Blog

As you are wondering the world wide interwebs, you may have noticed a new thing, websites are asking if you want push notifications when the site update. In this post I’m going to talk about WordPress web push notifications and do you need them.

What Is WordPress Web Push Notifications

When you visit a site with a supported browser such as Google Chrome a popup will appear on your screen asking if you want to get notifications.

Already I’m annoyed yet another popup! I’ve gone for a simple red icon bottom right of the screen.

You don’t need to enter any details, just click on the popup and it is saved.  This is saved in your browser settings.  A unique ID from your browser is sent to your push notification supplier, in my case OneSignal.com.  That’s the sign-up process.

There is a console on OneSignal where I can send out a WordPress web push notification to my subscribers.  The push appears bottom right of my browser and looks like this.

Setting Up WordPress Web Push Notifications

I’m not going to recreate the wheel, here is a great tutorial to make your site use push notifications.

http://www.wpbeginner.com/wp-tutorials/how-to-add-web-push-notification-to-your-wordpress-site/

My Opinion

This is just my opinion, and my feeling, but I don’t want all the sites I follow jumping onto my browser screen shrieking that there is a new blog post, I prefer to coral all my blog posts into my feed reader or get them in my inbox for later reading.

Do we need another notification?  Think about your mobile phone, it beeps at me too many times, and I’ve deactivate a lot of mobile push notifications.

Browser notifications are intrusive, they popup and demand your attention when you are working at your desktop, flow is broken no matter how focused you are.

I’ve effectively used web push for my helpdesk software notification and live chat software which is client related.  I need that alert, but do I want an alert jumping onto my desktop when Johnny posts about his new pet cat?  No I don’t.

Experiment

I’m adding push notification onto WP Dude until Thanksgiving 2017.  This will allow you, the reader, to see push in action if you have not seen it, and get an update about my blog posts to see if you like it.  I might even try to sell you some services, how annoying.

I’ll be monitoring sign ups to see how effective this technology is for marketing.  I’ll look at sign up rate and click through from my push notifications.

I don’t like the technology so as I sit writing I don’t think I’ll keep it, but I may be surprised by how effective it is. I’m open to this experiment.

Can I ask you to sign-up to test the system? Click on the red icon bottom right.

I’ll write a follow up post at the end of the experiment.

Wrap Up – WordPress Web Push Notifications

As you can no doubt tell I’m not a fan of this technology.  It is far too intrusive in my humble opinion.  I’m prepared to have my opinion changed if it is effective, but there’s no lead magnet delivery in exchange for sign-up.

Photo Credit: lenswrangler Flickr via Compfight cc

What is two phase authentication?  I’ll tell you, it’s an additional control you can add to you WordPress site to increase security.

Phase One

The first phase of authentication is your standard WordPress login user ID and password.

Phase Two

You are asked to enter a code which is sent to a device, usually your mobile phone.

Types Of Phase Two Authentication

There are a number of ways the code for phase two here are some examples:

• An app that give you a code
• You are sent a text message with a code

Phase Two Has An Expiration Date

The code sent your device has an expiration date, usually just a few minutes.  This means you have to act quickly and login with your code.

If you try to use an expired code, you will not be able to authenticate correctly.

Always With You Device

The beauty of this process is that the code is sent to a very personal, always with your device, your mobile phone.

A hacker could crack your user ID and password but they would have to go to another extreme level and find you and then steal your device to complete the process.

I like to think of security as a series of layers of control, the more layers the more annoyance you give to the hacker.

My Preferred Tools For Two Phase Authentication

My preferred tool is from Google and it’s called Google Authenticator, it is an app you install on your phone and a plugin you install on your site.  Here are the links.

https://en-gb.wordpress.org/plugins/wp-google-authenticator/

Android App

Apple App

VIDEO – Two Phase Authentication In Action

Here is a video walk though of me creating a user with 2 Phase authentication.

Wrap Up – What Is Two Phase Authentication?

It’s an additional level of authentication.

Just because you have 2 phase authentication activated, does not mean you are 100% safe, if the hacker has ftp access they can deactivate the plugins or create a new user which is not authenticating.

As I said previously I think of security as a multiple layer cake, the more layers, the tighter the security.

Do you need help hardening the security of your WordPress site, why not get a quote.

Photo Credit: drpeterrath Flickr via Compfight cc

“Why has my site been hacked?”. I hear this a lot from site owners who’s site has been attacked, and I inevitably tell them.

“IT’S PROBABLY NOT PERSONAL”

People feel violated about a hacked, and they have a need to know why this particular blog has been targeted.  In this blog post I want to shine a light on the motivation behind a hack.

Why Sites Get Hacked?

Sites are hacked for a number of reasons, here are the tops reasons I see:

• For kicks – there is an intellectual challenge to hacking a site, and some people do it for kicks, they will leave a little defacement on your site. It’s not a direct attack it’s just a game to them.
• For SEO – the hackers create links back to their site to improve their own SEO.  The more links the more Google will rank your site, so hackers add links.
• For Traffic – the hackers add redirects to their site for more traffic and more business.  They capture hard-earned traffic from your site and send it to theirs.
• Phishing – a hacker installs phishing sites on your site to con people into giving over their details.   The illegal activity is done on your site, not on one that can be traced back to the hacker.
• It’s an attack – I said it’s probably not personal but sometimes it is a direct attack on your business.  I’ll talk about this a little later.

Who Does The Hacking

So the question is who is hacking your site, there are a few groups of people who attack sites.

Black Hat Hackers

These are the hard core hackers that find and open up new ways to exploit sites.  These people are frankly brilliant, their technical skills are high, they dig into code and server configurations looking for a route in.

These people find the route into WordPress sites and pass it to the hacking community.

Script Kiddies

A derogative term for someone using the techniques found but a black hat hacker and exploiting them.  They don’t have any real skills, they just reuse other people’s work.

In my experience these are the majority of hackers I come across.

Brute Force Bots

Sometimes it’s not that clever and it’s simply a bot going to your login form and trying common user name and password combinations over and over again.

Install Wordfence and you will see this is a very common thing.  Here is a screen dump of login attempts on my site.

Vulnerabilities In Core, Plugins and Themes

The main way people get into word press sites is through a bot network brute force or by exploiting vulnerabilities in WordPress core, themes or plugins.

Using scanning tools they will look for a file on your site from a vulnerability, find it then exploit your site.

There is a great tool called wpscan which can be integrated into systems to scan for issues, I have tools for my maintenance clients to do this, then I close the vulnerability.

They keep a database of vulnerabilities which makes very interesting reading, I can bet a plugin or theme you have used is in the database. https://wpvulndb.com/.

Remember that person I mentioned earlier, the back hat hacker, they are probing all the time for vulnerabilities and are always one step ahead of things.  The hacker does not add entries into this database, the security community needs to find these and publish them so the hacker is always ahead of the game.

WordPress Is A Low Hanging Fruit

WordPress powers 27%+ of the internet, it’s a low hanging fruit, finding a vulnerability in WordPress opens the door to more hacking potential than some obscure website scripting system.

This is why WordPress does get hacked, more people are investing time finding loop holes.

Unless It Is Personal

I said it’s probably not personal, but sometimes it is.

Look at your content, is it controversial?  Look at what your business does, would it upset people?  If the answer is yes hackers may be coming at you personally.

I’ve seen LGBGT and religious sites get attacked.  I’ve helped a site supporting Charlie Hebdo with a request security review because they knew they were about to court controversy.

Politics, religion, money difference of opinion opens you up to hackers.

What You Can Do About It

Here are some tips to keep your site protected.

• Have full backups which you save offsite so you can recover from a hack.
• Keep your site updated to close the vulnerabilities as they are found and fixed.
• Harden security on your site, here is a great guide https://build.codepoet.com/tag/hardening-wordpress/
• Install plugins like WordFence of iTheme security to monitor for attacks.
• Use a decent hosting company, cheap hosting often does not have the best techs on their team to keep the servers secure.
• Harden the passwords you use and change them often, consider implementing two phase authentication (I’ll write about this in my next post).
• Give me a shout, I offer security hardening and monitoring as part of my maintenance plan or as a one off package.

White Hat Hacking

I hack people’s sites all the time in my capacity as a WordPress consultant.  I need to get access to fix things, it’s not hard you only need a little bit of access.

It’s white hat and is benign, if I can do it then you can bet a black hat hacker on the edge of the technology can get in.

Wrap up – Why Has MY Site Been Hacked?

It’s probably not personal, it’s some punk kid in their bedroom getting access to your site for kicks probably, unless it’s not :).

Photo Credit: nielskirkedal Flickr via Compfight cc

SEO bullshote why has my site been hacked? No really why has my site been hacked?

You’ve just published your latest blog posts.  You are pretty happy with your work.  You are hoping it has communicated an idea you have well. A few moments later, PING! you get a message from the Grammar Nazi, reaching out from over the interwebs to chastise you.

Here’s how I handle this type of particularly persnickety person.

What Is  A Grammar Nazi?

A grammar Nazi is someone who reaches out to a creator in a critical way.  They are obsessed with proper use of grammar and spelling, they fell almost physical pain if somethng is not right, and their major failing IMHO is their need to reach out and correct people, often in a deriding fashion.

They will point out the typos in your content, grammar issues and other faults.

They usually think they are doing a great service cutting you down to size, but more often it’s pretty hurtful.  There is very little thought given to the feelings of the recpient, as the image above suggests, they have found an error on the internet and they must correct it.

Now I’m Holding My Hands Up

I have shockingly little patience for spell checking, there have been many times when I’ve clicked publish and there are typos or grammatical errors.

My thinking is, have I communicated my idea, have I created value with my content? Sloppy yes, but to shake your fist at me across the internets,  I think that is a little harsh.

For the perfectionists out there this will cause the big vein in your head to pound, but hear me out, sometimes the reaction can be offensive and hurtful, I’m sharing my side of the story.

Sometimes It’s A Genuine Offer Of Help.

Not all communications I get are nasty, the vast majority are genuine offers of help “Hey dude there is a typo on the last line of your sales page”.

I’m fine with that, if you have sent me that type of message I’m not getting at you, but there is a certain type of person out there, when confronted with a typo will erupt and e-march into your country.

Sometimes It Is just Nasty

It happens all the time.  Should you have the audacity to press the publish button, and things are not 100% correct.

Here are some that stick in my mind.

1. “You need to get your shit together!” said the Nazi, he told me he liked my content but there were some typos that I needed to address and get my Sh1T together or no-one would take me seriously. FFS it’s just a blog post not the declaration of Independence.
2. I sent out an email blast, and the reply was “DO YOU EVEN SPEAK ENGLISH” I checked the blast and there was some missing punctuation.  Ouch, I followed your link and you were not creating anything.
3. A copy writer sent me a harsh critique of my blog post and then tried to sell me his services.  Hell no!

I’ve had dozens of other free critiques on the same line.

How I Handle Their Missives?

I have a two ways to handle a Grammar Nazi nowadays, in the past I would have girded my loins and gone into battle, but age has mellowed me.

Stage one take a deep breathe, and remind myself, this is of absolutely no consequence.

If they are mean, they are off the team, I unsubscribe them and never send them any of my future updates. It’s as simple as that, I have no time for angry people.  They are not getting the content I gave up my most finite resource for, time.  They are also banned from hiring me, but to date I’ve not had a Grammar Nazi also be a client.  They tend to lurk and consume free stuff not hire me.

If the notification is in a nice spirit a simple “thanks for the heads up” reply is what they get.

No drama, which leads me to my final piece of advice …

Don’t Feed The Trolls Grammar Nazis!

The last thing you should do is engage, don’t get angry, don’t confront, don’t even reply.

Take a deep breathe, accept the criticism.  If you want, make their suggested change, if not so what, it’s your blog post.   You owe those sort of people nothing.

To paraphrase, no-one raised a statue to a grammar Nazi.

My favourite thing to do is just leave the offending typo for a few days, you know they will be watching, and you know their OCD will be making them uncomfortable 🙂

Wrap Up – What To Do When The Grammar Nazis Goose Step Over Your Work

I’ve been guilty of pointing out typos in the past, once you get a grammar Nazi on your case you realise how unpleasant that can be.  My plea to you is think before firing off your grammar critique and word it nicely, don’t be the Grammar Nazi.

If you need help banning a Troll or Grammar Nazi from your site I have ways and means, get a no obligation quote.

I is not goin to chaneg this sentance no mattir wot you sez, if you get the meaning that is all that iz importint

Bonus reading Eats Shoots and Leaves.

Are WordPress comments dying?

I think they are, lets have a discussion about this.

What I’m Seeing

I’m getting fewer and fewer comments on my blog posts.  I’m not suggesting I’m the greatest writer, generating thoughtful work that the whole internet wants to engage with, but I can see that I’m getting fewer comments on each post I publish.

Personally I am not leaving any comments on blog posts anymore.

Spam is going down.  I am seeing a trend on my comment spam that shows attempts to leave comments on my site that are spammy.  Here is a six month graph from Akismet,

People are installing plugins to move comments away from their sites into the wider social sphere such as this one https://wordpress.org/plugins/comments-from-facebook/, or the are moving to centralised commenting systems such as Disqus.

This is not a scientific study, but I’ve just visited Problogger, one of the most popular blogging sites out there and a post from the 4th (2 days ago at the time of writing) has zero comments, and other posts have less than 10 comments, in the past each post on Problogger would receive hundreds of comments.

Why I Think This Is Happening

People are still distributing great content they like, and sharing it with their circle, but they are sharing and discussing from social media hubs such as Facebook or twitter.  The distribution hub has also become the discussion hub in my opinion.  They will click through read your content and return to the distribution channel to comment.

Dude! People need to keep their social feeds current, they need to be adding more content into the howling storm of the internet,why would they leave a comment on your backwater of the internet when they could leave a comment on their social media site of choice and build their own profile (please like my post).  Who is going to see their insightful thoughts on your site, 🙂

My previous statement is a little tongue in cheek, but I do think people want their discussion to be seen more widely, where will this happen on social or at your site?

Comment links are no follow so there is no benefit SEO wise for leaving comments.

Comments were often used as a method to engage with the author, but this can be done on social more effectively.

Wrap Up – R.I.P. WordPress Comments

I think comments have moved to the distribution channel not the source.  I don’t think this is a bad thing, as long as discussion is happening does it really matter where is it hosted?

What do you think? These are only my opinions,

<irony>Let me know in the comments</irony> or the social platform of your choice @nmatthews on twitter, or on Facebook.

Need help with your WordPress site? Get a no obligation quote.

Photo Credit: benekliz Flickr via Compfight cc

 

You are only as good as your last backup!

That’s the phrase that was drilled into me over and over when I was a young systems engineer looking after huge corporate databases.

Backup was such an important thing to us, we had rotas where it was someone’s sole job was to ensure backups were taken, they were valid and they were stored correctly.

Part of that storage was to bundle up magnetic tapes into a fireproof box and send it offsite to a secure storage location.  It was physically offsite.

As the owner of a WordPress site you need to ensure your backups are also stored off site but in the sense they are stored virtually off your website.

The Majority Of Backups I See

You do have a backup plugin installed don’t you?

The majority of the backup plugins I see installed are taking backups each day or each week.  These backup archives are then stored locally under wp-content.

Why Store Offsite

Let me paint a doomsday scenario.  Your site has crashed.

All of the files on your site have been deleted.

Your archives are gone.

Your hosting company cannot help you.

You are stuffed!

That’s why we keep a copy of your archive offsite so we can restore in a worst case scenario situation.

Off Site Storage Options

Your offsite storage options will be dictated by the backup plugin you use, but here are some of the more common options:

Dropbox – not only can you save the pictures from your phone but you can also save you backups there too.  Large sites can be into the GB sized archives

Amazon S3 – the good folk at Amazon not only sell you everything under the sun, but you can also rent part of their storage too.  It’s cheap and secure.

Microsoft Azure – always late to the game it seems, but Microsoft have storage solution too.

FTP – You can setup a manual process to FTP your archive files to a second location offsite.  Not my preferred method but definitely.

Email – if your archive is small you can attach it to an email and send it to yourself each day.  Gmail for example, only allows a max file attachment of 25MB, so email will not be the best for a large site.

Recommended Plugins/Services

Here are some plugins that offer an offsite storage solutions that I recommend.

• Backwpup – free
• BackupBuddy – premium plugin
• Managewp – freemium service
• Vaultpress – premium service.

What We Do For Our Clients

We manage the backups for hundreds of our clients, we take a daily full backup of their site and we store it off site on Amazon S3 servers.  The backups are secured and encrypted.

We get to select where, geographically we save the backups, so we store them as close to the clients physical location as possible.  We can select Amazon data centres in North America, Europe, the Far East or Australia.  This speeds up upload and restore times.

We’ve had to restore from this solution numerous times and it works.  That’s the important part of backup, not taking a backup, not saving it offsite, being able to restore when the SHTF.

Wrap Up – Why You Need To Store Your Backup Archive Off Site

I would like you to review your backup solution today and make sure you are also storing you backups offsite, you will thank me if things go pear shaped.

We have backup solutions starting at $9 per month, can we backup your site for you?  Get in touch.

Photo Credit: Dave ‘FBI’ Gibbons Flickr via Compfight cc

There are two main ways to categorise WordPress blog posts, tags and categories, in this post I want to explain the difference between categories and tags.

In this post I want to explain the differences between category and tags.

What Are Tags & Categories?

Both are ways to group related posts together, if someone is interested in your post about a cat, drop it into a tag or category about cats and people can find more content on your site about kitties.

Adding a post into a cat or tag, adds it to the category page linking all the other posts together for example, I’m putting this post in General Blogging, you can also see it in this page https://dev.neilmatthews.com/category/general-blogging

The Cook Book Analogy

The best analogy I have heard for the difference between categories and tags is the cook book.

Imagine the front of a cook book there are chapter listings with page numbers, think of categories are chapter lists.  The chapters in our analogy are breakfast, lunch, dinner and snacks.

Now think of your blog post as a recipe, our post is a breakfast dish huevo rancheros, it is in the chapter / category breakfast.

At the back of the book is an appendix, the appendix lists all the recipes by their main ingredients, this is a tag and helps to give much more detailed information about a post.  We would tag huevo ranchero with eggs, peppers, totillas etc.

Both do the same thing to help you find a recipe but they both do it in slightly different ways. Tag are more detailed where as categories are more general.

Do You Need Both?

Each post needs to go into at least one category, that is why there is a default uncategorized category that all posts are added to by default, but you do not need to use tags, they are optional.

What Is Best For SEO

Having both for SEO is best, it increases the number of indexed pages you have in Google.  for each category or tag you add a new archive page is added, s there would be oursite.com/category/breakfast and oursite.com/tag/eggs, oursite.com/tag/tortillas.  The more tags and categories we have the more keyword rich links we have.

Are There A Limit To The Number Of Tags / Categories

Technically no, but there is a suggestion to limit the number to no more than 15 for anti-spam and seo reasons.

Wrap Up – The Difference Between Categories And Tags

Further reading, here is what the good people at WordPress.com have to say on this subject Categories Vs Tags.

Photo Credit: ubrayj02 Flickr via Compfight cc

As part of my holiday blogging efforts I decided to write a blog post 100% with the WordPreas iPhone app.

You can download the WordPress app from your App Store of choice there is an iOS and android version.

Writing Experience

As you would expect the writing experience is the same as writing a text message.

If you have young nimble fingers, used to sending large amounts of mobile text, you will be able to quickly knock out a blog post.

This correspondent's fat middle age thumbs are not as Rapide as they could be but I'm coping writing this post.

Personally give me a keyboard for anything over a short form post like this one.

Adding Images

You can post images from your camera which is a huge benefit for personal bloggers.

You can add them inline and also save a featured post image.

I'm in a water park as I write this so here is a random image of my kids.

I'm going to download an image from compfight save that to my phone and add it as a featured image.

Error correction

Something really positive is the predictive text editing as my fat man fingers mash out this post, it's correcting as I go I've not had to type an apostrophe yet.

When I create a typo the content is underlined, tap on it to correct.

Downside

If your theme has features that need to be set from the editor you cannot do that from the app, it's completely theme agnostic.

It also ignores any plugins you have that add posts options, for example I use Yoast SEO to set my post options, I'll have to wait until I get home to optimise this.

The menu was not very intuitive and I had to google how to add HTML for the image credit at the bottom of the post.

People get really stroppy if you don't camel back WordPress but the app does not pick that up just saying some I don't plan to correct those typos.

Wrap Up – WordPress iPhone app

The app has surpassed my expectations, I've written a decent enough length post from my phone and yet another shackle of desktop work has been shed.

If you need help with your WordPress site please request a quote when I get back on the 5th 😀

Photo Credit: imherbsoap Flickr via Compfightcc