I have two new buttons on the top: My Calendar and Presentations. Using the ICS Calendar plugin for WordPress, I integrated the events into my blog by plugging the ICAL feeds for the calendars into the ICS plugin’s settings.

The plugin works pretty well. It automatically pulls the event information from the feed without requiring you to do anything in WordPress. You can specify the format for the event details using the tags in the plugin’s settings page. My custom format looks like this:

<h3>%event-title%</h3>
<div class="icalmeta">%date-time%<br/>
%location%</div>
<p>%description%</p>

It’s a little snazzier than the basic page I had previously used. And I only have to enter event information into one place.

Blog Sponsors

• Madcap Software
• Edit Me
• Dr.Explain
• Scriptorium
• Intelligent Content
• Adobe Technical Communication Suite 2
• Alma Loveland, Designer
• Snagit from TechSmith

Then last weekend, I checked the site, and it was totally gone. Completely? Yeah, completely. I logged into cPanel and the entire database had been deleted. Previous hacks had just deleted all posts, pages, and users tables in the database. Now the hacker turned it up a level and deleted the entire database. 

I looked at the log files and noticed that an IP address from Calgary rifled through the client’s cPanel and finally deleted the database. After about 30 minutes with Bluehost tech support, the support person mentioned that someone had requested the password to be sent to the email address on file. It’s common to have a retrieval method in case you forget your password. Almost every website with a login offers this. Somehow the hacker retrieved the password this way — either by retrieving it from the client’s email or through another method (intercepting it?).

I pressed the support rep about the security and encryption for the password retrieval tool, and he did say that you can request the password for any domain by plugging in https://www.bluehost.com/cgi/forgot?domain= or http://www.bluehost.com/cgi/forgot?domain= and adding your domain after the = sign.

He then said, ”I think our issue might be from our password request tool. I am reporting it now.” But he also suspected that the client’s email account had been compromised. He said changing the password may solve the problem entirely.

I don’t know if the password retrieval method is a common way to hack a site. But it’s a sneaky way to gain access. You may have a 25 digit hexadecimal alphanumeric password for your web host account, but probably not for your email. And do you really use different passwords for email, Facebook, Twitter, and the 75 other websites you log into? Guess one password and you probably have access to nearly all of them. With access to email, all you have to do is retrieve the password from the web host, and within minutes you have access to the MySQL database, where all posts and pages are stored.

What I’ve learned from the experience is to immediately look at the log files. As hard as log files are to read, log files allow you to trace the path of the last visitor to the site. You can look at the origin of the IP address through who.is. The log files tell you what part of your site the hacker visited. If the entry point is cPanel rather than your site, you might ask support if someone retrieved the password on your account. (The information about the password retrieval is something only tech support knows — it’s not in the log files.)

So after hours of looking at WordPress for the security vulnerability, going through theme code, plugins, and everything else, it turns out the vulnerability was with Bluehost’’s password retrieval and the client’s email account. The hacker was getting in through cPanel, not WordPress.

It’s not such an alarming problem, though. Because even if your entire site gets hacked and deleted, the web host usually backs up the site once a week or so. The worst scenario is that you’ll lose the last couple of posts (which you can retrieve via email if you’re subscribed to email delivery of your posts).

The real issue is getting hacked repeatedly and not knowing where the security vulnerability is. My advice is to look at the log files, who the last visitor was, and where they entered the site. Did they hack into WordPress or cPanel? Find out if someone retrieved the password. Is your email password easy to guess? Is it the same password that you use everywhere?

3/2/2010 update: A user in the comments informs me that the password retrieval tool is not part of cPanel but rather Bluehost. I had assumed otherwise. Sorry cPanel.

Blog Sponsors

• Madcap Software
• Edit Me
• Dr.Explain
• Scriptorium
• Intelligent Content
• Adobe Technical Communication Suite 2
• Alma Loveland, Designer
• Snagit from TechSmith

Adding more sidebar sections

Adding more sidebars is useful if you’re using WordPress more as a content management system than a blog.

Someone asked me how I did this. The process isn’t hard. I’ve broken it down into three steps. (Before you continue with the instructions, you may want to back up the information in your existing sidebar.)

Step 1

Add this code to your functions.php file under Appearance > Editor.

if ( function_exists('register_sidebars') )
        register_sidebar(array('name'=>'Sidebar Home','before_title'=>'
','after_title'=>'
'));
        register_sidebar(array('name'=>'Sidebar Jobs','before_title'=>'
','after_title'=>'
'));
        register_sidebar(array('name'=>'Sidebar Meetings','before_title'=>'
','after_title'=>'
'));

Note: Sometimes you have other sidebar code that looks similar to the above. If so, use it instead.

In this example, the sidebars that will be added will be called Sidebar Home, Sidebar Jobs, and Sidebar Meetings. Change the names to whatever you want. You can add many more sections here, not just three.

You can also add more arguments than simply name, before_title, and after-title. See the full function reference and arguments with registering sidebars.

You’ll also need to delete the previous register_sidebars function so that the two don’t conflict.

Step 2

Add a reference to the sidebar section where you want the sidebar to appear in your theme. For example, type the following to insert the Jobs sidebar:

<?php if ( !function_exists('dynamic_sidebar') || !dynamic_sidebar('Sidebar Jobs') ) : ?>

To insert the Meetings sidebar, you would type Sidebar Meetings rather than Sidebar Jobs.

Step 3

In a text editor, duplicate your existing sidebar code, rename the file (for example, sidebar_jobs.php), and FTP the file into the folder with your other theme files.

Where you want the file to appear (probably in a specific page template), add this reference to the file:

	<?php include(TEMPLATEPATH."/sidebar_about.php");?>

Remove the other code that calls the sidebar (probably get_sidebar). Now that page template will show your Jobs sidebar. And you can configure your Jobs sidebar under Appearance > Widgets.

Although I’ve mainly been calling these sections a sidebar, you can create sections and insert them anywhere in your site, such as the footer, an ad space in the header, or elsewhere.

Blog Sponsors

• Madcap Software
• Edit Me
• Dr.Explain
• Scriptorium
• Intelligent Content
• Adobe Technical Communication Suite 2
• Alma Loveland, Designer
• Snagit from TechSmith

Set Up WordPress on Your New Host

1. Identify the new host. Picking out a new host can be tough, but look for performance, support, and an easy interface, such as cPanel.  To ensure good performance, make sure the web host doesn’t overcrowd their servers (this slows down your site’s loading time). For support, see if you can contact them at all hours of the day. That’s why I like Bluehost so much — at any time of the day or night I can get a hold of someone either by live chat or phone.

   Also look for a web host that offers an easy interface, such as cPanel, which gives you a standard interface for working with your content. If they don’t offer cPanel, make sure you have access to a phpmyadmin and MySQL Databases tool. Finally, don’t choose a Windows server or else you’ll have index.php in almost every address of your blog (in addition to a file permissions issues). Most servers are Linux or Unix — these work much better with WordPress.



cPanel gives you a familiar interface for working with your database, which is key if you're managing a WordPress blog

2. Make sure you have the web host login, the FTP username and password, and the temporary IP address of your new web host. This information should be in your welcome email when you sign up for a hosting plan. I think I spend half of my time with clients trying to figure this information out.
3. Log into the cPanel of your new web host and install WordPress. You might use the easy Simple Scripts or Fantastico installers (available options in cPanel) to simplify the install. But even if you have to manually install WordPress, it only takes 5 minutes. You probably have to install WordPress in the primary domain for your account, e.g., ACME.com. But wait, you say, your ACME.com domain is pointing to your old web host (e.g., on Yahoo), so how will you access your new blog (e.g., on Blue Host) if the domain points to the wrong web host? Don’t worry — just install WordPress in the right domain (e.g., ACME.com). In the next step, you’ll make an update to the blog’s database settings to enable you to work with the blog at its temporary domain.
4. After installing WordPress, go to cPanel on your new web host, log into phpmyadmin, select your database from the drop-down filter on the left, click wp_options in the list of tables in your database in the left column, click the Browse tab, and then change the siteurl and home values from http://ACME.com to http://yourIPaddress.com~directory — where IPaddress~directory is your temporary URL of your new host (which they tell you when you sign up). To change the value, click the Edit button (pictured below), change the value, and then click the Go button at the bottom.
   

   Change your domain in wp_options to your temporary domain so you can work with the site

   (By the way, you have to click the Next > arrow at the bottom of the screen to see the home value.) There are other ways to do this, but I think going into phpmyadmin is the easiest.

Export Your Content from the Old Blog

1. Export your content from your old blog. You could export your entire MySQL database, but while you’re starting fresh, why not start with a fresh database as well? Instead of exporting the entire database through phpmyadmin, go to Tools > Export within the WordPress Dashboard interface and export your content.


Go to Tools > Export to export your posts, pages, and comments in an XML file

WordPress will generate an XML file containing all your pages, posts, and comments. This export purges you from any bad code that might be lingering in your database.

Note: You could also just export your MySQL database from phpmyadmin, but if you’re transferring web hosts, you may have been experiencing issues with your old web host, either from attacks, slowness, quirks, or other issues. Those issues may have actually been inherent in your database rather than the web host. Additionally, your WordPress files may have certain file permissions set from that web host. I’ve found that it’s just easier to start with a fresh database and install WordPress the way a particular web host wants it.

2. FTP into your old web host and download your wp-content folder. This folder contains your theme, plugins, and all the image uploads for your posts. I recommend using Filezilla as an FTP client.

Import Your Content into Your New Blog

1. Most likely your exported XML file is larger than 2 MB, so you have to adjust your PHP.ini file so that you can upload the XML file into your new blog. In cPanel, under the Software / Services section, click PHP Config and select PHP 5 (Single php.ini) file at the top. This will tell your server to use this same PHP for every directory on your host. Then click the INSTALL PHP.INI MASTER FILE button at the bottom.


You need to generate a php.ini file and change the values so that you can upload your exported XML file (if it's larger than 2 MB usually)

This will create a php.ini.default file in your public_html folder. Using FTP, go into this /public_html directory, download the php.ini.default file, rename it to php.ini, and adjust upload values (search for the word “upload”) to something greater than 2 MB. While you’re in the php.ini file, increase the memory values as well.

2. Go to your new blog using the temporary IP address/wp-admin. After you log in, go to Tools > Import and import the XML file containing your pages, posts, and comments.
3. Upload the wp-content folder to your new host’s web directory. (You can overwrite the new wp-content folder.)
4. Reselect your theme from Appearance > Themes in your new blog.
5. Go to Settings and reconfigure your basic blog settings, such as permalinks, comment approval, and other options.

Transfer Your Domain

1. Life is sometimes easier if you manage your domain at your web host (rather than having a separate company manage the domain). If your domain was managed by your old web host, unlock your domain and disable privacy. If you just disabled privacy and made your contact information public, you may have to wait a few hours for the who-is database to update. (You can’t transfer the domain while the contact information is private, because the winning registrar will need to send a verification to the administrative contact email, and if it’s private, the email address is hidden.)
2. Figure out what your authorization code is for the domain. Poke around the old web host’s settings for this. If you can’t find it, contact your old web host and ask them for it.
3. In your new web host, in cPanel go to the Domain Manager and transfer the new domain to the web host. To transfer the domain, you’ll need to the authorization code. The new registrar must also send an email to the contact admin address listed on the domain at your old web host. You’ll grab this verification code at the contact admin email and use it to verify the transfer.
4. There’s one more step if you’re trying to get out of Yahoo. Yahoo requires you to wait 5-9 days for the release of the domain name to the new registrar. You can try calling them to speed up the process, but they won’t do anything.
5. After the domain is released, wait 12 to 72 hours for the Internet servers around the world to receive information about the updated domain.

That’s it. Seems like the process should be less painless, but it’s not.

Blog Sponsors

• Madcap Software
• Edit Me
• Dr.Explain
• Scriptorium
• Intelligent Content
• Adobe Technical Communication Suite 2
• Alma Loveland, Designer
• Snagit from TechSmith

I recently decided to change my blog theme. I know that people are interested in content more than design, but it’s worth a post explaining why I changed this theme.

I recently switched blog themes

I’ve had the Limau Orange theme on my blog for about two years now. I grew tired of looking at it, and the design seemed a little out of date. Woothemes.com was running a Black Friday 50% off deal, and since I’ve always been impressed by their themes, I took the plunge and joined the Developer Club. This gives me access to all their themes with the ability to use them on as many domains as I want. By the way, if you want a theme, let me know and I’ll give it to you for free (yes, I can do that — I checked with them).

I narrowed my choices down to several themes and then let my daughter, who gives excellent advice, decide. She chose the Daily Edition.

The Daily Edition theme

Part of the appeal of the Daily Edition theme is the Flash slideshow on the home page. This slideshow makes the otherwise minimalist theme stand out. It’s eye candy, basically. And though at times it feels like a neon sign, it forces me to include visual elements where normally I might omit them out of laziness.

Embedding a slideshow at the top of your posts, by the way, is not hard at all. Just install the Featured Content Gallery plugin, add a snippet of code to your index.php file, and voila, you have a slideshow. This is the same feature I have on the Intermountain STC site.

Another thing I like about the Daily Edition theme is the readability of the font. The main column isn’t too wide, the font is readable, and it has a good amount of white space.

I would like to say the theme required no customization. But that’s not true. I had to restyle the blockquotes on the home page to match the blockquote style on the single pages (the blockquote style is a little grandiose, I think). I fixed the display of widgets in the sidebar (particularly the excessive padding with the headings), added multiple subscribe buttons on the main navigation bar (which required an adjustment to the stylesheet), changed the list of links below the latest posts (initially these were called “Talking Points” and were driven by tags), created a single post template for my screencasts category and widened it to accommodate a larger screencast size. I added more ad spaces, integrated my logo, customized the display of the Publish2 Technical Communication newsgroup links, rearranged the tabber and customized the tab’s PHP code, and added a truncation script to the slideshow text (because two lines in a title broke the display).

The themes at Woothemes, I have to add, have more complicated code. The designers try to create elaborate interface options, like this:

Woothemes have more elaborate interface options

As a result, the code that drives the interface options is more complex. I imagine this is an inevitable tradeoff: either have simple code and no user interface options, or lots of easy user interface options but complex code.

That’s about it for the theme. If you have any suggestions for improving the design, please let me know.

Blog Sponsors

• Madcap Software
• Edit Me
• Dr.Explain
• Scriptorium
• Intelligent Content
• Adobe Technical Communication Suite 2
• Alma Loveland, Designer
• Snagit from TechSmith

Here’s the description:

Because most communities have far more virtual participants than physical participants, establishing a strong web presence where members can find information, interact with each other, and access resources is critical. In this community webinar, we’ll review a handful of chapter or SIG sites and discuss what’s working well and how they might be improved. If you want to have your site reviewed, send me the URL before the webinar.

We’ll also talk about WordPress — a popular platform many chapters are using for their websites. As a WordPress consultant, I deal with all kinds of WordPress questions, from customizing themes to implementing specific plugins, tweaking the stylesheet, inserting PHP tags, and fixing crashed sites. If you’re currently managing or implementing a WordPress site, bring your questions and I’ll try to answer them. I’ll also go over my top 10 recommended WordPress plugins.

Sign up for the webinar here.

Blog Sponsors

• Madcap Software
• Edit Me
• Dr.Explain
• Scriptorium
• Intelligent Content
• Adobe Technical Communication Suite 2
• Alma Loveland, Designer
• Snagit from TechSmith

I also embedded this video in a WordPress wiki that I’m developing.

Installing WordPress locally involves about 6 steps:

1. Download and install Wampserver.
2. Create a database in phpmyadmin.
3. Add a user with privileges to the database.
4. Download WordPress and extract to a folder in the www directory.
5. Customize the wp-config-sample.php file.
6. Run the WordPress install script at wp-admin/install.php.

Blog Sponsors

• Madcap Software
• Edit Me
• Dr.Explain
• Scriptorium
• Intelligent Content
• Adobe Technical Communication Suite 2
• Alma Loveland, Designer
• Snagit from TechSmith

Section Widget

The winner of the latest WordPress plugin competition is the Section Widget by Godfrey Chan. I was exploring it yesterday, and I’ve got to say, it’s one super cool widget. Look in the lower-right corner of my sidebar to see it in action.

The Section Widget provides a tabbed widget, first of all. On each of the tabs, you can type your own text or code. You can also choose from one of about 20 different styles. And you can apply logic to the widget’s appearance in your blog, so you can set it to display only on certain categories, pages, or sections.

I like the tabbed widget because it allows me to display content in a compressed way — content that would otherwise be buried in my archives. I chose to add two custom bookmark lists and one list of random posts. (I chose the posts in my bookmark lists rather quickly — one tab shows my top 10 or so, another contains posts oriented for students.)

I did have a little trouble getting the Section Widget installed. It seems to take a lot of memory, so you may have to disable your other plugins first (if you run into trouble).

The two runner up plugins are Advanced Export for WP and WPMU, and Live Blogging. The Advanced Export is quite useful as well because although you can export your posts from WordPress using the built-in exporter (Tools > Export), the file is usually larger than 2 MB, which is problematic. When you try importing an XML file larger than 2 MB into another WordPress installation, the PHP rules block it because of a standard 2 MB limit.

To get around the limit, you have to install a php.ini file (which controls how your server’s PHP handles scripts) in your file directory, and then tweak a few limits within that file. In my experience, tweaking the php.ini file is anything but intuitive and sometimes doesn’t work. It’s much easier to just export about 7-8 separate XML files (broken up by date) and then upload them individually.

As for the Live Blogging plugin, I don’t have a use for it, but if you’re attending a live event or updating scores for a football game, it might be useful.

Blog Sponsors

• Madcap Software
• Edit Me
• Dr.Explain
• Scriptorium
• Intelligent Content
• Adobe Technical Communication Suite 2
• Alma Loveland, Designer
• Snagit from TechSmith

I actually helped Scott transition his site from Expression Engine to WordPress. Converting the site was not necessarily easy, because WordPress doesn’t automatically import Expression Engine databases (like it does with Blogger, Movable Type, and other platforms). You have to run a manual script to convert the entries over.

And while we used a theme from press75.com, we customized it, hiding the featured panels, changing the widths of sidebars, customizing the banner, adding in share-this-post buttons in the post headers, customizing the display of podcasts,  adding a mobile view, integrating an asides column, including author pages, adding the sidebar ads, adding the big subscribe buttons in the upper-right corner, and making other tweaks here and there.

The Content Wrangler on WordPress

I find that when people want to move to WordPress, it’s easiest to find an existing theme that best approximates what they’re looking for, and then customize it from there. WordPress is a bit complex to begin entirely from scratch (think of the comments features, the handful of theme files — index, single, archive, comment, search, etc — all the PHP tags, and more). If you do start from scratch, almost everyone uses an existing WordPress theme framework, which is basically a stripped down theme.

A while back I also helped Rahel Bailie move her Expression Engine site to WordPress. Her theme actually started out as the Brownline theme, and we customized it with her blue and gold branding to look as it does now.

Not to make a bandwagon appeal here, but if you a blog on another platform, you might consider moving to WordPress. WordPress has a tremendous momentum and community behind it right now. It’s hard to compete with it. And the user interface is usable and easy to learn.

On the other hand, all technology is transient. Content is what matters.

Blog Sponsors

• Madcap Software
• Edit Me
• Dr.Explain
• Scriptorium
• Intelligent Content
• Adobe Technical Communication Suite 2
• Alma Loveland, Designer
• Snagit from TechSmith

Right now there is a worm making its way around old, unpatched versions of WordPress. This particular worm, like many before it, is clever: it registers a user, uses a security bug (fixed earlier in the year) to allow evaluated code to be executed through the permalink structure, makes itself an admin, then uses JavaScript to hide itself when you look at users page, attempts to clean up after itself, then goes quiet so you never notice while it inserts hidden spam and malware into your old posts.

Upgrading to 2.8.4 is pretty easy and won’t take more than 5 minutes. Here’s the process I recommend:

1. Back up your database. If you don’t already have a WordPress backup plugin, go to Plugins > Add New and install WP-dbmanager. With some web hosts, this plugin doesn’t seem to work. If that’s the case, use WP-DB-Backup. When you back up your database using one of these plugins, you’ll be prompted to download an sql file (which contains all the content from your posts, pages, comments, and settings).
2. Go to Tools > Upgrade and click Upgrade Automatically. If you receive an error here, deactivate all your plugins and try it again.

That’s it. If for some reason the above method for upgrading doesn’t work, you can upgrade manually by deleting your wp-admin and wp-includes folders and all the files in your root except wp-config.php, .htaccess, and the wp-content folder. Then just download the latest version from wordpress.org and FTP the  files as replacements. It always freaks me out to hit the delete key in there and see dozens of files disappear , but just remember that your content is stored in a MySQL database, not in the WordPress files.

Here’s one other security measure. If you’ve had your blog for a while (a year or more), download wp-confiig.php (this file is in your root and contains important database information) and make sure you have the latest security statements in there (compare with wp-config.php from the latest WP download). You can generate some random security strings here.

While you’re upgrading, look at your list of plugins. Most likely a few of them have updates that you can apply by clicking Update Automatically next to each plugin.

If you need help upgrading your WordPress blog, let me know. If you’re a personal friend, I may do it for free.

Blog Sponsors

• Madcap Software
• Edit Me
• Dr.Explain
• Scriptorium
• Intelligent Content
• Adobe Technical Communication Suite 2
• Alma Loveland, Designer
• Snagit from TechSmith