To explain further, WordPress typically stores information (or data) on a MySQL database located on your web host. Storing information in a database, rather than in files, makes WordPress more flexible, capable and reliable. This is why most web based software use databases for information storage. Databases are not with out their drawbacks. It takes time to access a database, look up, retrieve it and display information. Typically the time required to perform these actions is negligible. The capabilities the database affords are worth the minor performance hit. Over time the database can become bloated however, this slowing down the entire site.

Not only are users intolerant of slow websites (many leave after 4 - 5 seconds of load time,) Google now includes site performance in their ranking algorithm. Suffice to say, you can no longer afford to have a slow website regardless of cause and many do because they have not kept their database healthy. To do so you must put your database on a diet, optimize your tables and eliminate the need for it altogether where possible.

Going on a Database Diet

The best way to address an "overweight" database is by slimming it down. This means optimizing the database by removing any old, unnecessary information (or tables.) You could login to your MySQL database and do this manually (if you are a gluten for punishment I highly recommend it,) but it's better to have a plugin do it for you. The choice is yours, I choose the later. The WP Database Optimizer plugin will delete excessive post revisions and other unnecessary information and you can even schedule it to run regularly.

This plugin takes care of obvious bloat, but misses the commonly overlooked pending comments. If you are like me you see pending comments much like e-mail, at a certain point it's not worth manually marking each one as spam which in turn causes them to build up to an excessive level. Those 5,000+ spam comments awaiting moderation are also slowing down your website (damn you spammers,) so you should probably clear them out. Of course WordPress doesn't make it easy to delete thousands of comments at the same time, so we will have to find a plugin to do it for us. Luckily the Delete Pending Comments plugin does just that. One click and some extra confirmation latter and your database is feeling lean and mean.

With your Database slimmed down you can move onto step two, optimize that sucka!

Optimize Your Tables

MySQL has an "optimize" function built in which defragments stored data. This reduces the time necessary to query a database and can reduce the file size as well. Again, for those of you who love pain you can do it manually... but I would much rather let the WP-Optimize plug-in do it for me. Beyond optimizing tables, WP-Optimize can also clean out the database making the two aforementioned plug-ins unnecessary. Three birds with one stone.

Now your database is lean and optimized, you should be good to go right? Not quiet, there is one last step. Eliminate the database where possible.

Don't Use the Database

There is no better way to reduce database associated slow downs than removing the database all together. Sound fanatical? Stay with me. I am not suggesting you find some way to run WordPress with out a database, rather use a caching plugin to reduce how often the database is used (my favorite is W3 Total Cache.) Caching plugins create a static version of your page the first time a user visits. Meaning, when the first users visits your page the database is accessed to generate the page. That generated page is stored on the server so the next time a user visits the page they are served that same pre-generated page and the database is left alone. When the page is altered, such as an edit or a new comment, the generate page is flushed and a new one is created.

This reduces most of the database associated slow downs. However, since some users will still encounter the database generated page it's worth getting your database trimmed and optimized as described above.

Summary: Set and Forget

The great thing about the plugins mentioned is most of them can be automated. Just install them once, schedule them to be run routinely and you have very little to worry about. It just takes the initial twenty minutes to get them installed and configured. Last but not least, the healthiest database is one with several backups. Make sure to backup your database frequently to prevent any unrecoverable issues.

Adding new and complex new features to the system may sound sacrilegious. Wasn't the whole point that it was simple and easy? The truth is that WordPress has always been a limitless solution... if you were a capable WordPress developer. However now there are easy to "enable" features that make it the ideal solution for designers. What previous required heavy hacking or several plug-ins can be integrated into your themes right out of the box (or should I say download?)

What you will find is that the WordPress team has addressed the most common requests by top designers with this 3.0 release. Where previous version have made large strides towards a better system none have included quite so many notable capabilities. This now allows designers who use WordPress to add new layers of visual interest and style to their designs with the knowledge that not only can it be done in WordPress, but the design features can be administered easily as well. While the features are powerful and have already created waves in the design communities, there are so many different capabilities that many are unaware of what now can be done with ease.

WordPress 3.0 has included the following key designer features that we will cover:

• Custom background images
• Custom header images
• Custom content types
• Author templates
• Custom menus

Custom Background Images

With the adoption of broadband and better server technologies, a visually rich background image doesn't pose a major experience issue on most users. As a result it is common to see more sites with different visually interesting background images.

Visually interesting background images are a great way to draw a user in and engage them. WordPress 3.0 has given us the ability to upload and select different background images through the administration interface.

Why Designers Should Care

As designers we are no longer held back by complicated implementation issues. We also can give our clients the ability to manage and select different background images with ease. The new functionality includes a full administration interface that has such features as image sizing/editing, positioning, tiling and uploading.

As a site grows and evolves there may be good reason to change the background. Being able to easily switch the background image allows designers to use the background as a tool rather than just an area to fill. We can now design sites with the idea that the background can on the site from time to time (seasonal backgrounds anyone?)

How To Use Custom Background Images

The first step to implementing custom background images is turning on the functionality through your themes functions.php file by adding the following line of code:

if (function_exists('add_custom_background')) { add_custom_background(); }

This will turn on the capability through the WordPress Administration so that users can upload and manage different background images. This functionality puts custom CSS in the head and stylizes the body element.

Custom Header Images

Sticking with the theme of making WordPress a more media rich tool, we now have the capability to upload and manage header banners through the administration panel. The system is sophisticated enough where it will resize large images to fit with in the desired area.

While you could previously force this sort of functionality through post thumbnails it lacked the polish and sophistication of the new custom header images. With WordPress you can now define the size, set the default image and manage them all in one place.

Why Designers Should Care

It used to be that design agencies would design a homepage and subpage for clients. The client could input what ever content they develop into those templates and be on their merry way. While there is nothing inherently wrong with this process the header images rarely could be contextually relevant for every page of content on the site. It is more common these days to have a different header image for each page.

How to Use Custom Header Images

Using and working with custom header images is a bit more tricky than backgrounds, but with a few functions added to the functions.php code you can setup the functionality and turn the keys over to your staff or clients.

(This code was found in the new TwentyTen theme, thanks to wpbeginner.com for the tutorial)

	if ( ! function_exists('customtheme_setup') ):

		function customtheme_setup() {

		add_theme_support( 'post-thumbnails' );

		define( 'HEADER_TEXTCOLOR', '' );
		 array (
		     'url' => '%s/images/headers/customHeaderOne.jpg',
		    'thumbnail_url' => '%s/images/headers/customHeaderOne-thumbnail.jpg',
		    'description' => __( 'Business People', 'customtheme' )
		),
		    'cherryblossom' => array (
		     'url' => '%s/images/headers/customHeaderTwo.jpg',
		     'thumbnail_url' => '%s/images/headers/customHeaderTwo-thumbnail.jpg',
		    'description' => __( 'Chess Set', 'customtheme' )
		),
		    'concave' => array (
		    'url' => '%s/images/headers/customHeaderThree.jpg',
		    'thumbnail_url' => '%s/images/headers/customHeaderThree-thumbnail.jpg',
		    'description' => __( 'Puzzle Pieces', 'customtheme' )
		)
		) );
		}
		endif;

		if ( ! function_exists( 'customtheme_admin_header_style' ) ) :
		/**
		* Styles the header image displayed on the Appearance > Header admin panel.
		*
		* Referenced via add_custom_image_header() in customtheme_setup().
		*
		* @since 3.0.0
		*/
		function customtheme_admin_header_style() {
		?>
		<style type="text/css">
			#headimg {
				height: px;
				width: px;
			}
			#headimg h1, #headimg #desc {
				display: none;
			}
                </style>
                }
                endif;

		

This will setup your theme so that you can upload and manage new custom images. Additionally it allows you to set the banner size so that images that don't fit those dimensions can be cropped to fit. This is half of the work that needs to be done, the next step you must actually insert the code to render the banner into your WordPress theme templates. In most cases this will end up in the header.php file.

<?php
    // Check if this is a post or page, if it has a thumbnail, and if it's a big one
    if ( is_singular() &&
        has_post_thumbnail( $post->ID ) &&
        ( /* $src, $width, $height */ $image = wp_get_attachment_image_src( get_post_thumbnail_id( $post->ID ), 'post-thumbnail') ) &&
        $image[1] >= HEADER_IMAGE_WIDTH ) :
        // We have a new header image!
        echo get_the_post_thumbnail( $post->ID, 'post-thumbnail' );
    else : ?>
        <img src="/images/wp/<?php header_image(); ?>" width="<?php echo HEADER_IMAGE_WIDTH; ?>" height="<?php echo HEADER_IMAGE_HEIGHT; ?>" alt="" />
    <?php endif; ?>
			

		

This code will go through the process of identifying the type of page, if there is a thumbnail and then if the attached image is large enough to fill the space. If it is the image will be rendered, otherwise it will output a default header.

Custom Content Types

One of the areas that has always pained me with WordPress is the lack of Custom Content Types. Systems like Drupal and Joomla have had this capability for a long time and in most projects you are going to end up with situations in which the site has different types of content. Whether you have employee bios or need individual listings for homes just having a standard "page" is rarely ideal.

WordPress 3.0 now has the capability to have Custom Content Types. No longer are we restricted to trying to make all content fit with in a post or page, we can define what ever content we need.

Why Designers Should Care

Previously if you were designing a site you couldn't design any sort of standard layout that differed greatly from your standard page as there were no great ways to implement it. Meaning if you had a standard set of employee information, unless you worked with more complicated plug-ins or taught your client how to use custom fields you had to keep the content pretty free form.

Now that WordPress supports custom content we can customize the administration panel, add our own custom fields and inputs and then design rich interfaces around them.

How to Use Custom Content Types

I will be honest and say that WordPress hasn't made this extremely easy at this point in time. Certainly not as easy as the visual interface of building Custom Content of Drupal's CCK (Content Construction Kit). Much like the other features if you are doing this by hand you will be adding a fair amount of code to your functions.php.

If you are the type that likes to get your hands dirty I recommend you read this great article about setting up custom content types and fields.

If you are like me then you would rather be designing than hacking through your functions.php, in which case you can choose from a wide range of capable plug-ins that will help you build the new content types easily.

Author Templates

WordPress has always had a very flexible templating system. Creating new templates for different sections of your site, blog or categories has always been as simple as creating a new file and adding a comment to give the template a name.

Previous releases of WordPress have resulted in category specific template capabilities, and to make a strength even stronger the new version of WordPress now features the capability to have author specific templates.

Why Designers Should Care

Experienced designers will agree that context is everything. Not only is it important that the template match the content and context of the site, but also the author.

While this won't apply to all sites, it is becoming more and more common to have different authors writing for a single blog. When you have faced with multiple authors you are going to end up with different writing styles, opinions and content. With these differences it simply makes sense to have different templates for the different authors.

Now of course I am not suggesting that you have a drastically different design, rather a slightly different template that indicates and reflects the author and their characteristics.

How to Create Custom Author Templates

Creating an author specific template is incredibly simple, WordPress will look for an author specific template when ever a post is rendered. Finding none it will use a default template. So all you have to do is create a varied template using the WordPress naming structure:

author-{nicename}.php

or

author-{id}.php

Custom Menus

The custom menu system developed from the WooThemes crew is one of the most significant advances in this release. WordPress always had ways to outputting a menu based on page structure, but it was hardly ideal. Often times you had to use a few plug-ins to hide unwanted pages and it really only worked for a primary navigation.

The new menu system makes it easy for clients and designers alike to design and work with rich menu systems with out hacking and extra plug-ins.

Why Designers Should Care

Beyond the fact that it makes designing menus easier it also opens up several new options that we previously couldn't do well with WordPress. We can now have multiple menus that don't need to be hard coded. This means easier footer navigation, utility navigation, etc...

Additionally the new menu system gives us a wide range of additional options such as custom CSS classes, descriptions, etc... This gives us a whole range of options that were difficult before, such as:

• Icons for each menu item
• Menu item descriptions (more popular)
• Better placement / styling through .first and .last style classes
• Better Microformat support through XFN

This really opens up a whole new level of design options that were previously very difficult to do.

How to Use Custom Menus

When it comes to adding custom menu support for our themes there are two steps, the first involves altering the functions.php file to add menu support.

			add_action( 'init', 'register_menus' );

			function register_menus() {
				register_nav_menus(
					array(
						'primary-menu' => __( 'Primary Menu' ),
						'utility-menu' => __( 'Utility Menu' ),
						'footer-menu' => __( 'Footer Menu' )
					)
				);
			}
		

This code here calls a function to register the different menus we wish to create. In this example we are creating a primary menu, utility menu and footer menu. The regster_nav_menus() function will create areas in which we can define menus through the administration panel. We just populate the array with the menu name and description (which can be what ever you would like).

From this point we can include the function to display the nav menu in our WordPress theme through the wp_nav_menu() function.

<?php wp_nav_menu( array( 'theme_location' => 'primary-menu' ) ); ?>

This will output the menu we have defined as 'primary-menu'. WordPress will automatically output an unordered list containing the complete menu that is created through the administration panel. By default it also includes quite a bit of extra xhtml and css, but luckily the function can be customized fairly easily. If you are looking to customize your mark-up a bit more consider reading the reference for the wp_nav_menu() function.

Those of you looking to display the description can do so by using the walker function of the menu, which you can read more about here.

Conclusion

The new version of WordPress has given designers a whole new tool set of functionality and capabilities. We can now put a whole new layer of polish and depth into our designs to provide a better experience for our users.

There is no doubt that WordPress will continue to evolve as a formidable platform and framework for designers and developers alike. As a designer, what features and functionality do you find most useful?

Some of the methods are a bit more difficult and require additional budget or capabilities, however there are tips in the presentation for all levels of WordPress users or developers.

The presentiona not only discusses ways to speed up WordPress, but also why page load time still matters and what techniques and plugins cans ensure that your site loads quickly for all users. You can access the slides as a PDF here, or via slideshare below:

The new menu system alleviates a lot of these problems and gives us easy control over our menus. With multiple menu support, drag and drop ordering and easy title changes it is hard to imagine needing much more.

The new system even addresses a challenge I have always had with WordPress, and that is of using link descriptions. Link descriptions typically are one or two lines of descriptive text below a primary navigation item used to  describe the section or link. They are a nice visual touch and can really enhance usability in a significant way.

Until now there wasn't a great way to do this, even with the use of plug-ins. Even with the use of custom fields and some hacking it was never perfect.

The new menu system allows us to do a bit more customization to our menus, such as adding custom classes, titles and even including a description.

Working with Link Descriptions

The first step is of course enabling custom menu support through your theme. This can be done with the following simple code in your functions.php file:

add_action( 'init', 'register_menus' );
     function register_menus() {
           register_nav_menus(
                array(
                     'primary-menu' => __( 'Primary Menu' )
                 )
            );
      }

You will then find a "Menu" link in your appearance tab with in the WordPress administration interface. Once clicked on make sure that you turn on "link description" with in the Screen Options.

At this point we can now define where we would like our menu to display in our theme by adding the following function to our theme files:

<?php wp_nav_menu( array( 'theme_location' => 'primary-menu' ) ); ?>

This will output the menu with our defined order and menu titles. It won't however output the description by default, in order to do so we will have to take advantage of the $walker function with in WordPress.

This is done by creating a custom class in our functions.php, such as the following:

class My_Walker extends Walker_Nav_Menu
{
	function start_el(&$output, $item, $depth, $args) {
		global $wp_query;
		$indent = ( $depth ) ? str_repeat( "\t", $depth ) : '';

		$class_names = $value = '';

		$classes = empty( $item->classes ) ? array() : (array) $item->classes;

		$class_names = join( ' ', apply_filters( 'nav_menu_css_class', array_filter( $classes ), $item ) );
		$class_names = '';

		$output .= $indent . '<li id="menu-item-'. $item->ID . '"' . $value . $class_names .'>';

		$attributes  = ! empty( $item->attr_title ) ? ' title="'  . esc_attr( $item->attr_title ) .'"' : '';
		$attributes .= ! empty( $item->target )     ? ' target="' . esc_attr( $item->target     ) .'"' : '';
		$attributes .= ! empty( $item->xfn )        ? ' rel="'    . esc_attr( $item->xfn        ) .'"' : '';
		$attributes .= ! empty( $item->url )        ? ' href="'   . esc_attr( $item->url        ) .'"' : '';

		$item_output = $args->before;
		$item_output .= '<a'. $attributes .'>';
		$item_output .= $args->link_before . apply_filters( 'the_title', $item->title, $item->ID ) . $args->link_after;
		$item_output .= '<span>' . $item->description . '</span>';
		$item_output .= '</a>';
		$item_output .= $args->after;

		$output .= apply_filters( 'walker_nav_menu_start_el', $item_output, $item, $depth, $args );
	}
}

This will add the description with in a span element when we tweak our template code to the following:

<?php
       $walker = new My_Walker;
	wp_nav_menu(array(
                'theme_location' => 'primary-menu',
		'walker' => $walker
	));
?>

Tada, now we can have menu descriptions such as on this Buddypress project we worked on here.

Now pair Google Analytics with another free (and this time open source) solution like WordPress and well, it is hard not to get a warm fuzzy feeling.

What you may not realize is that you can get a lot more out of this Google and WordPress pair than simply sticking the tracking number into the footer. There are quite a few rocking Google Analytics plugins that really kick up the functionality of your Google Analytics up a notch. Check them out.

1. Google Analyticator

This is my favorite plug-in in this area. Not only does it add the javascript needed to start tracking your site, it turns your WordPress site into a tracking monster! Rather than just tracking the normal "default" elements it also covers:

• Outbound link tracking of all links on the page, including links not managed by WordPress
• Download link tracking
• Event tracking with outbound links / downloads instead of the old pageview tracking method

It also has plenty of great additional features such as a dashboard widget, front-end visitor widgets, localization and more...

Download Google Analyticator Here

2. Ultimate Google Analytics

This plug-in is on par with Google Analyticator in that not only will it put the necessary google analytics javascript on every page, but it also will track outbound links, downloads and mailto: links. While the default configuration will work for 90% of the users it pays to go through and customize it for your own needs, everything is customizable for your specific situation or need.

The plugin is highly configurable. Read trough the list of features below to get a feeling of what this plugin can do. You can enable and disable all features individually, although the default configuration will suffice for 90% of the users.

Download Ultimate Google Analytics Here

3. RSS Link Tagger for Analytics

On many blogs the conversion point is getting new subscribers. Even with services like feedburner you don't always know what is most effective in getting new subscribers as there is no clear way to track an RSS subscription. However with RSS Link Tagger you can actually track your RSS feed using Google analytics to get a better idea as to what types of articles and posts are most effective in recruiting new subscribers.

Download RSS Link Tagger Here

4. Google Analytics for WordPress

Much like Ultimate Google Analytics and Google Analyticator this plugin automatically tracks and segments all outbound links from posts, comment author links, links within comments, blogroll links and other downloads. It even lets you track Adsense clicks! This plugin is great for tracking downloads as it allows you to specify what types of file prefixes should be used as downloads.

Download Google Analytics for WordPress Here

5. Google Analytics Dashboard

This would be my favorite plugin for client sites. Rather than trying to teach your clients how to login and use Google Analytics (which is an extra step and cumbersome) this plugin puts a view of your analytics data right from your WordPress dashboard.

Even for savvy users this plugin is a great way to keep track of your sites performance with out having to log into Google Analytics every day.

Download Google Analytics Dashboard Here

One of my main issues with most content management systems is that they are simply too large, bloated and complicated for 90% of the sites out there. They focus too much on functionality and not how it is executed. The result is bloated code, poor administrative interfaces and complicated configuration. With WordPress this is not the case, out of the box you can build and manage a simple site and when needed you can extend it to do anything from run a social network, do e-commerce or work as a full functioning web application.

In order to fully harness WordPress for my projects (and my company projects) it is critical that I have a clear and efficient understanding of what WordPress can do. From there it is also important that my employees have the capability to develop with the WordPress platform to make this happen. Now I could come up with a training program or try one of the off the shelf books (which I have read through and were not impressed), but I have found Digging Into WordPress to be an excellent solution.

What You Get

Digging into WordPress is available as a PDF download or as a print version. If you are like me and have no problem reading through a book on screen, the PDF version is an easy reference guide and has the added feature of searching and chapter click through. However I am sure there are plenty of people who would rather have a hard copy to reference while they are working away on their computer.

The book is a whopping 434 pages of content and on a broad level covers critical WordPress concepts such as:

• How to set things up
• Building themes
• Keeping sites secure and optimized
• Making the most of WordPress

More specifically the book has chapters on:

• WordPress basics (how to install, optimize and maintain it)
• Setup and optimization (permalinks, categories and tags, publishing, users, themes and plugins)
• Building WordPress themes (Theme files, page views, header, the loop, comments, sidebar, foots, functions & search)
• Advanced theme design (customizing the loop, sidebars, footers, side content, child themes, styling, widgets)
• Functionality (plugins, custom functions)
• WordPress as a CMS (custom content, page templates, dynamic menus, roles & permissions, great Plug-ins)
• Working with RSS Feeds
• Comments and customizations
• Search Engine Optimization (duplicate content, permalinks, appeasing google, tracking)
• Maintenance (security, comment spam, upgrades, backups)
• Bonus Tricks (option panels, free themes)
• WordPress Updates

As you can see the book is packed with just about anything you could possibly want to know about WordPress. Well Beyond what I had the time to read and learn about my first time through, but I am sure there will be instances where I will need to know how to really customize my RSS output and this book will be the perfect reference manual to do so.

The Excellent Points

There are several incredible parts of this book regardless of your skill level. Having used WordPress for about four years now I have gotten to a fairly high level of fluency, however I still found lots of great information about how to do things that I either didn't know how to do or wasn't even aware was possible. However there is plenty of great content for beginners as well, I was able to hand the book over to one of my new interns and by the end of a few days she had developed her first WordPress theme. Considering it was the first "non-static" site she had ever worked with this was extremely impressive.

Additionally the book does a great job of not only teaching the technical elements of WordPress, but also the practical elements as well. You will learn how to maintain, protect and optimize your blog for faster page loads, higher rankings and more stability. All of these are critical elements to the success of a site after it has been developed and launched (the longer portion of the site life cycle).

What Could Be Improved

The book is a huge wealth of information, that is for sure. However I wonder if this made it difficult to organize. There were more than a few points where the book seemed to jump around a bit in terms of the content and how it all fit together. The first chapter for example, seems to cover a bit of a variety of different topics that range from beginner to advance despite it's label of "WordPress Basics." That being said I would rather have more information and have to hunt a little bit for it than getting a book that left me searching the internet for what I need to know.

Overall...

If you do ANYTHING in WordPress you really should purchase this book. You will not find a more comprehensive reference guide or set of tutorials anywhere. The small cost of $27 will be outweighed by the time saved and the increased capabilities you will gain by reading through and understanding the book.

I have had to go the extra mile on a few projects in regards to security and WordPress, and after a clients website got hacked it made sense to compile all the methods of securing WordPress into one single document. Since WordPress is open source, I figure I might as well make the document open source as well.

You can download the PDF version of the document here, or simply read through it below.

Server Level Security

1. Disallow bots from scanning the important WordPress directories

By using the Robots.txt file it is always a good idea to block the wp-content, wp-admin, etc... directories. This can be done by adding the following line:

Disallow: /wp-*

2. Turn off directory browsing.

Many servers by default allow you to browse the listing of files with in a given directory. You may have come across this before when a page is missing or there is no index to a directory. The server outputs a listing of the files in the directory instead. This is particularly important in regards to plug-ins. If someone can see which plugins you have on your site they might be able to see which ones are venerable.

This can be done through your .htaccess be using the code below:

Options All -Indexes

3. Protect your wp-admin folder

The wp-admin folder is a critical security point with in WordPress. Denying access to this folder (as well as the wp-config.php file) goes a long way to ensuring that your WordPress site is secure.

This can be done in several ways and you may want to do all of them.

3.1 Limit access to your wp-admin folder by IP Address

If you know that you are on an IP Address that doesn’t change you can prevent any intruders by blocking every IP but your own. The drawback here is that if you are traveling, are off site or trying to update the site from a location that is not your typical one you will be denied access as well.

This can be done through your .htaccess by using the example code below:

<Limit GET POST PUT>
order deny,allow
deny from all
allow from 12.345.67.890
allow from 890.67.345.12
</Limit>

3.2 Limit access to your wp-admin folder through password protection

While not as secure as the IP Address method, it can be extremely effective to simply password protect your folder on the server level. This can also build upon the security enhancement of 3.1. For example if someone is able to spoof your IP address they still would need to hack your password to break in.

The easiest way to setup password protection is through the WordPress htaccess Password Protect Plugin.

3.2 Limit access to your wp-admin folder by hiding it

There is no reason that your wp-admin folder has to be called wp-admin. Hackers look for this administration folder in this location. One easy way to eliminate hacking of your site and administration area is simply rename the folder to something else. Simple enough?

4. Protect your wp-config.php file

The password to your database is stored in plain, readable text in your configuration file (wp-config.php). Access to your database gives hackers control over your complete site, so to say you need to protect it is an understatement. The first and most obvious step is to ensure the permissions are set correctly.

Some servers set the wrong permissions by default which allows anyone who wants to the ability to read the contents of that file.

The permission should be set using SSH or through an FTP client to 640

chmod 640 wp-config.php

Additionally you can actually move the wp-config.php out of the main WordPress directory and still have everything function properly. This way hackers don’t know where to look for the file. For example if your wp-config.php is located in /public_html/blog/wp-config.php you could move it to /public_html.

5. Install the 3G Blacklist

A lot of WordPress installations are hosted on an Apache server. If your site is on an Apache server then you can improve the security (not just WordPress) by installing the 3G Blacklist. The 3G Blacklist is:

“a concise, lightweight security strategy for Apache-powered websites...the 3G Blacklist serves as an extremely effective security strategy for preventing a vast majority of common exploits. The list consists of four distinct parts, providing multiple layers of protection while synergizing into a comprehensive defense mechanism.”

Find instructions and usage information on the 3G Blacklist here.

WordPress Level Security

1. Remove the WordPress version number from the META tags

Some hackers target specific versions of WordPress because of known open venerability's.  An easy way to prevent your site from coming up as a target is to simply remove any indicators of the software version.

In older version of wordpress your theme file would hav the following code in the header.php that generates a simple tag that outputs the current version:

<meta content="WordPress &lt;?php bloginfo(’version’); ? /&gt;" name="generator" />

You can prevent this from being an issue by simply deleting that line of code.

Newer versions of WordPress output the version automatically through the wp_head(); function. You can remove these by installing the Secure WordPress plugin.

2. Disable the “Admin” account

By default WordPress creates an “admin” account every time you install it. While the passwords are generated randomly it is never a good idea to let people know the login of your most powerful account. Because all WordPress installations have the same username for the master account you are doing just that.

Simply changing the username from admin to something less obvious will improve the security of your site.

This will have to be done through the database as WordPress won’t let you change or remove the account through the administration interface. The account is located in the wp_users table, and you can simply change the account name, display name, etc... to that of your choosing.

3. Change the WordPress table prefix

All installations of WordPress use the same name for all of the tables on the database. The problem with this is that if a hacker is able to use a SQL injection exploit they know exactly which tables to change data on. If you use an alternative prefix when you install the software this is prevented.

Already have a WordPress installation? The WP Security Scan plugin can help you switch.

4. Use secure connections when connecting to the ADMIN pages

To prevent data being intercepted between your computer and the server hosting your website you can actually force a secure connection to all of the administration panels. This will require that you purchase and implement a SSL certificate from your host first, but once you have done this you can add the following code to your wp-config.php file to activate secure administration:

define('FORCE_SSL_ADMIN', true);

5. Use Security Keys

WordPress doesn’t require that you take advantage of their “security key” tool that better encrypts cookies, there by better protecting your passwords. Using security keys is a simple process where you generate a key and make some simple modifications to the wp-config.php file.

You can generate WordPress security keys on this website.

WordPress Security Plugins

1. Login Lockdown Plugin

This simple plugin will record the IP address of every failed login attempt. If there are too many failed attempts from one IP address the login function will be disabled for that IP range. This prevents brute force password break-ins.

You can download the plugin here.

2. Invisible Defender Plugin

This plugin protects registration, login and comment forms from spambots by adding two extra fields hidden by CSS. The idea behind Invisible Defender is simple: SPAMBOTs either fill every form field they find (generic spambots) or fill WordPress-specific fields only (spambots which will recognise WP or are targeting WP only).

You can download the plugin here.

3. Maximum Security

You can perform and identify a lot of the problems outlined in this document automatically through this full featured and robust plugin. It can identify permission issues and has an intrusion protection system.

You can download the plugin here.

4. Secure WordPress

Little help to secure your WordPress installation: Remove Error information on login page; adds index.html to plugin directory; removes the wp-version, except in admin area.

You can download the plugin here.

5. Secure Admin

Secures Login and Admin pages using Private or Shared SSL.

You can download the plugin here.

Security Best Practices

There are plenty of good security practices that you should follow that are not specific to WordPress.

1. Pick your passwords wisely

The first step to being secure is to ensure your passwords are well formed. A strong password contains upper and lowercase letters, numbers, punctuation marks and are not a common dictionary word. This should be tested on every aspect of your website from your SFTP / FTP account, database password and user accounts.

You can test your passwords using this handy website.

2. Only use secure connections

Most website owners and developers use FTP connections to access the files on their server. This is all good and fine except that the transmission is not secure and is open to security holes. Instead setup an SFTP account which will encrypt your connection and prevent stolen information.

3. Keep your software up-to-date

Any software should be updated as frequently as possible. Updates often fix security holes among other things (performance enhancements, new functionality, etc...) This certainly is the case with WordPress. Now that the system has automatic upgrades there is no excuse to have out of date software.

This is not limited to the WordPress core software either, you should also upgrade your plugins as often as possible as well.

4. Backup often

While it is not going to directly improve the security of your site, the only thing worse than getting your site hacked is getting it hacked with no way of restoring it. You should not only backup the actual files of the site but the database as well.

With the WP-DB-Backup plugin you can automate this process and even have it e-mail a copy of the backup to you on a regular schedule.

You can download the plugin here.

Have a hard core an intensive WordPress site? You can even backup the important parts of your WordPress installation to Amazon S3 servers through the WP S3 Backups.

You can download the plugin here.

5. Secure your MySQL Database

Not specific to WordPress but you can make a lot of strides to improving the security of your MySql database server. I won’t go into the specific details in this document but you can get more than enough information from this detailed website.

Anything Else?

Did I miss something? Have any better ways to perform any of the security items I mentioned? Feel free to leave them in the comments and I will update the post!

To say that the golden rectangle is powerful is an understatement. Powerful and skilled designers can use this ratio to improve their designs dramatically, and what is amazing about it is that people won't be able to directly place their finger on how or why the design is so effective.

The Golden Rectangle Explained

The golden rectangle is a rectangle with its sides in the 'Golden Ratio' or 1 : 1.618. Where most people get this wrong with they might account for the ratio to divide a canvas horizontally (ie: into two columns) but they don't account for the fact that the ratio also specifies a height (vertical divisions). Failing to account for the vertical ratios will reduce the impact and effect of using this tool for visually pleasing designs.

The Photoshop Guide

To make it easier to use this principal we have created a simple tools that lays out a golden rectangle and it's divisions (on all four corners) that you can overlay onto any of your designs. While it is originally designed for a 960 pixel wide canvas, it was created using vector shapes so it can be easily re-sized to any dimension with out losing any quality.

It also is organized based on folders so you can hide / show any portion of it to best fit your design needs.

Downloads and Suggestions

I am open to all suggestions, thoughts or improvements. I am releasing this under the creative commons, so if you choose to post it somewhere or repurpose it please do the right thing and at least attribute me with a link (or two).

Download the golden selection PSD guide here and let us know what you think!

Having tried so many different content management systems (not to make it sound like I am a CMS whore, although I probably am) I have come across features and functionality that I feel would be extremely useful to integrate WordPress. Silverstripe's simple page focused navigation lead me to develop the dashboard pages plugin, which makes it easy to sort and find the page you are looking to edit or manage off of the homepage rather than having to click to find it.

What I Look For in a CMS and How it Applies to WordPress

There are really only a few primary criteria in what I look for in a CMS, so it is shocking that so many content management systems get it wrong. I always focus on:

• User friendliness to a non tech savvy user
• Capabilities with plug-ins
• Ease to template and configure
• Quality of XHTML code delivered

Out of all of those items I would say being user friendly is probably item number one. This is primarily because I really, really, really dislike having to do tech support phone calls on how to do X, Y or Z on a site. I also really, really dislike long CMS training sessions.

So maybe it is born out of selfishness, but a lot of the plugins that I develop are directly related to making WordPress easier to use for the average website owner. Out of the box I feel WordPress is simple and user friendly, however a bit too blog focused when it comes to using it as a primary CMS tool. This isn't really a criticism because WordPress is a blogging platform first and CMS second — however that doesn't mean we shouldn't look to improve where we can.

CMS Dashboard

I have run into a handful of content management systems that make the most common actions so big and obvious no one could miss them. This is one major focus I feel the dashboard of WordPress lacks. A majority of the WordPress dashboard is on plug-ins, news, quick posts, comments, etc... all things that are not very important when it comes to managing an average website. Sure the menu on the left gives you access to all of the major items but there is no emphasis on common tasks and it is easy to skip over an important element because it is hidden amongst everything else.

CMS dashboard puts a widget on your WordPress dashboard with large icons and links to the most common tasks your users will perform including:

• Add / manage posts
• Add / manage pages
• Add / manage users
• Add / manage widgets
• Manage settings

This way you will never get a call asking how to add a user or change a widget. It also will speed up the time it takes to perform tasks and lead to a better CMS experience.

Download or Read More about CMS Dashboard

Editor Tabs

Another design element I loved with Silverstripe was the tabbed interface. Let's face it, there is a lot of controls you can add to any given page that is managed. Especially when you start working with page titles, meta tags, navigation text, custom fields, custom write panels, etc... If you use either the PODS or Flutter CMS plug-ins you are likely to end up with editing pages that have so many meta boxes you have lots of scrolling up and down to simply make an alteration and then publish the page.

This is because WordPress chooses to have additional control over a page done in a very flat manor. This works when you are simply managing a blog and don't have too much information to control, but once you start using WordPress as a CMS it can be cumbersome.

I have had plenty of calls where a client wasn't aware they had control over a part of the site simply because it was so far down on the editor page.

Editor Tabs fixes this by automatically generating a javascript based tabbed navigation menu below the main content editor comprised of all the meta boxes that are on the page. That way you can easily flip through the different options, make a change and hit publish with out having to scroll all the way up and down. Additionally you have a clear idea of what can be controlled and you don't have to hunt for it.

Download or Read More about Editor Tabs

Feedback or Suggestions

I would love to hear any feedback or suggestions. I created these plug-ins because I would find them personally useful, however I am sure there are other small tweaks or alterations that could improve upon them.