Okay, people, if you are running any version of WordPress older than 2.3.3 2.5*, you need to upgrade now. Seriously. WordPress 2.3.3 and older have security holes that are being actively exploited by hackers to inject spam links into blogs which are not maintained. And search engines like Technorati are de-listing hacked blogs. Are you listening now? Do I have your attention? Upgrade your web apps before you get hacked and your site drops off the search-engine radar.

While the Technorati article specifically talks about WordPress sites, this goes for any web application. You need to pay attention to updates which are released, and upgrade whenever a security probem is fixed. WordPress gets particular attention due to its popularity and the sheer number of installed sites out in the wild. But it is no more or less secure than any other similar web application. So whatever you’re running, keep it up-to-date.

And the same goes for any add-ons — if you install third-part plugins or themes, make sure you keep up with updates. WordPress 2.5 makes updating plugins easier than ever. Review your Plugins page from time to time, and pay attention when it tells you that a newer version of a plugin is available.

I see comments from people all the time saying that they don’t want to upgrade because it might break this theme or that plugin that they have installed. To those people, I say, GET OVER IT. The security of your site is important. If some theme or plugin is not compatible with a newer version of WordPress, ask the author politely to update it. Or find a replacement. Or live without it. I have in excess of 25 plugins active here. But there’s not one of them that I would hesitate to deactivate when it comes to security of my site.

There are several ways to keep up with new WordPress releases. The Dashboard shows you all sorts of news from the WP community, including announcements from the Development Blog. There are several mailing lists. If those lists are too noisy for you, you can get just release announcements by signing up on Freshmeat.net and subscribing to the WordPress Project. I normally submit the Freshmeat update within 24 hours of an official release.

* One exception is WordPress version 2.0.11 (or the 2.0 svn branch, more generally), which is maintained with security updates for the Debian package.

ShareThis

I mainly mention this as warning that if my site appears to be down, email bounces, or any other strangeness occurs, it might be because I’m in the middle of moving things around. It will probably be another couple of days before I start shaking things up. While I’m moving thing around, I might try consolidating some of my stand-alone WordPress sites into a WordPress-MU setup. That would make upgrades and other site management tasks a bit easier, I think.

With a little luck, and a lot of attention to detail, you might never know that I’ve changed anything. Yeah, right! Watch this space for further announcements.

ShareThis

In this article, Bob briefly outlines six benefits that he gets from writing on his blog: Meet and Greet, Self Documenting, Self Promotion, Mentoring, Education, and Giving Back. Even though I don’t make time to post something new every day (I wish I could), I have some of the same thoughts and feelings about why I keep a blog. Click on over, read his post, tell Bob why you blog. And tell him that Dougal sent you.

ShareThis

Akismet

There are a lot of people who swear by Bad Behavior or Spam Karma 2. But I’ve found that Akismet by itself does the job for me, when it comes to taking care of comment spam.

Sidebar Widgets

With the Sidebar Widgets Plugin and a widget compatible theme, you no longer have to edit your theme’s sidebar.php file every time you want to add something new. You can rearrange the order of your sidebar’s sections just by dragging and dropping the widgets in the admin configurator.

Search Everything

The basic search in WordPress only searches the content of your posts. It doesn’t search pages or comments. But with this plugin, you can search on all of those things, plus on any post metadata (custom fields) that you have set.

DoFollow

I mentioned this recently in another post (Follow you, follow me). Strips out the nofollow attribute for links in approved comments after a configurable amount of time has passed.

Share This

Alex King’s social bookmark plugin. There are two features that I particularly like about this one: the dynamic expansion/collapsing, and the ability to email the link. It’s like two plugins in one!

WP-Cache 2

An excellent defense against traffic spikes. If you ever get hit with a large volume of traffic, this plugin is going to save your hash.

OpenID Registration

With OpenID, you can consolidate all of the common information that you normally have to re-type every time you register at a new web service. This plugin allows your commenters (or user registrations) to use their OpenID for identification.

Again, that’s not every plugin I’m using. I didn’t list individual sidebar widgets like the ones for del.icio.us or Flickr, for example. And I didn’t highlight any of the plugins I’ve written myself. And I’m sure I’ll be adding other plugins into the mix as time goes by. But these are the main ones that I wanted to highlight that I’m using right now.

How about you — what are your favorite plugins, and why?

ShareThis

Reinvigorate’s Hourly Stats

About a year-and-a-half ago, I wrote about how the Reinvigorate web stats service was entering a private beta, and I hoped to get a chance to try it out. I applied to the private beta program and waited. And waited. And waited some more. Then I sent them an email, and they said they were still working on it. And so I waited… Then I finally gave up, and tried some other tools like Google Analytics (which I don’t look at much) and MeasureMap (which I like a lot).

Well, all my waiting finally paid off. I received an email last week inviting me to the Reinvigorate Private Beta. I immediately signed in and activated tracking for this site. The new stats are a little different from what they used to provide, but they definitely give you some nice breakdowns of the information.

I’m particularly interested in the information on click-paths. I’m finding that only a few visitors dig down into the site. I want to add more prominent internal linkage to encourage people to explore, and I’ll be able to use this information to help gauge whether or not changes I make are effective. A couple of changes I’ve made recently are the addition of links to the next/previous post on the single article pages, and the addition of the page navigation buttons at the top of each page. Additionally, I’ve created an Archives page using the archive template in Sandbox.

I think that they’ll be opening up for more beta testers soon, so if you’re interested, you might want to head over and register: reinvigorate.net

ShareThis

On Friday, I decided to use my lunch hour to perform the upgrade. I backed up my database and my wp-content directory, deleted all the old WP files (I traditionally haven’t bothered with that step, but I knew that several files were renamed/outdated, and I wanted to do some general housecleaning anyhow), installed the new ones, and upgraded the database schema via wp-admin/upgrade.php. Everything looked fine. I switched the theme over to Sandbox and activated the ‘Rockem Sockem’ skin that I had created previously. Then I began activating my sidebar widgets to get my sidebar set up the way I wanted. It was around this time that I started noticing problems…

I started seeing really slow page loads and blank pages, and most of the time when I tried to access an admin page, the browser would time out, or think that it needed to download the page instead of display it. The load on the server was higher than usual, so I figured it was spammers hammering my site at a bad time. Except that when I watched my logs, I really didn’t see much suspicious activity. I wrestled with this for a while, still thinking that high server load was causing the site to have problems. I figured that perhaps upgrading from PHP4 to PHP5 might gain some improvements, and spent a few hours compiling PHP 5.2.0 and recompiling all the associated extensions that I needed. Nope, that didn’t seem to help.

Then at some point, on a whim, I brought up my wife’s web site, which runs on the same server. And what do you know — it came up just fine. I could also login and navigate the admin pages without any problems. Sooooo, the problem was just in my site. Probably a malfunctioning plugin. I disabled all the plugins by renaming the plugin directory temporarily and reloading the page (WP will automatically disable any plugins that it can’t load up, in case you weren’t aware of that trick). Voila, the pages loaded fine. I began re-enabling plugins one-by-one, starting with the ones I was most sure were okay, gradually working down to the likely culprits. Until I finally found it. It was my Now Playing widget, which I had recently (and hastily) refactored. Arg! It was my own fault that I had been having so many problems!

I haven’t narrowed down the exact nature of the problem yet, so that widget remains off. I suspect that the root of the problem is in the old Amazon search library that I’ve been using. I had meant to write my own, updated, stripped-down functions for that, but hadn’t gotten around to it, yet. I suppose I’ll be doing that soon(ish).

So, with that said, welcome to the new improved geek ramblings, powered by WordPress 2.1!

ShareThis

The problem seems to come from APC (Alternative PHP Cache). I’m not absolutely sure why it decides to crap out on me like that, but I suspect that the real root of the problem might be some old supporting libraries on this server that need to be updated. I might try fiddling with the APC configuration again later, but in the mean-time, I’ve disabled it again. Over the past week, I’ve probably only gotten a little more than half of the hits that I might of had otherwise, so I’ll probably wait for another quiet period before I try enabling it again.

ShareThis

• Tabbed WYSIWYG/Code editing: You can now easily switch back and forth between the WYSIWIG (AKA: RTE, or “Rich Text Editor”) and the old-style editor with quicktags.
• Autosave: When editing posts, your changes are automatically saved every two minutes, as long as you’ve set a title.
• Spellcheck: The RTE now includes a spelling checker. I just tried it out, and it works pretty nicely! Click on a flagged word to see possible corrections.
• Blogroll categories have been completely redone in a way that integrates them with regular post categories.
• “Home” page: You can now use a WordPress Page (sometimes called “static pages”, though that’s a misnomer) as your front page, instead of the usual list of latest blog posts. This makes it easier to treat WordPress as a Content Management System and less like a system specifically for blogging, for sites where it makes more sense to arrange things like that.
• Import/Export: There is now a native WordPress Import/Export tool included. This will make it easy to migrate a site from one server to another, or even set up environments where you could have “test”, “staging”, and “production” servers. In fact, I think that’s a ripe idea for a new plugin…
• Comment Management Improvements: Mucho improvement to comment management. Comments are now a top-level menu item, rather than a sub-menu of “Manage”. Paging is improved, you can now easily flag comments as moderated or as spam. And make sure you also take advantage of the new Akismet 2.0 plugin, which has some great improvements of its own.
• Database Optimizations: An expert from MySQL helped optimize the database queries, which should help improve page building speed and reduce server load.
• And much, much, more… There are lots of little user interface improvements, optimizations, better error handling, extended features, and under-the-hood goodies for plugin and theme creators.

I’ve upgraded two of my blogs, plus Susan’s blog from WordPress 2.0.7 to version 2.1, and both upgrades went off without a hitch. I haven’t upgraded this site yet, because I’ve still got some old, ugly hacks that I’d like to update into proper plugins. I had also hoped to launch a redesign when I upgraded, but I haven’t made as much progress on that as I wanted to, so I’ll probably do the redesign after-the-fact.

ShareThis

Plans by Death Cab for Cutie

You know how sometimes a song comes along and gets stuck in your head? But in a good way. Not in that “Oh my God, if I don’t get this song out of my head I’ll go freaking insane” way. More in that “I could listen to this song on repeat all day long and not get tired of it” way. I need to find all those songs in my collection and burn a CD of them.

Anyhow, ‘Soul Meets Body’ by Death Cab for Cutie is one of those songs for me right now. I particularly like this bit, which reminds me of blogging, or of writing in general:

In my head there’s a Greyhound station
Where I send my thoughts to far-off destinations
So they may have a chance of finding a place
Where they’re far more suited than here

Yeah. Blogging is like that.

ShareThis

Still, though, occassionally I get bursts of traffic that either aren’t detected by these measures, or that are detected, but the process of handling the connection causes excessive load on the system. When that happens, I typically add new code to my SpamValve plugin to automatically block future attempts at the firewall. Here are some of the things that have caught my eye recently that caused me to take action:

GET requests for trackback URIs

When WordPress detects a trackback using HTTP GET instead of POST, it redirects the client to the permalink of the associated post. But that’s all it does. I flag that as a possible spam attempt. If I get several of these from the same IP, I temporarily block that host at the firewall.

Bogus User Registrations

I once saw a flurry of fake user registrations on one of my sites. I’m not sure what the purpose was, but it annoyed me. User registration attempts get flagged. There’s no legitimate reason why I should get more than 5 user registrations from the same host in a 48 hour period. So if I see that happen, I block the host.

Direct (non-referred) posts to wp-comments-post.php

If an attempt to post a comment doesn’t have an HTTP Referrer that comes from this site, it’s flagged as a spam attempt. The comment is still processed normally, with the usual Akismet spam/ham checks, and if it doesn’t appear to be spam by other means, the comment appears on the site. But if more than a few of these come from the same host, the host will get blocked. Yes, there are personal firewalls and browser privacy extensions that strip the referrer information out. But I doubt that anybody using those is going to need to post more than 5 comments here in a 48 hour period. Still, this is probably the one rule of mine that is most prone to false-positives. But it’s not likely enough for me to lose sleep over it.

Too many spam comments from a host

And, of course, if a blog comment is flagged as spam by any of the usual means (i.e. by Akismet or any other spam detection plugins), the host is flagged. More than 5 spams from the same host? Blocked!

Mail spammers

Lastly, I monitor my mail server log. Any time a message is rejected by the anti-spam measures in place there, the client IP is flagged. Again, more than a few spam attempts from the same host earn a place in my firewall rules.

These are some of the things I look for to prevent repeated abuse. There are other things as well, that I consider slightly less serious. For example, I recently discovered that a MySpace user was hotlinking an image of mine. So I’ve put measures in place to ensure that unapproved sites can’t hotlink those particular images.

I’m still keeping an eye on my logs to catch other types of abuse that need blocking. Have any of you other spam warriors noticed any trends of abuse lately?

ShareThis