Create an Awesome Home Business » Wordpress

WordPress Security is Not Just About WordPress

Martin — Mon, 04 Jan 2010 13:48:20 +0000

One of my customer’s WordPress installations was hacked and turned into an attack site over the weekend.

I got a plea for help on New Year’s Day because she couldn’t view her site or log in – she just got an error message whenever she tried to do either.

When I reviewed the file that was referred to in the error message I found some scripts had been added.

Two other files in the wp-includes directory had also been updated at the same time, so I deleted all of them and replaced them with clean versions.

When I then accessed her site to check it was working OK, I got two Malware files dumped onto my PC – so they had infected more than the 3 files I found.

My first step was to clean up my own PC. Luckily AVG, CleanUp! and Malwarebytes did a great job on that, so I was back in action again in an hour or so.

My next step was to access my customer’s site via FTP to delete the database and the entire WordPress installation.

Then I set up a new database and installed a clean version of WordPress.

In the process I took the following security steps:

Created unrelated usernames and passwords for the database – long and complicated
Changed the wp- file and folder prefix to something else
Changed the default ‘admin’ username to something else – long and complicated. I set out a process for doing that here.
Created a long and complex password
Installed WP-Security-Scan and checked all the file permissions
Made sure the WordPress version was not visible
Installed Login Lockdown to lock out anyone attempting to use an incorrect user ID or password to log in
Installed a blank index.html file in the wp-content/plugins and wp-content/themes directories (to prevent anyone seeing what plugins or themes were installed)

And two and a half hours after I’d completed everything her site was hacked again.

They got in because they had a copy of her FTP login details, which they’d obviously stored so they could use whenever they wanted to.

Although I’d given strict instructions for her to change her FTP password, she’d not had a chance to do so after I’d finished everything.

And the lesson is…

Nothing could more clearly illustrate the point I made in this article that WordPress security involves more than just making your WordPress installation secure.

You need to consider your PC and your FTP accesses – i.e. your entire online environment.

There’s no knowing for sure how the scammers had got hold of her FTP login details, but some of the ways would include:

Intercepting email which contained them
Having a keylogger (malware) installed on her PC which captured them and sent them back to the scammers
Intercepting them during an FTP transfer.

So the message is this:

In addition to taking all the security precautions I referred to above on your WordPress installation itself, make sure your PC is (and stays) clean and, if you’re regularly uploading stuff to your WordPress site, use SFTP rather than FTP.

It goes without saying that you should be using one of the Internet Security products from a reputable supplier. And that means the paid version, not the Anti-Virus version which is usually free.

But I also use two other products:

Malwarebytes, which is an excellent product and free to download.

A couple of years ago I got a Trojan on one of my PC’s which I couldn’t get rid of. McAfee couldn’t find it, Spybot S&D couldn’t find it and Adaware couldn’t find it.

But Malwarebytes did.

And since then I install and use it on every PC I own and every PC I’m setting up for someone else.

As long as you have one of the Internet Security products running you only need to run Malwarebytes manually every few days. Make sure you update it before you run it, because they release new signatures every day.

And, by the way, although I’m delighted with the Internet Security product I’m using, Malwarebytes still picks up stuff that it misses.

The other product I use (also free) is CleanUp!. This focuses more on clearing out your temporary files, but I needed it the other day because I opened a copy of the infected file from my customer’s site to review it on my PC.

Although I didn’t save the file, a copy was still sitting in my temporary files folder and CleanUp! zapped that one for me.

Summary

Long story short, then:

Make your WordPress installation as secure as you can – follow the steps above
Make sure your PC is clean and stays clean
Use SFTP rather than FTP
Backup your site (database and system files) at least weekly. Preferably more often. But be careful not to restore an infected version.

Can Changing Your WordPress Theme Affect Your Search Engine Love?

Martin — Thu, 10 Dec 2009 09:15:43 +0000

Yes, it can is the short answer.

I used to think of a theme as nothing more than a nice colour scheme when I first started blogging. As long as I liked the colours, and as long as it had enough sidebars, I was a happy camper.

How wrong I was.

WordPress themes have progressed enormously since those days (only 3 years ago), but even back then if I’d known what I was doing I’d have paid a bit more attention.

Here’s how they can impact your search engine love:

Free Themes

The first thing to be aware of when looking for free themes is that there’s nothing to stop the author from hiding links in it.

Which means that by activating his theme you could be providing links back to his site (if you’re lucky), or to some spam or scam site if you’re not.

The search engines will not be pleased about the spam and scam links.

Even if he hasn’t hidden links in his theme, the author’s coding skills will have an impact on how easily the search engines can find their way around your blog, and understand what it’s about.

And that’s important for good search engine rankings.

So yes – even at the most basic level, changing themes can affect your rankings (either positively or negatively) just based on:

Whether or not the author has hidden links in it
The quality of the his coding (CSS, HTML and PHP)

Don’t get me wrong – there are some very good free themes out there, but there are also some pretty awful ones.

So if you’re going for free, you need to make sure it’s a good one.

Premium Themes

WordPress caused a bit of a stir a while ago when they decided that the only themes they would approve had to be GPL – free to download and install. For a short while Premium Themes became the target of some speculation.

But, having used the Thesis theme for a year now, and another premium theme prior to that, I can tell you that there’s no way I’d ever go back to using free themes.

You not only get rid of the chances of being stuck with hidden spam links, you greatly increase your chances of having well coded CSS, HTML and PHP. This, as I said earlier, will help the search engines.

Plus, modern premium themes provide all sorts of additional functionality that builds on the flexibility of WordPress.

For example, some themes (Thesis among them) enable you to set META tags and settings both for your blog as a whole and for each individual post and page within it.

This greatly improves the visibility of your blog and articles to the search engines, and it enables you to drop SEO related plugins.

For example, I used to automatically install the All-in-One-SEO-Pack and Robots-META plugins on new blogs. Now I don’t need to, because Thesis gives me the same options.

Of course, if you weren’t using any SEO plugins to start with, this will bring you a whole bunch of SEO benefits you didn’t previously have.

Further, many premium themes will enable you to change the layout and design of your blog by selecting various options in the control panel.

So as long as your theme is capable of it, and your imagination can cope, you no longer need to go hunting for new themes. You can change your blog’s appearance whenever you want to and not lose the settings and SEO benefits you’ve built up.

Themes these days, particularly premium themes, should be thought of as supplementary platforms which extend the functionality of WordPress.

As such, the quality of their coding and the functionality they provide can have a big impact on your blog’s search engine rankings.

How to Change Your WordPress Username

Martin — Tue, 08 Dec 2009 06:25:43 +0000

I was helping someone get their blog configured the other day and we came to setting up WP-Security-Scan – one of the plugins I do recommend.

It takes you through some pretty straightforward steps that will strengthen your WordPress installation against mass bot hack attacks.

One of the recommendations it makes is to change your login user name from the default ‘admin’ to something else.

Here’s how to do that:

From your hosting control panel click on PHPMyAdmin. You’ll see a screen like this:

Find and click on the ‘Databases’ link (circled above).

The next screen you’ll see is this:

It lists all your databases on the left. I’ve blacked mine out, but trust me – those are your databases!

Click on the database of the blog on which you want to change your login username. You’ll come to this screen:

Look for the users table. Unless you’ve changed your prefix it will be called wp_users. My users table is circled above.

In the users row click on the first icon: browse (2 above). The next screen you’ll see is this one:

If you’re the only person with a login you’ll see just one row there. If you have others on your blog with logins, look for the one that’s called ‘admin’, and click the ‘edit’ icon, 1 above (and circled).

The next screen you’ll see is this one:

In the ‘user_login’ row above look to the right and replace ‘admin’ with a new user name. When you’ve typed a new user name click ‘Go’ at the bottom right of the table (it’s not shown in this screenshot).

After clicking ‘Go’ you’ll be taken back to a screen that displays your new user name in the ‘user_login’ field:

OK, you’re all done in PHPMyAdmin now, so you can log out if that option’s available or just close that window if it’s not.

Next go to your WordPress login screen and login with the new username and your existing password.

Go to your profile screen and you’ll see your new username displaid:

That’s it – you’ve changed your WordPress login username and made your blog more secure as a result.

1 More Plugin Bites the Dust

Martin — Thu, 03 Dec 2009 08:35:33 +0000

Back here I wrote about the benefits of using as few plugins as possible on your site.

As is typically me, this has turned into a bit of a crusade (removing plugins from my site, that is).

Here, again, are the reasons for my crusade:

Plugins can slow down site load times, they may fall behind WordPress developments (potentially causing problems after upgrades) and they create more to go wrong.

So this week I removed another plugin and replaced its functionality with alternative means.

Here’s what I did:

The plugin I removed was the Redirection plugin.

Before we go any further let me make it absolutely clear: Redirection did a great job for me.

I experienced absolutely no problems with the plugin itself and, if you’re not ready to play around with your .htaccess file, this plugin will handle redirects for you without any problems.

But remember my crusade: I’m progressively removing as many plugins from my site as I can, replacing them with other ways of achieving the functionality they provide.

My experience and use of Redirection

Redirection does a number of things:

It enables you to set up manual re-directs where you change a post permalink
It automatically creates a 301 redirect if a permalink (post URL) on your site changes
It logs 404 errors
It provides statistics and reports on anything to do with redirects and 404 errors.

It’s a powerful plugin and I had it installed for about 18 months in total.

During that time I set up 4 manual redirects where article permalinks had changed. I set these up when I originally installed Redirection. In fact the reason for installing it was because I changed the permalinks on those 4 articles to make them more SEO-effective.

No auto redirects were set up by the plugin during that time because no permalinks on any other articles were changed.

I want as few 301 redirects as possible on my site. So I always give a lot of thought to permalinks when I publish new articles in order to avoid any temptation to change them later.

With that low level of use, I figured if I could learn how to set up 301 redirects manually in my .htaccess file I could do away with Redirection, saving myself another plugin.

What I did

I searched online for tutorials on how to set up 301 redirects.

301 type redirects, by the way, are permanent redirects. These are better for SEO purposes (you don’t lose incoming links) and they also update the visitor’s browser if they already have the page bookmarked under the old URL.

Most of the information I found focused on redirecting existing pages to another URL. In other words – there’s an actual page at link (a) and you add the redirect script to that page (or create a page in a folder and add a PHP redirect call) to send visitors to page (b).

Visitors are being redirected from one page to another.

But when you change a permalink in WordPress there’s a big difference:

You’re not redirecting visitors from one page to another. You’re asking the server to display the same page which now has a different file name from the one the searcher typed in.

You achieve this via the .htaccess file.

As long as you’re running WordPress on a Linux/Apache server you will have a .htaccess file in your blog’s root directory. If, for any reason, you don’t then you can add one.

In that .htaccess file you can type the following command to re-direct visitors to the new permalink:

redirect 301 /old-post-slug http://www.example.com/new-post-slug

Take careful note of the spacing.

Notice, also, that you don’t include the entire URL for the old post. You only need to include the /old-post-slug (if your blog is installed under the root domain name) or /directory/old-post-slug if your blog is installed in a directory under your domain.

But the new URL does need to include the full address, even if it’s on the same site.

So, using that format, I set up redirects in my .htaccess file for the 4 articles I referred to earlier and, hey presto, another one bit the dust. (Plugin, that is).

This will work for most WordPress users because you’re likely to be hosting your site on a Linux/Apache server. If you’re on a Windows server this won’t work for you because Windows doesn’t support the .htaccess file.

But most importantly: take a copy of your .htaccess file before you make any changes to it. It’s a powerful file and screwing it up will likely make your blog disappear into the ether.

If the unthinkable does happen, you can use FTP to restore the back up copy of your .htaccess and you’ll be back in business in no time.

What would be great to know is what you’ve done to remove plugins. Leave a comment telling us what plugins you’ve removed and how you replaced the functionality they provided.

3 Things to Look Out For With WordPress 1-Click Installs

Martin — Thu, 19 Nov 2009 05:25:22 +0000

The 1-click installation service offered by most hosting providers for various applications is wonderful.

In particular, it’s opened up self-hosted WordPress blogging to a whole tribe of people who might have baulked at the manual installation.

But there are some things to keep in mind.

And please don’t take these as criticisms – they’re not, because most of them have plus sides.

An important point to start with: the way your hosting provider sets up and manages the 1-click installation scripts affects every point that follows.

Character set

WordPress uses and recommends the character set UTF-8. However some Fantastico installations have used Latin in the past and this can cause problems with some themes.

I first realised this during the testing of Thesis 1.5, when some beta testers reported some apparently quite serious problems that were eventually traced to the character set. Turns out they were running Fantastico installations of WordPress, and Fantastico had used Latin.

Chris Pearson and the Thesis development team made the adjustments to accommodate this character set before 1.5 was officially released, but other theme authors may not be so diligent.

Moral of the story:

If you’re having problems with the way stuff is displaid on your site try activating the default WordPress theme. If the problem goes away you know it’s theme related.

You may be able to change the character set (in the WordPress Settings>Reading screen) but it would be worth checking with your hosting provider to make sure it won’t create problems elsewhere.

WordPress version

One of the sites that I’m a member of offers hosting, including 1-click installations of WordPress, as part of its member benefits package.

Unfortunately, the version of WordPress that their script currently installs is WordPress 2.0 – an archaic version in WordPress terms.

Even upgrading from that version is a pain because there was no auto upgrade in those days.

Hosting providers should always keep the version of WordPress their scripts install current, especially if the latest version is a security upgrade.

Moral of the story:

Check the version of WordPress you have as soon as you’ve done a 1-click installation and upgrade if necessary. It’s only a click of a button (from 2.7 on), and it takes about 10 seconds these days.

Themes and plugins

I was helping a friend recently who had just done a 1-click installation and I was showing them how to back up their system files.

Turned out their brand new installation, not even any posts on it yet, had over 2,800 files.

I was puzzled because this site, which has been going for 3 years now, has just under 1500 files on it.

A bit of digging revealed that her hosting provider had included 42 themes and 8 plugins as part of their 1-click install.

This is a definite benefit of you’re new to WordPress and not ready to go hunting for, and manually installing new themes.

But it almost doubled the size of her site, meaning that full site back ups (if she were to do them by FTP-ing everything back to her PC) would take twice as long as they needed to.

We deleted everything but the theme she was using and the default theme, reducing the bloat on the site by nearly 50% right off the bat.

Moral of the story:

Check to see if your installation has lots of themes and plugins already installed.

If you know what you want (in both cases) delete the pre-installed ones to reduce bloat and install the themes and plugins you want.

If you don’t know what you want, then leave things as they are. Once you’ve made up your mind on your themes and plugins you can blitz the rest.

If you have other tips or hints relating to 1-click installs (good experiences or problems) leave us a comment!

How to Avoid Ping Spamming

Martin — Mon, 16 Nov 2009 23:30:14 +0000

I saw one of those VERY IMPORTANT READ THIS NOW posts in a forum the other day. It was all about how WordPress could get us banned from the search engines.

I normally don’t go anywhere near posts with titles like that, but considering the mutual love affair between Google and WordPress I was intrigued.

Apparently all WordPress users were suddenly going to be labelled as spammers because of the built in pinging functionality. (Wordpress tells blog syndication services like Technorati whenever you publish a new article).

We’re not, and here’s why:

The first misconception was that WordPress pings the services (lets them know) every time you edit, save or publish your article.

It doesn’t.

It only pings them when you publish a post for the first time or update it after publishing.

So you can edit and save your posts as many times as you like – and you won’t become a spammer.

The cure for this ‘problem’, according to the forum post, was to download and install a plugin.

Not only is this absolutely not necessary, it may have a negative impact – if not right away then later.

As I’ve written elsewhere, I do suggest restricting the number of plugins you use. The more plugins you have the more likelihood of something going wrong.

And if a plugin author stops updating his plugin you may experience problems after future WordPress upgrades when his plugin is no longer compatible.

In any case, a plugin in this case is completely unnecessary.

WordPress provides a Preview function:

So when you’ve written your article, add your tags, categories and any other settings you use, then click ‘Preview’. (If you’re updating a post it will say ‘Preview Changes’).

Your post will open in a new window, displaid exactly as it will look when it’s published, and you can check layout, links, images and everything else.

Since it’s in a new window you can switch back to the edit window to make changes as you need to.

And none of this activity will be pinged to Technorati and the rest.

You can save your post as a draft, edit and re-save it as many times as you like, preview it as many times as you like, and Technorati and it’s friends won’t know a thing about it.

Until you hit publish.

That’s when your article will be pinged.

So the lessons are:

When you want to see how your post will look in the flesh use the Preview function.
When you’re editing and saving it – use the save button, not the publish (or update) buttons.
Only hit publish or update when you’re finally satisfied with everything.

Then you won’t be labelled as a spammer and you’ll have saved a plugin.

Stop! Do You REALLY Need That Plugin?

Martin — Thu, 12 Nov 2009 07:21:29 +0000

If you read (and remember) any of my articles from a few years back you can take me to task now.

Because back then I raved about plugins and added them to my WordPress sites at will.

But I’ve changed my mind.

Don’t get me wrong. There are some excellent plugins that do great jobs.

But they can also slow down your site, create PHP errors and create problems after WordPress upgrades.

There are more than 4000 plugins available now, which enable you to add almost any functionality you want to your site.

But there are a few questions to consider before installing one:

Does this plugin need to access external sites during the site load process (like share this or related sites type plugins)?
How often is this plugin updated? (But keep in mind that simple plugins probably don’t need to be updated that often).
Does the plugin author look as though they’re here to stay? (Do they have other plugins? Is their site professional and does it look as though it’s been around for a while? Does the author provide quick and responsive support)

Accessing external sites

If your plugin needs to access an external site to do its thing (such as a share this or related sites type plugin) you may be dependent on that site being available and responsive for your site to load fully and quickly.

It depends on where the plugin sits in your page, but if it sits above your content in the HTML (source code) view, and the site it needs to access is slow or down, this will greatly slow down the load time for your site and may stall it altogether.

In which case you’ll lose a reader.

Two plugins I’ve used in the past have caused slow load times and PHP errors, that were initiated by the sites they needed to access for information.

I removed them.

How often is this plugin updated

This one goes hand in hand with point 3. Some plugin authors simply stop supporting their plugins. Remember – the majority of plugins are free and most authors do it for love.

But if something else comes along that takes their focus away from their plugin they may well stop supporting it.

This means that at some point (usually after a WordPress upgrade) it will cause a problem on your site, because it won’t have kept pace with new WordPress functionality and design.

Again – this has happened to me in the past, although only once (so far!).

More to go wrong

And finally, adding plugins creates more opportunities for things to go wrong.

They could have security holes, and they may clash with other plugins, or with your theme. They may even clash with your version of WordPress.

And they increase the size of your site.

I recently removed 3 plugins from this site (and by ‘removed’ I mean deactivated and deleted), and the overall number of files on my site was reduced by a little over 250. (That reduced bloat on my site by 14%).

So I’m now steadily reducing the number of plugins I have on my WordPress sites and using alternatives wherever possible.

For example, I don’t have any Twitter plugins – my posts are Tweeted by RSS.

I don’t use a plugin to manage the number of times my site pings the ping services – I use the Review function in WordPress and only publish or update my post when I’m happy with it.

There are lots of excellent plugins that do great jobs. But if you have plugins on your site that you don’t absolutely need, then remove them.

How To Make a WordPress Post Sticky

Martin — Tue, 03 Nov 2009 04:48:15 +0000

I see a lot of questions asking how to make a WordPress post sticky.

A sticky post is one that stays on the front page of your blog so that, same as sticky posts in forums, it will always be displaid first.

What’s the point of that?

It depends on the content of your blog, but any post you want everyone to read would qualify.

It could be your commenting policy, directions for how to achieve something on your site or notice of an important upcoming event.

There’s a difference between Featured Posts and Sticky Posts:

Featured posts are driven by your theme and, depending on your theme’s functionality, you can set criteria in your control panel that will enable it to define which posts should be featured.

Featured posts could change automatically as different posts meet (or fall short of) your criteria.

Sticky posts in WordPress are simpler, and driven by WordPress rather than your theme. You flag a post as sticky and it will stay on your front page until you remove the sticky flag.

So, here’s how to make a post sticky:

In your Add New Post screen, to the right of the editing window, is the Publish Box (1 below)

Inside the publish box are 3 factors you can edit: status, visibility and publish (2 above).

If you click the edit link next to ‘visibility’ the rows below it will expand.

Under the first option (public) is a sub option: ‘Stick this post to the front page’.

Click the check box to make the post sticky and it will be stuck to the front page of your blog until you uncheck that box again.

That’s all there is to it – no need for plugins or anything more complex.

How to Set Up The Google XML Sitemap Generator

Martin — Tue, 06 Oct 2009 04:50:22 +0000

Many thanks to Jake Hyten for asking this question: how to set up the Google XML Sitemap Generator Plugin.

Thanks for your question, Jake – and the steps follow with the greatest of pleasure

Firstly, why would you want to install the Google XML Sitemap Generator Plugin?

Because it creates a sitemap for the Google, Bing, Yahoo and Ask search engines, automatically re-builds it whenever you write or edit a post and pings those 4 search engines as soon as you publish it.

Under estimate the value of that at your peril!

All your sites should have XML compliant site maps because they help the search engines work out what it’s about. And they can’t send you traffic if they don’t know that!

But a normal static sitemap that you can create at any number of places on-line needs to be updated manually every time you add or remove a page.

A bit of a pain.

The Google XML Sitemap Generator Plugin does everything automatically. A huge time saver.

Further, if your blog’s in a sub-directory you can locate your Sitemap Generator in the root folder and have it generate a sitemap for your entire site – not just your blog.

That’s really cool.

So here’s how to set it up

Step 1: Click on the XML-Sitemap link in the Settings section of your menu.

You’ll see this screen:

The top section (above Basic Options) just gives you key information about the last time your site map was built. Unless you’ve initiated a manual build, this will be the time of the last post you published.

Step 2: Set some initial options in the Basic Options section.

I normally check all of the options except ‘enable manual site building via GET request’. This option enables you to manually initiate a sitemap build remotely – via a mobile browser or PDA for example.

I don’t blog by email or use desktop applications to create new posts, so I don’t have any need for this functionality.

However, if you do use desktop applications to update your blog then checking this option will enable you to access and rebuild your sitemap manually, and remotely. The auto rebuild of your sitemap doesn’t always happen when you post with desktop applications.

In order for the plugin to notify Yahoo whenever you update your blog you’ll need to get an application ID from Yahoo.

This is very straightforward: clicking the link underneath the box for your application ID will take you to a Yahoo sign in page, and logging in to your Yahoo account will take you to the application account set up page.

Fill out the fields on that page. If your blog is in a sub-directory be sure to enter its full URL (i.e. http://www.yourdomain.com/blog) . Ignore the check boxes at the bottom (they’re greyed out anyway) and click ‘Continue’.

The next screen will display your application ID key. Copy it, go back to the basic options section and paste it into the field provided.

The Advanced Options are all about improving the efficiency with which the plugin operates – by increasing memory, limiting the time it’s allowed to take to re-build the sitemap or limiting the number of posts to be included.

Unless you’re experiencing problems with your sitemap taking too long to re-build itself after publishing a post, you should not normally need to touch any of these.

Step 3: Additional Pages.

If your blog is in a sub-directory and you want the XML Sitemap to include other (non WordPress) pages from your site, then you should add the address of your root or other directory in this section.

Click the ‘Add New Page’ link at the bottom of the section and enter the details.

You’ll also need to move your sitemap.xml file to the directory you’ve specified (covered in the next section).

Step 4: Set the post priority calculation method (see 2 in the image above).

Prioritisation is a way of directing the robots to the most important pages on your site.

I do not use automatic prioritisation, so I check the top radio button.

Automatic prioritisation frequently results in the index page of your blog (the starting page) getting the highest priority and all the others getting the same priority just below it.

I prefer more granularity and I also prefer my posts to have a higher priority than my home page. This is because I take care to optimise each of my posts, so giving them a higher priority here makes the best use of the optimisation I’ve done.

I also like to raise the priority of my static pages.

For some strange reason the actual setting of priorities in the plugin is done at the bottom of the page rather than here, so I’ll come back to that later with a screen shot

Step 5: Define the location of your sitemap file.

On the site from which these screen shots come, WordPress is installed in the root directory and there are no other files or pages in the domain. Therefore I’ve just accepted the default location setting.

On another of my sites, though, WordPress is in a sub-directory and on that site I’ve moved the sitemap file to the root directory so I can have it map all the pages on that domain.

If you do that you need to specify both the path to the sitemap file and the URL of the sitemap file. The plugin will suggest both elements – see the examples above – just edit them as necessary.

(I’ve blacked out the actual paths for my sitemap in the image above, but where the blacked out bits are the plugin will suggest the path based on your actual server set up and sitemap location).

Step 6: Sitemap content (second section in the image above)

In this section you can specify what should be included in your sitemap.

Removing unnecessary content reduces the sitemap build time during your post publishing process, and that will speed up the publishing of your new articles.

I’ve excluded the ‘following pages of multi-page posts’, ‘archives’ and ‘author’ pages.

Archives and author pages because the content of these pages is already indexed in posts and static pages, and following pages of multi-page posts because it’s un-necessary.

Step 7: Excluded items.

This section allows you to exclude categories from your sitemap.

Used along with the noindex meta tag, this is a way of protecting categories that you want to keep private or restricted to selected viewers.

If you don’t want posts in a specific category to turn up in search results you can check the category here.

Likewise, if you want to protect specific posts list their IDs in the box at the bottom.

To increase the protection of posts you want to keep private you should also specify ‘noindex’ in the ‘Robots’ meta tag for each post or page you want to protect.

Step 8: Change frequencies

The second item in the image above allows you to tell the robots how often specific pages are likely to change on your site.

The site I’ve taken these shots from is set up with a static page as the start (Home) page, so I’ve set the home page to a weekly update while my posts are set to daily update.

If your blog is set up as a blog – i.e. where your home page reflects your most recent posts – then you should set the home page and the posts update frequency to the same.

For the rest you can see the frequencies I’ve selected – you’re welcome to use the same or vary them depending on how you operate your blog.

Step 9: Priorities

This is the section I referred to earlier – it’s where you can set your priorities if you choose not to use automatic prioritisation.

In this section I’ve set the highest priority to both posts and pages. As I mentioned earlier I optimise those every time I publish a new one, so giving them a higher priority here helps to make the most of that optimisation work.

My Home page in this image is set at a slightly lower priority than my posts and pages because of the way I’ve set up this site, using a static page as the start page.

On my other WordPress site, which is set up as a traditional blog, I’ve set my home page at the highest priority. This is because the Home page will change every time I write a new post.

For the rest of the elements you can see that I’ve set tags and category pages much lower and archives lower still.

These are all just other ways of looking at the same data on your site and, having set high priorities for pages and posts and not excluded any elements from the sitemap, I’ve got everything covered in the most efficient way possible.

OK, so that’s how I set up my Google XML Sitemap Generator Plugin. How do you set yours up? Leave a comment and let us know.

How to Copy and Paste From Word to WordPress

Martin — Mon, 28 Sep 2009 06:29:01 +0000

Another question I see quite often is people asking how to copy a post developed in Word into WordPress.

I create all my posts initially in either Word or Open Office, because with both of those packages I get spelling and grammar checking and the ability to test different layouts.

Once you’re satisfied with the layout, and the spelling and grammar checkers have given their approval, it should be a simple case of copying the completed text (fully formatted) into WordPress.

But it’s not.

And here’s why:

Word uses a bunch of code to create the styles you set up – heading 1, heading 2, bullet points, etc – and this code clashes with the HTML based code that WordPress uses to do the same thing.

The result is usually not pretty.

This leaves you with 2 options:

First option:

Copy your text from Word and paste it into Notepad, then re-copy it and paste it into WordPress

Pasting your text into Notepad has the effect of removing all the code that Word uses. The obvious disadvantage is that it also removes all the styling.

Therefore when you re-paste it into WordPress you have to do your styling all over again.

But you will be starting with a clean sheet, as if you had drafted the article from scratch in WordPress.

And that means you won’t get code clashes messing up your layout.

There’s another glitch you have to look out for with this method: sometimes when you paste your copy into Notepad single quotes (which are usually ’smart’ quotes in Word) are pasted as angled quote marks in Notepad. They look like smart quotes but don’t have the code supporting them.

When these are re-pasted into WordPress they’re transferred as angled quote marks and these are not recognised in a number of environments – most frequently in RSS feeds.

The result is that your RSS feeds will contain nonsense characters whenever one of these angled quote marks appears. This glitch also affects dashes (the minus sign).

Therefore if you use this approach you really need to delete and re-type quotes and dashes if you want to be sure that your content will show up without nonsense characters in as many different environments as possible.

I’ve found the easiest way of doing this is to re-copy the article from Notepad and use the ‘Paste as Plain Text’ button (see below):

Clicking that button will bring up a small window and you can paste your copy from Notepad into this window.

For the most part the angled quotes will be converted to simple quotes and the dashes will also be sanitised. But you still need to run an eye over the article to check.

Once you’re happy, you can click the ‘Insert’ button and your article will be pasted into your Add New Post content window, where you can get stuck into your formatting.

This option is a pain in the butt, but it is the best way of ensuring the cleanest display of your article wherever it appears.

Second option:

The second method is to use the ‘Paste From Word’ button

This method has the advantage of retaining the styling you created in Word – here are some screenshots:

This is the original document done in Word 2007, and I’ve circled two ‘heading 2′ items and a bullet list:

Copy the document from Word and, in the Add New Post screen, click the ‘Paste From Word’ button (see the first picture).

That will open a small window into which you can paste your article directly from Word. You can immediately click the ‘Insert’ button.

Here’s how the result will look in the Add New Post content window (I’ve maximised the window here so you can see it more easily):

You’ll see that the heading 2 items have been converted to H2 items and the bullet list has been retained.

To see how it will look when it’s published, click the ‘Preview’ button. Here’s the result, again with the H2 items and the bullet list circled:

Check it over and hit the ‘Publish’ button when you’re happy.

So which approach do I use?

The first one, and here’s why:

Although the first approach is definitely more tedious, it’s the best way I know of ensuring that my content will come out cleanly in as many different environments as possible – especially where it’s picked up by RSS.