We don’t often pay a lot of attention to “competitors”, but this week we were forced to take a look at Sucuri.net’s malware removal service because we had a client that used them to remove malware from their website (but it came back). In fact the malware and malicious code came back every day for 8 days straight, and Sucuri kept removing it. At this point the client hired us to fix the website for good because even though Sucuri fixed it (every day) for free – it was kind of annoying to him (as well as concerning) to have them remove it each day, without fixing it for good. Would they have kept removing the malware for an entire year without fixing the root cause?

Once we learned this, we had the client forward the Sucuri Support email he received each day after the cleanup, and this is what the body of the email looks like:

Hi,

Your site is now clean and malware-free. The following files were compromised and fixed:

CLEARED: Cleared malware from file: ./wp-includes/https.php
CLEARED: Cleared malware from file: ./wp-includes/legacy.php
CLEARED: Cleared malware from file: ./wp-includes/feed-print.php
OK: Hardening ./wp-admin/setup-config.php on WordPress
CLEARED: Cleared malware from file: ./wp-content/themes/elegant-grunge/Image.class.php
CLEARED: Cleared malware from file: ./wp-content/plugins/akismet/native.php. Details: http://sucuri.net/malware/backdoor-phpfilesman02

CLEARED: Cleared malware from file: ./wp-content/plugins/wp-cart-for-digital-products/wp_cart_for_digital_products.php
CLEARED: Cleared malware from file: ./wp-content/plugins/lock-out/lock-out.php
CLEARED: Cleared malware from file: ./wp-content/plugins/googmonify/googmonify.php
CLEARED: Cleared malware from file: ./wp-content/plugins/get-recent-comments/get-recent-comments.php

Please follow these steps to avoid reinfection: http://sucuri.net/kb/after-the-cleanup

This ticket is now in resolved status. If there is no further activity in the next 24 hours, this ticket will be automatically closed. Feel free to open a new ticket if you require further assistance.

Thanks for using Sucuri!

Every day he got the same email, with the same listing of cleaned files. To be fair, Sucuri does give that link to an “after the cleanup” page, but all it really says is to change your passwords, run a virus scan on your PC, update your website, and start doing backups. That’s it. All the things they tell you to do are great, but they’re just a (very few) bits of preventative maintenance. None of them have anything to do with securing and hardening your WordPress website. Also, they tell you what type of malware virus infection your website had (according to their internal definitions), but they don’t tell you where the security hole actually was (or how to plug it).

It seems to us that Sucuri.net is a one trick pony. They can remove the malware from your website, they even have a really cool malware scanner plugin that you can install for free to make sure you’re not infected. But they do not (that we can see) offer any actual security and hardening services for WordPress, nor do they help you fix the security hole(s) that got your website hacked into in the first place.

*Update*: Sucuri has commented below that the reason the malware “came back” was that the client was running WordPress 2.8.4 and 2.7 in the same hosting account, and this was was the malware kept coming back every day. Some people may have focused in on that part of our observations, but it wasn’t really the point.

We have a couple comments on this…

The first being – after the malware was removed – the confirmation email to the client provided a link to an “after the cleanup” page, and one of the points on that page was to “keep WordPress updated” (and the client obviously didn’t follow that recommendation). Sucuri’s position is probably that if the client had done that, the site would not have gotten reinfected. Our position is, that really doesn’t matter at all – even if he had done that, if the website wasn’t completely secured – it could be hacked again.

What we probably should’ve provided were a few more points about what we did for the client – and why a malware removal service (alone) is almost never good enough.

Although Sucuri does what they do well (malware removal for a flat yearly fee), they are only able to offer that one service for that price.

When this client came to us (after using Sucuri), during the security and hardening process of his WordPress website we did a lot of things including:

-complete reinstall of WordPress core files
-complete reinstall of all plugins
-removal of plugins without an update in the last 12-18 months
-scanned and checked the theme for vulnerabilities
-scanned all content in the database
-reset all passwords
-manually reviewed user accounts
-setup and configured an all-inclusive security plugin
-and dozens of other security and hardening points

We’re not saying Sucuri doesn’t work (it does). In our opinion it’s just not the same (or enough) as hiring someone to manually review and secure and harden your website, and to install disaster recovery options. One of our biggest beefs was that the “after the cleanup page” on Sucuri didn’t contain either links to detailed information or even a service / person you could hire for this. In a LinkedIn WordPress group discussion about this Dre Armeda says that Sucuri does offer additional security and hardening services, as well as another WordPress security plugin. While not all of the malware removal customers would take advantage of it – that’s probably information they should have presented on the “after the cleanup” page.

Again, if all you need is malware removal, Sucuri.net as a flat fee malware removal service works great. They also do have security and hardening services available. For business website owners – we advise our clients to take advantage of our WordPress malware removal / security and hardening services. If you have a malware infection, we will fix your website by removing the bad code, we’ll find and fix the source of the break-in, secure and harden your website to protect against future hack attempts, and setup a disaster recovery option that suits your needs.

What is Pinterest?

Pinterest is based on the concept of a pinboard, where you would use push pins to pin up images and scraps of things that interest you. This website allows you to “pin interests” to various “boards” that you create. For example, in our Pinterest account we have (so far) 2 boards – one for WordPress and one for SEO.

Aside from creating your own boards, and adding pins to them – you can “repin” things from other people’s boards (to yours), you can “like” pins, and you can “comment” on pins. You can also “follow” other pinners (and they can follow you). Oh – and you can categorize your pins as well when you add them to your board (so people can find them more easily).

So the pinterest homepage looks a bit like this:

Why is Pinterest so Popular?

It’s always funny when something comes along as a “game changer”. You probably couldn’t tell senior magagement at Facebook or Twitter they could stand some improvements for growth (but they both could). The problem with both social media sites is that they both lack the ability to easily follow and find things you like.

Facebook is extremely hard – have you ever tried to find people that like and use WordPress on Facebook? Not an easy task, it’s more of a tool to connect family and friends. LinkedIn is more of a business website (and not for interests). Twitter is the whole mobile SMS text status thing, and connected to your phone – not exactly well suited for links and images.

The time was ripe for a social media tool exclusively used for sharing links and images of things you like – and Pinterest (easily) fulfills that need in spades. If you think about it, this really makes sense with the bulk of information on the web. You can get lost in Google looking for things you like or need – and despite their efforts to clean up search results, it’s still a mess. Niche memberships websites, forums, and social specialty interest websites thrive online – because people connect with what they like.

What Opportunity Does Pinterest Provide for Website Owners?

Here’s the thing – Pinterest probably won’t work if you’re selling car insurance or bail bonds (directly). For us, Pinterest has been great, we generated followers and re-pinners in just one day of posting a couple dozen WordPress things to our Pinboard. People search for what we know (and write) about – so we don’t have to think about how it works for us.

If you’re a business website owner, or blogger – you have to think about the social media paradigm and how you make connections to people. On Facebook, you would never (get very far) if you owned a hardware shop – and posted your sale items every day. Then again – if you were the manager of the same hardware shop, and connected on Facebook to customers and clients in the community, and your FB page consisted of community events, tips, tricks, and the ‘occasional’ store update – you’re using social media properly.

Using pinterest you could make pinboards revolving around “how-to” topics and tutorials to help people. Maybe inject some humor linking to images of what not to do or projects gone wrong. It’s easy to connect your pinterest account with Facebook and / or twitter and show what’s on your pinboards on those accounts too. You could probably generate more activity on Facebook posting what you were doing on pinterest then from normal Facebook actvity alone.

How to Use Pinterest in WordPress

So, you have a WordPress website – how can you use Pinterest and WordPress? Like all the other social media sites, you need a “pin it” button on your pages so people can start sharing. You could also add a widget or badge showing you’re on Pinterest (and what you’re doing).

There are of course all kinds of new Pinterest WordPress plugins you can use:

Pinterest Badge: show a pinterest badge in a widget of your website showing your activity

Pinterest RSS Widget: show your latest pins in a sidebar widget of your WP website

Pinterest Lightbox for NextGen Gallery: if you use NextGen gallery – you can add pinterest to it with this plugin

Pretty Pinterest Pins: show off your latest pinterest activity in style

Pinterest Pinboard Widget: use a WordPress widget to show pins from specific pinboards

Pin in Button: adds a simple “Pin It” button to your posts in about 2 minutes

Pinterest Plugin: this pinterest plugin is unique because it shows “pin it” when users hover over your images (since to pin something the page or post must have an image)

Easy Pinterest: another RSS feed type pinterest widget plugin

Pinterest follow button: This is a button allowing people to follow you on pinterest

Pinterest Block: maybe you don’t want your images or content to be shared on pinterest – you can block that with this plugin

Pinterest Image Pin: another plugin for pinning images on your site to pinterest

And last – if have the ability to edit your own WordPress theme, and would rather add the code directly (rather than use a plugin), here’s a code snippet for adding Pinterest to your pages manually.

Do you use Pinterest? If not – you should be!

Today we’re going to talk about when and why you should be using social media for business.

Why Use Social Media for Business Websites?

A lot of our insight comes from the face that we manage social media accounts not only for our own business – but for client websites as well. Social media is sometimes largely misunderstood, because it began as a way for people to connect to friends and family and “grew into” being useful for business later on.

Connections to People: One of the greatest reasons to use social media for a business website is because it’s the easiest way to connect to people that are relevant to your business (and their friends, and their families). Facebook receives more pageviews per day now than Google, and connecting with people where conversations and emotional connections are going on is an easier way to find leads and sales that traditional search will ever be.

Google Tracks Social Media: Out of the nearly 200 “ranking factors” Google uses to determine where you fall in website results – your usage of and visibility in social media can impact your organic search rankings as much as 30%. The new Google analytics interface now has social media tracking and indicators.

One of the main reasons that Google is interested in your social media participation (and how people are responding to yoru website in social areas) is to prove your real. SEO experts and spammers have been trying to “game the search engine” for years for good rankings, but trying to “fake it” in social media isn’t quite that easy. Google figures if all you have is a bunch of spammy low-quality links (and nothing in social media) – your website is probably a big spammy as well (and not deserving of decent rankings for keywords).

When to Use Social Media for Business Website?

When and how to use social media can be different for any business or website. Some might use certain channels more often than others – it really boils down to who you need to connect with. It’s probably easier if we give an example of a ficticious client:

Client: Company ABC
Market: Manufacturing
Website Content: Products and Whitepapers, Sales and Support

Let’s say “Company ABC” has a website with 2 distinct sections. One is products and whitepapers, targeting higher level management “decision makers” within the company. This would be middle management through executives, the type of people that would receive a sales presentation or at a conference for their market.

The other segment are the field technicians that actually use the products the “decision makers” buy. They mainly visit the product manuals, forums, and support sections of the website.

As it pertains to social media, “Company ABC” should think about how to target their segments in social media.

For example:

Facebook: while the company Facebook “page” is there for people to “like”, the real usage here is targeting field techs that use the product and connecting with them in the field. Using the Facebook ad platform you can drill right down to actual companies and job roles for targeting.

Twitter: following the latest buzz words from the trade journals, you can often find the “decision makers” using Twitter to connect with companies in their market.

LinkedIn: a great way to research, connect with, and communicate with other companies (with a premium account).

YouTube: both sales and support videos can be uploaded to handle either segment

Flickr: product images can be uploaded to target specific portions of the website for sales pitches

What you don’t want to do is use social media as a regurgitation platform for your press releases, product announcements and “news”.

Social media is meant to “engage people”. As a business your job is to engage people, and then make an emotional connection with someone who is looking for information (that you can provide). Once you provide that information, you build your brand loyalty with that person, making sales in the future much more possible.

The last thing you want to do in social media is constantly be selling. Nobody wants to feel like they are being pestered, and those that feel you are pushy (in social media) can actually come away with a negative feeling about your business or brand.

As a business website owner, think of social media as nothing more than “networking” – it’s just online instead of face to face.

We provide social media management for small to medium sized business, and corporations. How can we help your company?

Today we released version 1.5 of the Widget Logic plugin for TotalBounty.com. Widget Logic is a great plugin that allows you to control the display of widgets on your WordPress website. By default widgets display on all pages, but by using “conditonal tags” (WordPress PHP template code) you can control where and how things display in your theme.

Widget Logic Visual puts the ability to use these conditional tags in the hands of normal WordPress website owners that don’t know any code. You can point and click your way through setting “limitations” and rules as to where and when widgets display.

New in version 1.5 is the ability to add either visual limitations OR the conditional tag code. This is because we had multiple requests from advanced users who didn’t want to jump back and forth from the original plugin to this one to use or not use code. Now both abilities are in Widget Logic Visual, and developers can use it, but they can use it on client sites as well for people with basic WP knowledge. The interface has also been cleaned up, help text added, and overall it’s a clean user experience than in the previous release.

Visit the Official Widget Logic Visual Page.

Click here for a quote on a custom WordPress plugin.

Most website owners don’t have a disaster recovery plan in place at all. Most people think about “what could happen” until it happens. Have you ever heard the phrase “you don’t know what you’ve got ’til it’s gone?” Plan ahead – before it’s too late

When you’ve worked in both corporations and small businesses for extended periods of time – you get to see how both sides get things done. A small business owner doesn’t need to ask permission to do something – they just get it done. A corporation has slower wheels of progress, as things must be approved at all levels. Then again a small business owner that wears many hats only has time (and expertise) for so many things. A corporation (that is ISO certified) must have certain processes and procedures in place, with the right expertise assigned to them. Corporations that are ISO certified in various areas usually must have a “disaster recovery plan” in place, that is tested at best annually.

The bulk of webiste owners online are small to medium sized business owners. Most of them get some type of leads of sales from their websites, and have invested extensive time and money into them over time. If the website was completely lost tomorrow, they would lose time and money putting it back together – not to mention the sale and revenue lost.

As a website owner, here are some things you should know about disaster recovery:

Webhosts:

• Webhosting companies (even those that have backup) are not responsible for your data (read their terms and conditions
• Most webhosts with backups only keep the 1 revision of the data
• Most webhosts charge a fee to process a backu or restoration request
• Most webhosts keep backups at the same facility as the server (sometimes the same server)
• In the last several years multiple webhosts have lost thousands of websites data through failed hardware or other mishaps
• Never pay for extended terms on a webhost (annually, etc.), becase you should be “ready to move” at all times (just in case)

Backups

• Never rely on a webhost to backup your data
• Always have an “offsite backup” that can be used to restore your site on ANY webhost in case yours goes down, out of business, or has a DOS attack, etc.
• Use a service, plugin, or application that saves “versioned” backup and save 7-30 days worth of versions so you can move back to any point in time
• Restore your website in a test area to make sure your disaster recovery plan actually works
• Have a trusted WordPress developer you can call if you run into problems

About WordPress and Disaster Recovery

Most of our clients use WordPress to manage their websites (some don’t). One thing we always tell them is:

“WordPress is software. Software needs to be maintained just like Windows on a computer.”

WordPress has 3 areas that need updates on a regular basis:

1. WordPress itself
2. Themes
3. Plugins

WordPress, themes, and plugins are written by different developers. As updates come up – conflicts can arise, and things can (and do) break. If you don’t update you can leave security holes open (and hackers can exploit them and break in).

So for our WordPress clients, we also say to them that in addition to a disaster recovery plan, you need a separate (staging) area to upgrade and install (and test) upgrades and updates before putting them live. This is a very good way to routinely check and test that your disaster recover plan for your website is working.

If you need help with your website backup and disaster recovery plan, please view our WordPress security page for detailed information.

We’ve had the idea for this plugin for a very long time, and it was great to see Total Bounty sponsor development for it. The original widget logic plugin has been around a few years now, and once installed it supplies an input box at the bottom of every widget you have. Once you add PHP code for WP template conditional tags for each widget, you can restrict what pages or sections of your website the widget appears on for visitors. That plugin worked great – but if you weren’t a WordPress coder (or technical), just exactly how to make it work right could be outright confusing.

Widget Logic Visual works on the same concept – except you don’t need to know any coding at all – you just point and click where you want the widget to appear, simple as that. Now anyone with any level of WP experience can make widgets appear wherever they want without having to code their WordPress theme or hire a developer.

You can set as many or few rules as you’d like (for each widget). For instance, you could show a widget on just a single page, or on all pages. You could show on just one category or all categories. You can even add “exception” rules – like show on all pages “except” the homepage, etc.

Here’s a short video on how the plugin works:

Looking for WordPress development or coding work? Need a custom WordPress plugin created or customized? Just fill out the form in the footer with some basic details, and we’ll get back to you as soon as possible.

Nearly every website owner would like to have additional information in that signup email, and some would like to have a different (or no) login URL, because they have a login box exposed on the front end.

The trouble with this situation is, if you figure out how and where to make these changes in WordPress – you have to make them in WP core files. This means that (if you manage to make the changes) in the future when you upgrade WordPress (and it’s core files) your changes will be overwritten and you’ll have to make them again (and again, and again). It’s never a good practice to edit WordPress core files.

Enter the SB Welcome Email Editor plugin. This plugin provides several features where you can:

• change the admin welcome email notification
• change the user welcome email notification
• you can send email ‘reminders’ to users using a template
• you can edit the email subject
• you can edit the email body
• you can edit the email ‘from’ address
• you can edit the email ‘reply to’ address
• you can send email as HTML or plain text
• you can add additional email headers

One of the main problems with WordPress and forms and sending outgoing email is that many webhosts, ISP’s, email providers all filter out incoming email without valid from or reply to field. Some webhosts (depending on how email is setup) will take your outgoing emails and make the reply to or from email “wordpress@domain.com” instead of the admin usersname (causing the email to go into spam folders for many people). In some cases spam filters will eat the email before it’s even received.

So with this plugin you have the ability to not only make your signup notification more user friendly – but also to ensure that more people receive it.

How to Send WordPress email via SMTP

Another consideration is changing the way that outgoing WordPress emails are sent. By default WordPress sends email out using PHP which (on Linux servers) goes out using “sendmail”. This is hosting server based outgoing email (not email server). Sending emails out this way is not always without it’s own issues, and a safer way to send out email (again ensuring that more people will receive it and it won’t be marked as “spam”) is to make WordPress outgoing emails use an actual email server and “SMTP”. You can even set it up to use SSL or TSL (secure) email ports and or / Gmail to send.

Here are two great current and updated plugins you can use to do that:

Configure SMTP

WP Mail SMTP

JTPratt Media does WordPress consulting, maintenance, and development, visit our services page for more information.

Luckily enough there are all kinds of WordPress import tools and plugins online, many of which are freely available in the repository. We always search the WordPress repository first when looking for any solution since “there’s almost always somebody that had that problem before you”.

Here’s some plugins that might help you import content from other types of websites for migration WordPress:

Need to move your Tumblog from Tumblr to WordPress? Try the Tumblr Export for WordPress.

You might also like to try Tumblr Importer, written by Ott42 (core submitter to WordPress).

If you were using Posterous for your blog or website, you could use the

If you’re been using the Mambo CMS for your website, you could import the content to WordPress using the Mambo Importer plugin.

You could also try the Joomla / Mambo to WordPress Migrator:

Joomla Mambo WordPress migration import

If you’re using the older Joomla 1.5 version there’s always the Joomla 1.5 Importer.

Another (smaller) CMS that used for website management is “e107″, and there’s even a e107 to WordPress Importer.

Maybe you just have static website content, and no idea how to get that imported into WordPress. That’s fairly simple work with the HTML Import 2 Plugin:

If you’re using the Typo3 CMS system, you could use the Typo3 to WordPress importer.

For users that have a Movable Type webiste, you can use the Movable Type Backup Importer to get your content inside WordPress.

Maybe it’s images you need to import inside WordPress, and in that case you could use the Gallery2 Importer

There are other types of importers available too, such as the Delicious XML importer – which could be used to import all of your delicious bookmarks.

Also, if all you want to do is move a WordPress website from one location, server, domain, or sub-domain to another – consider using the XCloner backup and restoer plugin.

If you need help moving, migrating, backing up, or importing content into your WordPress website, please consider our Web Development Services.

When your website is down – you are losing money in potential sales and leads. Do you have a WordPress expert maintaining your website?

WordPress is the most popular website management tool in the world, running more than 75 million websites across the globe. WordPress is also software that needs to be maintained on a regular basis, and when you let regular updates pass you by – you’re exposing your business website to serious risk.

Can I do My Own WordPress Maintenance?

Even though this is a bit of a loaded question – the answer is yes, you can. It’s like asking, “Can I work on my own car?” Sure, you can – but do you have the time, money, and expertise to do so?

You can perform your own WordPress core updates, plugin updates, and theme updates (when available). The risk you take is – if something goes wrong, can you fix it? If you can’t, can your website be down for a period of time until you can get someone to fix it?

The answer for most people is, if you’re using your WordPress powered website for business, then (in most cases) you don’t have the time or expertise in house to maintain your own website.

What is a WordPress Maintenance Package?

When you hire someone to perform regular WordPress maintenance on your website you need someone who can update and upgrade themes, plugins, and core WordPress files on a regular basis. Best case scenario would be a competent WordPress developer to can fix conflicts or issues as they arise, as well as harden security, setup routine offsite backups, and a disaster recovery plan for your business website.

We perform routine maintenance on WordPress website for small businesses and corporations – from 1-100 websites which can include (but are not limited to):

-WordPress updates
-plugin and theme upgrades
-design updates
-adding additional functionality
-installing and configuring new plugin
-on-site SEO maintenance
-backup configuration and setup
-WordPress security and hardening
-spam protection
-database optimization
-caching and CDN solutions
-development and staging server setup
-landing page setup
-contact form setup
-mobile site setup for iOS, iphone, ipad, cell phones, Android
-multi-language or multilingual page / post setup
-google analytics, google webmaster tools, bing webmaster tools setup
-analytics and stats
-uptime monitoring and alerts
-custom post type setup
-custom theme template pages

Prices start from $49

For more details on how we can help you, please ask for a quote by filling out the inquiry form on our web development page.

I Own a WordPress Website, What Should I Do?

1. Stay Up to Date: The first thing you should do is always make sure that all your plugins are theme files are up to date. WordPress is software that needs to be maintained, the same as a computer. It if’s out of date – it’s vulnerable and hackers can get in. If you have a shared hosting account with multiple websites and hackers break into one, they can infect them all.

2. Use Common Sense with Passwords and Logins: Time and time again we find clients that have the same password on their website as every other account they own (Facebook, Twitter, Banking, etc.). Use a Strong Password that you can’t remember and change it every month – and make if different than all other accounts you have. Use an admin account with a unique login name (that isn’t ‘admin’).

3. Use Basic WordPress Security Plugins: There are a LOT of great free WP security plugins in the repository you can download and install in your website. You don’t have to be technical or a security expert to use them. We offer WordPress security and hardening services, but if you can’t afford to hire someone – using one of these free plugins is better protection than doing nothing at all.

What are the Best WordPress Security Plugins?

We have used Secure WordPress for a very long time – because it does very basic things that give you better security:

• deactivates error message on login page
• removes version of wordpress for non-admin on dashboard
• removes WP footprint from the HTML code of webpages
• removes WP update messages for non-admins
• removes version of WP from scripts and stylesheets
• protects against malicious URL attempts

Beyond that there are lots of things we do manually to make WP security better.

There are lots of other WordPress security plugins that do individual things, like lockdown your login or perform secure logins. There are also ones that are “firewalls” protecting against hacker attempts.

There is one newer WP security plugin that does more than most others called “Better WP Security“.

It performs the following security measures:

• remove the meta generator tag
• remove login error messages
• change login URL’s
• limit admin access to IP or range of IP addresses
• ban bots or specific hosts
• ability to completely turn off login for period of time
• remove update notifications
• strengthen .htaccess files
• enforce strong passwords for accounts
• detects attacks to your website
• rename the admin account
• changes your WP db table prefix
• supports forced SSL wp-admin login
• changes your wp-content path
• turn on or off file editing from wordpress admin

Previously all those things would only have been available through multiple plugins and manual work.

You can see in the image above what you see when you visit the plugin settings screen. It actually gives you color coded messages that tell you what is and isn’t secured within your website (and links to fix them).

Caveat Emptor WordPress User

These security plugins aren’t perfect, they don’t do everything. Some things are still done best manually, and sometimes using these plugins can conflict with other themes or plugins and cause things not to work (like forms, e-commerce shopping carts, download plugins, caching plugins). If you install one – be sure to read through the known issues and forums for that plugin and see if there are known issues with anything you have installed. Also, after you install – be sure to go through and test every single thing in your website to make sure it works (shopping cart, forms, downloads, image galleries, widgets, pages, posts, categories, tags, etc.). Always remember that if for some reason you lock yourself out of your own website (with a setting you tried), you can usually get back in by manually deleting the security plugin in FTP (and trying agagin).

Do you need help with WordPress security? Click here to learn more about our malware removal and WordPress security services.