After yesterday’s little experiment, I began playing with the WosServer and found some little tricks for bloggers, would-be marketers or developers.

If you already have a blog or site that you are working with that is live, you can create a full version on Wos. It’s a little fussy but you can do the following things…

For parts 1-5, see WosServer: A Useful Tool in your Armoury.

• Step 6: Download a copy of the database from your website (via the PHPMYSQL interface or wizard).
• Step 7: Get and install the WP PHP Admin plugin. Activate it as usual. Head over to the new tab.
• Step 8: Activate the plugin. Then carry out an import operation to import your downloaded file into the WosServer MYSQL database.

Image shows: plugin activated and accessing my database.

• Step 9: (optional) If you encounter a problem with the size of your file, you will need to go into the PHP files in Wos Server, and edit the php.ini file to increase the permitted size from 2M to something more reasonable if you have a BIG blog, like mine.
• Step 10: Download the complete wp-content/ folder with ALL the pictures, too.
• Step 11: Move the wp-content/ folder to its rightful location, images, plugins, themes, etc.
• Step 12: You will also need to change the database name in wp-config.php to your imported database name.
• Step 13: You will need to edit the ‘options table’ in your database from http://www.yourblog.com to http://127.0.0.0/wordpress twice or you won’t be able to access your blog. It will keep taking you to the live site. You will see the first of the two entries in the wp-options table in the first row named ‘siteurl’, the second entry is on page 4 of the list, entitled ‘home’. Change both of these to your new URL. It’s difficult to change them within WordPress like this, because you will end up on your live blog.

Oh, and when you login for the first, do remember to use your original blog password, not admin/password for the WosServer. Oh, and there’s no email reminder! So don’t forget! The good news is that the plugins/wordpress core updates all seem to work fine as they do in version 2.7. Good luck.

This is a short checklist of items that I created when I was setting up a friend’s new blog. It’s pretty much all the tweaks, I make to a standard install of WordPress that I use.

Once you have created your admin user:

• 1). Login and set the password to something you can remember!
• 2). Update any pre-installed plugins that you need, remove any that you don’t.
• 3). Set the title and Tagline in General Settings
• 4). Check your WordPress address is correct
• 5). Update your email address.
• 6). Check the membership of the blog including the New User Role
• 7). Don’t forget to check your timezone!
• 8). Go to the writing tab, and check the size of the post box! I usually set mine to 15 lines.
• 9). For remote publishing, I always check the XML-RPC box.
• 10). Add any Update Services that you want to ping.

On the reading tab in Settings:

• 11). Set your frontpage, to either blog style or have a static page.
• 12). How many posts do you want per page? Five is a reasonable number
• 13). Set your feed to show the ‘x’ most recent posts. I usually set that to 10 if I’m doing full feed or 25 if not.
• 14). Set your feed to show the full text or summary. Most people recommend the full text for feeds.

On Discussion Settings:

• 15). I always set “An administrator must always approve the comment” which is ideal for a new blog, and prevents unnecessary spam.

On the Privacy tab:

• 16). I always set to “I would like my blog to be visible to everyone, including search engines (like Google, Sphere, Technorati) and archivers” but if you’re for a small or private audience, then check the other option.

On the Permalinks tab:

• 17). Set the options for your permalinks. I usually use the /%postname% tag with something else, for example ../archives/%postname%/

Plugins – There are two plugins that are pretty useful to get at the beginning:

• 18.) Akismet for spam. You’ll need a WordPress.com API key for this.
• 19.) WP-Cache Manager. You’ll need to activate it, enable the manager and set the time (in seconds).

Users Tab – On the Users tab, click to find your admin profile:

• 20.) Set the Nickname to something you like. Hit ’save’.
• 21.) Set your “Display name publicly as” to the Nickname in 20.)
• 22.) Check your basic details, Website, and any Bio. Info.
• 23.) Go to the Design Tab.

If you have a good host, you’ll have a variety of themes pre-installed.

• 23.) Find a good one, activate it.
• 24.) Go to the Widgets and select the ones you need.
• 25.) Go to the Theme Editor…
• 25.) Add your Google Analytics code in the footer!
• 26.) Add any other code that you might need to the footer.

General Tidying Up: Let’s set the links categories

• 27.) You will need to decide what links categories you need.
• 28.) Remove or add any particular links you need in the blogroll.
• 29.) Set your initial categories for posts, too.
• 30.) Remove the Hello World post and default links in the blogroll!

This has been honed over numerous installs of WordPress, but is by no means the only possible set. If there are any errors, please read the comments and submit one!

Well, WordPress 2.7 is just around the corner, yet another upgrade, yet another version that is likely to introduce all the things we love and hate about WordPress

New Features and Bugs

Take a look… I won’t be in the first wave of upgrades at all. I’ll likely hang around for version 2.7.1 before upgrading unless there’s an immediate requirement to upgrade.

I think the interface will be useful and more friendly, but I won’t really know until my customers have tried it out! For more information, check out an extended discussion at WebTools Collection.

Michael Kwan’s blog was recently hacked by a clever hacker who managed to hide his visit neatly. Michael will tell you all about the story at his blog. This event plus a couple of other events has got me thinking about blog security . I’ll be doing a fuller post on my own experiences, ideas and suggestions.

It’s going to be a long post, so it will take some time to put all the pieces together. In the meantime, why don’t you sign up for my feed… so you don’t miss it!

——-
For more interesting articles on running a business, making money, operating your blog, , and so on…, subscribe to the RSS feed or email newsletter. There’s a lot more in the Random Walk to Wealth on InvestorBlogger dot com.
——-

Apart from the obvious tactics of keeping your blog software, themes, and plugins uptodate, several bloggers have suggested ways to make it more difficult to find out which version of the blog platform, and which plugins, you are actually running.

The typical solution is to add a blank html file to the /wp-content/plugins/ directory which will show a blank page, or in John Cow’s case a Moo! But I was surprised to learn that this technique fails to stop an easy way around this. It is possible to discover quite easily any plugin that you can guess is installed and retrieve the directory listing for that plugin even though the higher level directory is masked. Take a gander:

(This image was taken from one of my other blogs with the WP-Cache plugin installed and active.)

I found the directory for the wp-cache folder for another blogger who had otherwised masked his plugins directory with the standard blank HTML file. Unfortunately, a determined hacker will be able to figure out which plugins you likely have, rifle your directory of files to see which files exist in the subdirectory of plugins, and perhaps hack your blog… I could see the contents of this wp-cache directory, plus all the other ones I knew this blogger to have been using. Mmm! I didn’t think that was particularly secure.

What alternatives are there?

Standard .htaccess

Yes, you could simply use an ‘htaccess’ file to secure the plugins from display but you would have to manually write and upload the file to each and every plugin directory that you already have. This could be done more than ten times on my blog, I think. It would look something like this:

Redirect 301 /index.html http://www.your-domain.com/
Redirect 301 /index.htm http://www.your-domain.com/
Redirect 301 /index.php http://www.your-domain.com/

But I realized that with the most commonly suggested solution to prevent viewing plugins, namely a 301 redirect, it is still possible to view the contents of any directory of any plugin below the directory in which the htaccess file is placed. So even if you place the htaccess in the directory of any particular plugin, some plugins also contain subdirectories (for images, etc.) that will still be visible. Tiring work…, so…

IndexIgnore

If you have a lot of directories in the plugins folder, the simple and easy solution is to create an htaccess file with the following command: “IndexIgnore *” and place it in the /wp-content/plugins folder. This should prevent anyone seeing the listing in that folder or any folders below that level. It generates an error like this:

It’s not very pretty but it’s effective so browsers won’t display the contents. It could also be an opportunity wasted. Why?

HTML file

The standard blank HTML file mentioned above looks something like this:

<HTML>
<HEAD>
<TITLE>Blank Page</TITLE>
<META HTTP-EQUIV=”Content-Type” CONTENT=”text/html; charset=utf-8″>
</HEAD>
<BODY>
</BODY>
</HTML>

Then Michael Kwan suggested adapting it to a page redirect in a chat we were having. He wrote: “…i’m thinking that it’s also possible to do a index.php and then put in a redirect… if you keep this file handy then you can upload it each time you install a new plug-in…” I began to think: What a good way to turn a problem into an advantage! I’m using an HTML file, though, not a PHP file.

The blank HTML file doesn’t show anything, and inadvertent visitors will not know what’s wrong. And the 404′s only show that a page was not found. So why waste the opportunity? I’ve adapted some simple code that I use, and it should work a treat. I would like to attribute this code, but I can’t remember where it came from!

Page Redirect

With this page redirect, it’s easy to redirect visitors quickly and conveniently to the most recent posting or indeed any specific page you want:

<html>
<head>
<title>Your Domain</title>
<meta name=”robots” content=”noindex,nofollow”>
<script>window.location=http://www.yourdomain.com;</script>
<meta http-equiv=”refresh” content=”1; url=http://www.yourdomain.com“>
</head>
<body>
<p align=”center”>You are going to Your Domain Name now…
<br>If the page does load after 5 seconds or if you are (like me) impatient,
<a href=”http://www.yourdomain.com“>just click here</a>.</p>
</body>
</html>

The only downside is that you’d have to add this to every plugin directory the first time. But you could easily keep a copy somewhere and copy it to any subsequent plugin directory before you upload the plugin.

Thanks to Michael Kwan, and others for providing information that helped to write this blog. I’d appreciate any updates on security, so just drop me a line, especially if I got something wrong.

(Post edited for language, clarifications, and so on.)