase here'); define('LOGGED_IN_KEY', 'put your unique phrase here'); define('NONCE_KEY', 'put your unique phrase here'); define('AUTH_SALT', 'put your unique phrase here'); define('SECURE_AUTH_SALT', 'put your unique phrase here'); define('LOGGED_IN_SALT', 'put your unique phrase here'); define('NONCE_SALT', 'put your unique phrase here');

If you ever need to regenerate these keys, you can visit the official generator provided by WordPress.org at https://api.wordpress.org/secret-key/1.1/salt/.

If an attacker has the security keys, they can regain access to the site even if the passwords have been changed. So if your site is compromised, don't forget to change your secret keys – not just your passwords!

Disable Directory Browsing

WordPress allows users to browse the web directories, if they know where to look. Obviously, this is something we want to avoid. Directory browsing can be used by attackers to find your most vulnerable files. It's not uncommon for developers or webmasters to leave backup files or archives in odd places.

Ensuring that no one can view the contents of directories can be done by adding a single line in .htaccess

Options –Indexes Secure Multiple Installations

If you have more than one instance of WordPress on the same host, you should use different user credentials for each database. The database username and password should be unique in the wp-config.php files for each of your websites. This will ensure the isolation of every single site, in case one of them gets hacked.

It's a simple tip, but reusing the same credentials is something people do all the time.

WordPress Security Plugins

If you don't feel comfortable making the above mentioned changes, there are several plugins that help you maintain the security of your WordPress installation, or even to help you recover quickly if you fall victim to a malicious attack.

Here's a list of the most popular security plugins:

Charles Costa has previously explored the topic of WordPress Security Plugins, that is well worth reading.

Conclusion

With a large percentage of websites being powered by WordPress it's no big surprise WordPress security is a popular topic. If you're serious about your website and your website security, you should definitely explore your options and take the extra time to lock your site down.

To recap, we've previously covered 10 Tips to Secure WordPress, in this article, we covered even more tips to help you better manage your website security. If you're keen about learning more, I'd also recommend reading the official WordPress.org documentation "Hardening WordPress".

Please let us know in the comments below if you have any of your own extra tips for increasing WordPress security.

Source: More Tips to Further Secure WordPress

July 9, 2015 12:01 a.m.

Before I dive into the main point of my post today, I just want to say wow!  I was alerted by WordPress yesterday that my blog was booming with visitors, the graph line was zooming upwards and as of today, I now have 104 followers of my blog!  That statistic just boggles my mind-I feel akin to The Little Engine that Could-so thank you to all of my followers for reading my posts.  I will refrain from quoting actress, Sally Field, who's honesty on accepting an Academy Award led to a wince-inducing reaction.  Now, on to may main post for today.

I am a book worm.  I love to read.  As a kid, I loved to ride my bike across town to the public library, one of many libraries built via donations from that ancient philanthropic rich guy, Andrew Carnegie.  I would take my time, peruse the books in the Children's section, and take my selections home and pore over them.  I can recall my frustrated younger brother, begging me to stop reading and play with him outside!

Defiance, OH's public library that I would visit a lot!

When I hit my teens, I began to put the kid lit behind me and aimed for the Classics.  I did discover that through all of my years of reading, I loved history books the best.  Whether they were books written by Augusta Stevenson that I devoured from the public library or books written by adult historians, I always prefer to read such books over mysteries, or romance writings.  Becoming a mom in 1991, I discovered that my reading had to be put on hold.  I would still read, but it now took me quite a while to finish a book.  Now that my kids range in ages from 12-23, I am starting to speed up my reading, just a bit, but hopefully in another year I 'll be back at my former fast-reading ways.

With my love of books, I decided that for some of my blog posts,  I will  focus on good reads, books that I've enjoyed reading; my own Reader's Corner Review type of blog post.  I will still plan on my Friday/Weekend posts to be about a classic movie, but  my Tues./ Wed. mid week posts may be about a book.

My first review is the late  Stephen Ambrose's  Undaunted Courage, the saga of Lewis and Clark's amazing exploration and journey of the land purchased by President Thomas Jefferson in the Louisiana Purchase.  Living in Missouri as I do, Lewis and Clark are still pretty important men to the state's history and as I read about their endeavor and outcome, it amazed me at how well the journey progressed.   It amazed me as to  how they were able to avoid the potential pitfalls and dangerous outcomes due to their God-given talents and wisdom, in leading about a group composed of young soldiers, fur trappers, Lewis's slave, and one Native American woman, who was expecting a baby!

Undaunted Courage-cover art for the book

Ambrose goes into great detail about Meriweather Lewis's life, his family's background in Virginia, Lewis's boyhood, military career, and his work as a secretary for the new President, Thomas Jefferson.  After Jefferson had made the purchase of that great swath of land, he wanted Lewis to lead a team to explore it and find an all water route from the Missouri River to the Pacific Ocean.  Jefferson was convinced that the two rivers were somehow connected.  He also wanted Lewis to make allies of all the Native American tribes that they would meet.  Jefferson had a "kooky" plan for the tribes in my opinion; he wanted Lewis to evaluate the idea of placing all the Native American tribes west of the Mississippi River, and have them live all together in a specific area, learning how to farm, read, write, and to assimilate into American ways of life, yet making them stay on the west side of the Mississippi.

The book also introduces us to Lewis's co-leader, William Clark and how they had known each other, respected each other, and were friends due to past military service together.  4 sargeants, 23 privates, 6 civilian adults, eventually 1 baby, and Lewis's Newfoundland dog, Seaman, made up the expedition.  Only one man died along the way west, and now historians think he died from appendicitis.  Amazing that during that entire journey, which was begun in St. Louis in May of 1804 and ended with their return to St. Louis in September of 1806, that only the one soldier had died.  Many Americans at the time had given all of the expedition up for dead and there was even a rumor that Lewis and Clark had been captured by the Spanish, who still controlled a lot of California at the time, and that they had been forced to work in a silver mine somewhere in the Southwestern territories!

Lewis was also called upon by Jefferson to take copious notes about plants, animals, insects, birds, fish, reptiles, and to make nightly measurements using the stars as to their latitude and longitude when ending each day's travels.  To get Lewis ready for his scientific notes and drawings, he was sent to Philadelphia months before the expedition began to be trained by leading scientists of the day.  Lewis was also in charge of gathering all of the supplies, trinkets for the Native Americans, and he also learned medical treatments and gathered the medicines available at that time for any future illnesses that would occur.  

After the success of the expedition, we learn of Clark's courtship and marriage to Miss Julia Hancock and the birth of their first child, a boy.  We learn how the US Congress complained loudly about the expedition, the costs associated with it, how it was Jefferson's folly to have it done.  We also sadly learn of the decline and demise of Meriweather Lewis.  Ambrose looks at the theories that exist as to why Lewis would commit suicide: his family's genetic leanings to depression and mental instablility-was he a manic/depressive?  There was the young lady he was in love with and tried to court but she didn't care for him at all and married another man.  There was the pressure to get the journals that he and Clark kept of the expedition published and Lewis procrastinated to have them published.  Why?

Undaunted Courage, something the two leaders and all of the members of this great journey had in spades.  Lately, when I am feeling a bit daunted by a task, I just ask myself, "Is what you have to face as difficult as what Lewis and Clark had to face?"  The answer to my rhetorical question is usually "No!" and off I march to face my task and get it done.

Filed under: Book Review

Source: My Reading Corner : Undaunted Courage

Web design is (finally!) dying of irrelevance. Web pages themselves are no longer the center of the Internet experience, which is why designers need to move on to the next challenges — products and ecosystems — if they want to stay relevant.

Web design has no future — a risky statement I know, but this article explains why it has no future and what we, as designers, can do about it. As a discipline, web design has already exhausted its possibilities, an emerging combination of tech and cultural trends highlight the need for a broader approach.

Let's start with the symptoms of this imminent death.

Symptom 1: Commoditization by templates

Most of the content that you see on the web today is run by some framework or service — WordPress, Blogger, Drupal, you name it. Frameworks provide you a foundation and shortcuts so you spend less time struggling with the creation of a web site, and more time creating content.

As a consequence of the ubiquity of these frameworks, a whole world of free and paid templates lets you get started with a professional-looking design in minutes. Why hire a web designer if you can achieve a fairly acceptable design for a fraction of the cost using a template? Actually, many web designers (especially the ones on the cheaper side) just pick a pre-made template and make some minor branding customizations.

Either way, if your web page is a standard, informational one, there's probably a template out there that can do the job for you.

Symptom 2: Web design patterns are mature

What is the latest web design innovation you can point a finger on? Responsive design? That's digital ages old. Parallax? Useless eye-candy. The web has had all the user interface components and patterns you might need for a while now (and no, parallax is not something we really ever needed). And that's why you don't see much innovation in web patterns as of late.

This maturity is good for users: they will find consistency in their daily use of the web. Checkout forms, shopping carts, and login pages should all behave in a similar way. Trying to get creative at this point will probably be pointless or even harmful.

Symptom 3: Automation and artificial intelligence are already doing the job

There's a new trend of automated web design services, arguably started by The Grid. It's a service to build basic websites which makes design decisions — semantic ones — based on artificial intelligence. It analyzes your content to detect the best layouts, colors, fonts, and extra imagery for your site. Using cleverly chosen design basics (made by humans) as the foundation, it's hard to go wrong with it, and the result will probably be better than what an average web designer can do.

When something can be successfully automated, it means that its practices and standards are established enough as not to need much human input. And this is obviously the beginning. There will be a fierce competition about which service can deliver better designs, faster, and with less human intervention.

Symptom 4: Facebook pages as the new small-business homepage

In the late 1990's, future-minded businesses would buy their .com's, purchase expensive hosting plans, and hire a "web master" in order to have The Web Page, the one that would make them visible to the rest of the Internet. By 2005, creating a site in Blogger or WordPress.com was more than enough for your new wedding photo business (it was also quick and free).

Today, this function has been completely overridden by Facebook pages. They are free, made to be viral out of the box, offer powerful tools only available to big businesses a decade ago (like subscription for updates or media posting), and are as easy to set up as your own profile page. They are so efficient in making a business visible that they are rendering basic web pages useless.

Symptom 5: Mobile is killing the web

How often do you visit a web site from your mobile device by directly typing the address? Only when you don't have the app, right? People don't seem to think much in terms of web pages these days: they think of digital brands, which mostly translate to apps or subscriptions (likes, follows, etc). That's why most big websites, blogs, and portals are pushing their mobile apps to you — out of home screen, out of mind.

Mobile web has always been slow and cumbersome. Typing addresses is weird. Navigating between tabs is weird. Our underpowered mobile devices and saturated data networks don't help create a smooth web experience like the one we have in our desktop machines.

As vital as responsive web design is (not adopting it is commiting digital suicide), it only guarantees that your user can view your page in a mobile device, if she ever finds it in first place. And the limited space in her mind is already mostly occupied by apps.

The rise of web services and the content that finds you

The truth is, we need fewer web pages, not more of them. There are already too many competing for our attention and assuming selfishly that we have all the time in the world to close pop-up ads, explore navigational hierarchies, and be dazzled by transitions, intros, and effects.

But what really matters is not how you arrange things on a page: it's the content, in terms of a specific user need. That's why Google is starting to display actual content in some search results, without you having to visit another page. Just an example: if you Google a nearby restaurant from your mobile device, the search results include a button to directly call the place. You don't even need to visit the page. The page designer's ego and the visits-counter may suffer a bit, but ultimately the user experience is improved.

Things are moving in the direction of digital assistants like Siri, and especially Google Now with the new changes announced for Android M: they aim to provide you the exact bit of information you need, when you need it. This implies a shift from web pages to web services: self-sufficient bits of information that can be combined to other services to deliver value. So if you are looking for a restaurant, you get the reviews from Foursquare or Yelp, the directions from Google Maps and the traffic conditions from Waze.

Even more: we are transitioning to a push-based model of content consumption, where the right information arrives without you even requesting it. Google Now, for instance, warns you of how early you should depart in order to arrive on time to your meeting. All of this is already happening thanks to APIs — interfaces that let other services interact with your data. In this world, web pages are not required at all.

This is not to say that web pages will die — they will be around for a long time, because they are — and will continue to be — useful for certain purposes. But there's nothing interesting there for designers anymore. They are a commodity and a medium, no longer the default state for digital products and businesses.

Web pages are static content that need to be found and visited (pull-based). But in the emerging push-based paradigm, the content finds you. Through data obtained from your context, your activity, and even your biometrics, content and tools will smartly present themselves to you when you are most likely to need them.

That's the big thing about the new breed of smartwatches: they obtain data from your body and show you proactively tiny bits of information for your brain to chew on. Computer technology is already making big steps in order to dissapear from your sight.

Where does this leave us?

Web design is dead, long live UX design

Here's the good news: designers are really far from being obsolete. Quite to the contrary, you can see that the demand for UX designers is still on the rise, and everyone seems to be redesigning their digital products these days.

This switch from web design to experience design is directly caused by the shift from web pages to digital products, tools, and ecosystems. Web pages are just part of something much bigger: mobile apps, API's, social media presence, search engine optimization, customer service channels, and physical locations all inform the experience a user has with a brand, product, or service. Pretending that you can run a business or deliver value just by taking care of the web channel is naïve at best and harmful at worst.

And all these touch points need to be designed, planned, and managed. This is a job that will continue to exist, regardless of the channel. We will still need cohesive experiences and valuable content across smart climatizers, virtual reality devices, electronic contact lenses, and whatever we invent in the decades to come.

In fact, as technology fades into the background, all we can see is the value transmitted by it. The designers who want to stay in business need to be experts in managing content and value across channels.

It's time for us to grow up, because we have been part of the problem: We have helped to give birth to self-righteous web pages that assume they deserve to be watched and awarded just for the time we invested in crafting them. Now more than ever, in a world flooded with cognitive noise, the world needs simple, intelligent, integrated ecosystems of information. The sooner designers embrace this need, the better prepared we'll be for the future.

This article originally published at UX Magazine here

Source: Web design is dead

Hey everybody! I want you all to know that I have a new blog at topherhallquist.wordpress.com. I know a lot of people have been unhappy about the awful ads and awful commenting system on my Patheos blog, which has in turn left me not-very-motivated to blog more, which has led to the blog just sort of dying. This is my solution to that.

Also, it's been at least a year since I've done much atheism blogging here. I may still post here when I have things to say about religion (which I still do, in spite of being busy with other stuff lately). But non-atheism stuff will likely be at the WordPress blog.

I'm currently just using a default WordPress theme, and may try to prettify the blog in the future, but when I set it up I wanted to make sure I got an actual blog post out right away. So here it is: The case for donating to animal rights orgs:

This year, I am seriously considering making the bulk of my charitable donations to organizations working on animal rights, specifically Animal Charity Evaluators and two of the charities they recommend, Animal Equality and Mercy for Animals. I wanted to talk about my reasons for this, both to get feedback from other people in the effective altruism movement, and to convince some of them to do the same if I'm right.

Source: New WordPress blog

I don't know about you, but whenever July 4th rolls around I feel the urge to watch the 1996 film Independence Day. Just in case you've never seen it, the movie is about an alien invasion that takes place over July 4th weekend. What makes the film super amusing is the crazy mix of cast members. I'm talking about Will Smith, Jeff Goldblum, Bill Pullman, and more. Don't get me wrong, it's an extremely entertaining movie. However, there are so many moments that will make you laugh out loud. As a celebration of July 4th weekend, I've compiled a few clips below.

You can't forget about President Bill Pullman's inspiring speech…

Did you know that there's going be a sequel? Yep! It's going to be called Independence Day: Resurgence. Jeff Goldblum shared this photo on his Facebook the other day commenting on Liam Hemsworth photobombing him. This alone makes me so excited for the release.

Christine Marie is a Staff Writer at Bleeding Cool, and bibliomaniac with a love for all things creative. She hopes to one day be a Superhero/Disney Princess/Novelist. You can find her on Twitter and Instagram @AWritersWay or on her blog writerchristinemarie.wordpress.com.

Source: Favorite Moments From Fourth Of July Movie Independence Day