Wordpress Archives - Sam Harrelson

Editing the WordPress Footer Text

Handy walkthru here… if you do anything on WordPress, this is one of those questions that you’ll need an answer for sooner or later:

For those wondering, the footer is the bottom part of your website that appears after the content area. This can be a copyright statement, the year, contact details, branding, social media icons, privacy policy links, disclaimers, and so many other things you want it to be.

Source: How to Edit the Footer in WordPress

Why not just write on your own blog and monetize there?

I get the allure of Substack and applaud the move to decentralized platforms, but why not write on your own blog if your goal is independence and direct interaction with your own audience?

It’s not that difficult.

So many more benefits to creating in your own space, on your own domain, with your own platform…

And despite a handful of departures over politics, that wave is growing for Substack. The writers moving there full time in recent days include not just Mr. Lavery, but also the former Yahoo News White House correspondent Hunter Walker, the legal writer David Lat and the columnist Heather Havrilesky, who told me she will be taking Ask Polly from New York Magazine to “regain some of the indie spirit and sense of freedom that drew me to want to write online in the first place.”

Source: Why We’re Freaking Out About Substack – The New York Times

Biden Administration’s Whitehouse.gov WordPress Setup

Fascinating breakdown here…

With the change of administrations comes a new website, and this morning the all-new Whitehouse.gov debuted. Like its predecessor, the site is powered by WordPress – but this version carries […]

Source: Whitehouse.gov Chooses WordPress, Again – Pagely®

Churches, We Need to Talk About Website Accessibility (and Discrimination)

Open Door to a Church

“Failure to comply with Section 508 of the Department of Justice’s ADA (American with Disabilities Act) Standards for Accessible Design could expose your company to hefty fines, the risk of expensive criminal and civil litigation as well as a reputation for being unfriendly to the disabled.” https://userway.org/

I’m going to make a rant here. Forgive me (or just don’t read if you’re not up for a Sam Rant™).

Cheap website builders really upset me. For a number of reasons.

We’re working on a couple of large church website revisions for clients this week. These are content-heavy sites with numerous pages that are all info-dense with text, video, audio, podcasts, galleries, and just about every measure of content you can imagine. They are both complicated builds with lots of moving parts. So, we are constantly doing checks and QA (quality assurance) tests to make sure everything is working. Building websites of this scale might be sold as an easy thing to do on Super Bowl ads, but they are definitely not easy or “quick” things to do if you want to do them right.

One of the pitches I make to clients like this when they want to know what Harrelson Agency does differently that they couldn’t get done if they just used Wix or Squarespace or Weebly or one of the many other “website builder” apps is the care and attention we give to details such as Search Engine Optimization, mobile user experiences, payments and online giving (those %’s really do add up when you start receiving online donations), and security. It’s not that the website builder apps don’t offer those services, but items like SEO or mobile experience and especially website security tend to be the last things that someone volunteering to build your site checks (if at all). Plus, there are just better tools that last longer if you know what you’re doing, which is a cost saver over time. That’s especially true of security in 2018 and 2019.

However, one of the newer pitch items I’ve been including out of my own interests and passion is accessibility. I’ve always been interested in the subject, but that became especially true during my time in the classroom as a teacher. I frequently became frustrated with books or apps or computers or websites that students were forced to use but designed specifically with no regard to accessibility or usage issues. Over the last few years running Harrelson Agency and working heavily on website builds and designs with companies, individuals, churches, and nonprofits I’ve noticed that accessibility definitely takes a back seat to other concerns. That’s ESPECIALLY true with resource-strapped and budget limited churches and nonprofits.

However, that should not be the case. In my mind (that’s admittedly full of “too much righteous indignation” as a mentor once chided me), churches and nonprofits should be leading the way to make their websites true open doors to the public in a way that does not discriminate against anyone, including those who need usage, visual, or auditory accommodation to participate in that invitation.

1 in 5 Americans experience permanent or temporary usage, auditory, or visual disability
7.6 million Americans are auditory impaired
8.1 million Americans are visually impaired
2.2 million Americans suffer seizures and epilepsy
2 million Americans are blind
19.9 million Americans are motor impaired and cannot use a computer mouse

Technology is most powerful when it empowers everyone.

Apple is one of the most forward thinking and acting tech companies when it comes to raising awareness of accessibility issues for users. It’s one of the reasons I truly love that tools such as iPad are available for students and all people who seek to participate in the global experience that is the world wide web.

https://www.apple.com/accessibility/

Why aren’t churches talking the similar language and instead forcing everyone to fit through a very narrow door and definition of visitor abilities? We wouldn’t do that in the physical world. It’s time to take the digital world just as seriously and stop passively discriminating because of poor website build decisions.

Take your website’s functionality seriously and allow it to empower and welcome ALL. It’s a matter of mixing philosophy with theology with technical know how. And the trick is that it won’t even cost you that much, but you’ll gain so much more and perhaps share the love of God with someone who is looking for a real open door.

Keep your WordPress Site Plug-ins Updated

Now more than ever…

After its removal from the WordPress plugin repository yesterday, the popular plugin WP GDPR Compliance released version 1.4.3, an update which patched multiple critical vulnerabilities.

— Read on www.wordfence.com/blog/2018/11/privilege-escalation-flaw-in-wp-gdpr-compliance-plugin-exploited-in-the-wild/

WordPress Plugin Supply Chain Attacks

These are pretty popular plugins in the SEO world… I imagine lots more of these “supply chain attacks” exist due to older but still popular plugins being sold or leased:

If you have any of these plugins running on your site, we recommend that you remove them immediately and that you make sure that SEO spam hasn’t been injected into your site. Even though one of them, WP No External Links, has been updated to remove the backdoor, it has been closed, so it will never be updated again in the future.

via Three Plugins Backdoored in Supply Chain Attack

Building a website is cheap, but not protecting it is costly.

massive-brute-force-attack-dec18

We use Wordfence as a default on all new WordPress client sites that we create for good reason. Here’s a scary reminder that while building a website has become quick, easy, and relatively cheap your company / nonprofit / church / community group should not take WordPress security for granted with cheap hosting and no one overseeing these sorts of things:

This is the highest volume brute force attack we have seen to date. It may also be using the fresh credentials that were provided in the database released on December 5th, so it may achieve a higher than normal success rate. Please spread the word among the WordPress community to create awareness of this new threat.

via Breaking: Aggressive WordPress Brute Force Attack Campaign Started Today, 3am UTC

Even Hackers Take Summer Vacations

Pretty staggering July stats from Wordfence regarding attempts to log in to WordPress installs with guessed user / passwords. People still don’t use secure passwords (or more preferably a password manager)…

The average number of daily brute force attacks increased 21% from last month, which was up substantially from May. Daily attack volumes were incredibly stable throughout the month, with no big peaks or valleys. It’s almost like the attackers went on vacation and left their malicious bots running on autopilot.

via The July 2017 WordPress Attack Report

Why Your Church or Nonprofit Website Needs Regular Security Updates

hacked

One of the items Harrelson Agency itemizes on invoices when building out a new client website (particularly when using WordPress or Drupal) are maintenance and security updates for the year.

It’s not a major cost, but I often receive questions about the charge and whether or not it’s really necessary. That’s particularly the case when dealing with churches, nonprofits, and small businesses who are on tight budgets and looking to save every penny possible (and understandable). However, it’s necessary and I always counsel our clients (of all sizes) to understand what that cost entails and why it’s beneficial in the long run.

Regardless of the amount of traffic your website receives, if your site is self hosted and using software such as WordPress or Drupal, you have to make sure you or your website manager are doing regular updates of plugins and versions, as well as making sure there is some sort of security software in place to manage firewalls, login attempts, IP attacks etc.

If you accept online donations or payments via your website, this is especially true. If you host any sort of “member directory” or registration information or personal details of your congregants or customers, this is especially true. That’s not depending on the size of your church, nonprofit, or business.

This week, press (and governments) around the world are reeling from the explosive release of the Panama Papers. This is the largest leak of private documents ever, and exposes a number of world leaders and companies and their potentially illegal financial transactions. It happened because of outdated software with known vulnerabilities:

“FORBES discovered the firm ran a three-month old version of WordPress for its main site, known to contain some vulnerabilities, but more worrisome was that, according to Internet records, its portal used by customers to access sensitive data was most likely run on a three-year-old version of Drupal, 7.23. That platform has at least 25 known vulnerabilities at the time of writing, two of which could have been used by a hacker to upload their own code to the server and start hoovering up data. Back in 2014, Drupal warned of a swathe of attacks on websites based on its code, telling users that anyone running anything below version 7.32 within seven hours of its release should have assumed they’d been hacked.

That critical vulnerability may have been open for more than two-and-a-half years on Mossack Fonseca’s site, if it hadn’t been patched at the time without updating website logs. It remains a valid route for hackers to try to get more data from the firm and its customers. On its site, the company claims: “Your information has never been safer than with Mossack Fonseca’s secure Client Portal.” That boast now looks somewhat misguided.”

Source: From Encrypted Drives To Amazon’s Cloud — The Amazing Flight Of The Panama Papers

So yes… in 2016 it certainly matters that you have good passwords and good security on your personal online accounts as well as those of your church or business.

Don’t wait until it’s too late and have to deal with the ramifications.

Should You Use WordPress.com or Host Your Own WordPress Site?

I am often asked by Harrelson Agency clients and potential clients if they should use a WordPress.com site or have us build and host a WordPress site for them. Money is often a main concern, as you can pay $100 – 120 a year for a pretty solid WordPress.com site without much fuss. A hosted WordPress site can cost anywhere from a few hundred dollars to thousands of dollars in building costs, and more for hosting and programming. As with anything, discuss the costs upfront with the agency or company building your site if you go the self-hosted route.

There are advantages to the “set it and forget it” style of a WordPress.com website financially, but there are also a few other variables to consider if you’re looking to have a serous presence on the web and translate that into bigger goals for your company. Remember, WordPress started off as a blogging platform. While you can manipulate a WordPress.com site into a more “professional” looking business or church or group site, it’s not always easy depending on your needs and skill level.

If you do self host, you can use custom / commercial themes, plus all other free themes that exist. You can modify, customize, or do anything that you’d like with your site. With WordPress hosting, you’re limited to a set of free themes that exist in the theme repository. Also, you can’t modify the CSS or other codes within the theme. If you’re looking to customize the site with scripts and customizations (as an author / speaker / consultant / business etc) it’s definitely advantageous to be on your own server. This includes everything from being able to do custom embeds of media to accepting payments to contact forms etc.

Simply put, there are (often mission-critical) things you can’t do with WordPress hosted sites that you can do with a self-hosted site.

Plugins are also a big deal, especially as the web matures. You can upload any free, paid, or custom plugin that you want with a hosted site. This allows you to really maximize WordPress’ potential as a content management system and expand that functionality. With a WordPress.com site, you’re not allowed to upload any free, paid, or custom plugins. Everything from search engine optimization (especially needed in 2015) to handling social media sharing to newsletter delivery to some really cool media handling plugins to how your site displays posts etc are covered. Here are a few popular plugins, but I have a standard 10-15 that I typically install on a new site and highly recommend for flexibility and security and making WordPress more than just a blogging platform.

Of course, spending $99 once a year is a nice idea and provides a sense of regular expense if you’re looking into a WordPress.com site with ads turned off and a custom domain (and a little extra storage). There is a higher initial cost for a WordPress hosted site (typically anywhere from $2,000 to $35,000 for most group, church or business sites depending on many variables). However, the cost of a self-hosted WordPress site over the span of a few years evens out and you get a much “nicer” custom experience that is built around your own brand. This also frees you up from being shackled to whatever changes WordPress.com might or might not make as it evolves as a commercial arm of the larger WordPress ecosystem, as we’ve seen just this week … although the changes are all very positive this time. I’ve never had a client want to go back to something like a hosted service after they realize the options available and how the site “pays for itself” over time.

Maintenance is a very big concern for security and speed reasons these days, or at least it should be an absolute top priority. That does require that you keep your site updated, have backups, keep SPAM controlled and keeping your site optimized. That’s something we do for clients, of course. WordPress.com frees you up from that worry or need for maintenance, so that’s a plus for that side of things. However, like everything else, it’s a tradeoff between convenience and the ability to make something truly “your own” in terms of appearance and functionality.

The biggest point I always make when comparing what we can do with what WordPress.com hosting offers is that I believe you really cannot maximize the potential of your site / blog / online presence / long term branding unless you have access to the additional functionality of plugins and the ability to maintain custom modifications (and get down to the nitty gritty code based level allowing for you to make the site look and act like you’d like for it to). Being able to take payments, offer audio / video / text media downloads etc are all big benefits of what we offer with a self-hosted site, but the biggest benefit is that it’s “your” site and belongs to you, whatever may come down the road.

Don’t Use Admin As Your WordPress Username

We create, host, and manage a number of sites for churches, non-profits, community groups, and businesses. As a part of that, we also spend a good deal of time “behind the scenes” keeping these websites safe and secure. Our clients often don’t realize how much work that entails in 2014 / 2015 with the ongoing proliferation of sophistication and the sheer numbers of bots and bad folks looking to exploit poorly constructed sites or social media accounts to use for other nefarious purposes (nor should they).

Setting up a WordPress site on your own is not hard to do. You have to find a host, click a few selections for your server, then run through the install. It’s gotten tremendously easier over the years. However, if you’re setting up a self-hosted WordPress site, you have to take security seriously.

For example, the screenshot above is just a small sampling of the attempts to “brute force” access to this site from this morning. There are hundreds of these everyday for this site and I see thousands daily for some of our larger clients. You’ll notice the attempts are all trying to gain access to the site with the username “admin.” Before WordPress 3.0, the default for new site installs was to use “admin” as the username. Combine that with the terrible passwords that most people online use, and it’s not hard to see that with enough permutations, the math is there. It’s fairly easy to buy a list of the most commonly used passwords on the web if you know the dark parts of the web to look, as well.

Here are my surface level and generic recommendations if you do decide to set up a WordPress site for your church, group, or business after about a decade of working in this area…

1) Don’t use admin as your login username for WordPress or for any other account whether it will just be you logging in or a team of people.

2) Don’t use a short or “dictionary” phrase password. Use something unique to you and combine numbers, letters, etc as much as you can. That’s not fool proof and there’s research showing that doing so isn’t as effective as it was previously, but it’s still a good practice. Even if you’re “bad at passwords” as most humans claim to be, figure out system for a stronger password. It’s worth your time and it’s important no matter how small or large your site or social media account will be.

3) Use a good plugin such as Sucuri to keep track of security audits, reviews, and monitoring. Again, it’s worth your time and easy to set up email alerts for certain events.

4) Keep track of installed plugins and make sure that no one has installed a plugin that is actually a piece of malware or using your WordPress install for nefarious purposes. This is important especially if you are working with a number of people on a WordPress site and sharing a common user account rather than setting up various users (which you should do for a number of reasons).

5) Update, update, update. Keep your WordPress version, plugins, and themes as updated as possible. That usually means at least a couple of times a month.

Of course, there are many other things to consider but I get this question frequently and wanted to make my initial thoughts easy for others to find. Setting up a WordPress site is a great idea and it’s not terribly difficult. However, do it the right way and make sure you are keeping your brand, visitors, and users free from any potential threats that you can avoid with a little time investment.

Blogging Still Matters in a Social Media World

One of the main things I want to do more in 2014 is post on my blog. It’s a daily fight with Facebook, Instagram, Twitter etc.

However, this has been my web home for over ten years now an I need to start treating it better.

Great post by Matt…

Blogging is harder than it used to be. We’ve gotten better at counting and worse at paying attention to what really counts. Every time I press Publish the post is publicized to Facebook, Twitter, LinkedIn, Path, and Google+, each with their own mechanisms for enumerating how much people like it.

via The Intrinsic Value of Blogging | Matt Mullenweg.

Reminiscing About What the Web Was

From 2008:

The vanishing personal site – Jeffrey Zeldman: “Our personal sites, once our primary points of online presence, are becoming sock drawers for displaced first-person content. We are witnessing the disappearance of the all-in-one, carefully designed personal site containing professional information, links, and brief bursts of frequently updated content to which others respond via comments.”

From this week in 2012:

The Web We Lost – Anil Dash: “The tech industry and its press have treated the rise of billion-scale social networks and ubiquitous smartphone apps as an unadulterated win for regular people, a triumph of usability and empowerment. They seldom talk about what we’ve lost along the way in this transition, and I find that younger folks may not even know how the web used to be.”

We’ve lost a great deal indeed.

Lots to ponder between these last four years and these two complimentary bookends on the handing over of our namespaces and personal sites to venture capital funds, eager stock buyers and corporate silos.

And yes, I miss Technorati as well.

New in WordPress 3.5

We’re super excited about the upcoming release of WordPress 3.5 as we use the insanely flexible and competent WordPress content management platform for our own blog as well as a a number of client sites (especially in the affiliate and performance marketing world).

MediaTemple, who we use for hosting this site and can’t recommend enough to others who need server hosting, has put together a great post about the new features of WordPress…

(mt) Media Temple » Weblog » Blog Archive » What’s New in WordPress 3.5: “WordPress 3.5 is set to be released this Monday, December 10! What can you expect from the new upgrade? In this article, we will cover the basics of the new default theme, Twenty Twelve, the new Media Manager, and some lesser known but very useful features that will be a part of 3.5.”

We’ll post our experiences with 3.5 next week after we’ve had a few days to kick the tires.

WordPress A/B Testing with Simple Page Tester

Shawn Collins points out a nifty WordPress plugin for split A/B testing on affiliate sites or any landing page that requires optimization…

A/B Testing: “For the uninitiated, split or A/B testing is a process where you serve up different versions of your page to different visitors to determine which is more effective.

I’ve tried various ways in WordPress and found they were largely a hassle, until I came across the Simple Page Tester plugin.”

I’ve tested Simple Page Tester with a paid search campaign as well as a Facebook Ads campaign linking out to a micro-site lead generation page and it definitely does the trick.

My Favorite SEO Plugin

I do most of my own SEO but when I have an affiliate site on WordPress (as most of mine are), I like to use the great SEO Ultimate Plugin. There are a few others out there (probably equally as good) but this plugin is my go-to when it comes to quick link masking, 404 detection, deep linking prefs etc.

There’s a new update out that expands on some of the functionality…

SEO Ultimate WordPress SEO Plugin Version 7.2.1 Released: “Link masking has two benefits: First, it lets you replace lengthy affiliate URLs with short, clean, internal URL masks (using 301 redirects, which have no search engine penalty). Second, Link Mask Generator automatically generates robots.txt rules that disallow your masked URLs, effectively neutering the juice-flow of the link, without resorting to the rel nofollow attribute. This combination makes Link Mask Generator a perfect tool for affiliate marketers.”

If you use WordPress, it’s worth a look as a plugin.

Here’s a PDF with all of the new features.

Great Review of @Posterous

Years of building and maintaining my WordPress blog have resulted in my learning a lot about WordPress and getting a lot of grease under my fingernails. Weeks of using Posterous has resulted in a media-rich blog with several posts per week. Tell me which service is more powerful.

via suntimes.com

I started using Posterous primarily as a photo-blog back in September of ’08.

However, it’s transitioned into my full time personal blog as I’ve changed up the samharrelson.com domain into a static landing (pointer) page.

Posterous solves so many problems for me.

Thanks to Andy Ihnatko for the great review affirming my love and thanks to the Posterous team for a fantastic product that has renewed my love of posting.

Magnify Publisher Simplifies Blogging

Magnify.net is releasing a very exciting new WordPress and MovableType plugin aimed at making it easier for bloggers to find and include images and videos into posts.

Basically, the plugin integrates easily and nicely into either a WordPress or MoveableType install and allows for a blogger to include a keyword relevant image or video to be embedded in a post within a few seconds.

As most bloggers know, finding relevant images or video content for a post can consume a great deal of time and often lead to frustration. So, the Magnify Publisher program definitely solves a much maligned problem.

Magnify Publisher searches through popular video sources such as YouTube, Metacafe, Veoh, Blip.tv, Google Video, AOL Video, RedLasso and a number of others. At the moment, Flickr is the only available image search source but Magnify CEO Steve Rosenbaum tells me that this will soon be expanded.

Here’s an example of the video search and embedding feature:

And here’s an example of the image search and embedding feature:

Perhaps most compelling is the ability to also directly and easily incorporate webcasts into a blog post. So, instead o recording a video on a webcam then uploading that video to YouTube then grabbing the embed code then embedding that code into a WordPress blog, a blogger can simply press a couple of buttons and instantly get their webcam video embedded into a post.

Here’s an example:

These are very innovative features from the Magnify team and definitely needed improvements to the current paradigm of blogging. When I spoke with Steve Rosenbuam today, he mentioned his ardent belief that popular blogs of the immediate future would be those that best blend the visual, video and text components of content creation rather than those that just focus on one specific medium.

Magnify’s Publisher plugin goes a long way in supporting his idea.