Austin WordPress Meetup

Bringing together WordPress users of all levels

WordPress Beginners

How to choose a WordPress Theme

WordPress Beginners, WordPress Themes

What is a theme?

Depending on how you use it, WordPress is a blogging platform/content management system/website building software – in essence, it’s the behind the scenes code that makes a website work. Your WordPress site itself consists of content, the posts/pages/images that convey information, and a theme, which is the overall design that you choose to determine how your site will look to the outside world. You do not (usually) change the underlying WordPress code (or need to reinstall WP) in order to change the site’s theme, though on occasion you may need to modify your content.

Choosing a theme

Do’s:

  • Define the purpose, structure and audience for your website.
  • Consider your branding (logo, design, etc. of your print materials, signage as well as message)
  • Who is the primary audience? What characteristics define them?
  • What is your site’s purpose? Blog? News? Gallery/portfolio? Sales?
  • What features do you need on the site? Social media? Shopping cart? Forms?
  • Determine the basic structure for your site: wireframing


Don’ts:

  • Choose a theme solely based on color, fonts, or graphics.
  • Obsess about it being ‘perfect’ (to the point where you don’t have a functioning website!)
  • Give up.

Other questions to consider:

  • What kind of media and what is most important/prominent? Text/Photos/Audio/Video
  • What kind of navigational structure do you need? How do you want your menu bar to work (e.g. drop downs)? Do you need a special way to display categories/tags, comments, or multiple authors? Do you want a sidebar – or multiple sidebars? Widgeted footers or headers?
  • How important is a custom(ized) design?
  • What is your own skill level for adding your own features/modifying a theme’s design? Are you willing to pay a developer/consultant to work with you or do you need to be self-sufficient? Are you willing to read documentation or contact support (if provided)?
  • How much are you willing to pay for a theme? Do you need/want support from the theme developer?

When you find a theme you (think) you like:

  • Does it offer the customization you need? Can you change layout, font and/or colors from the admin panel? Can you move the sidebar or increase/decrease number of sidebars/columns, or upload your own header graphic? With CSS and PHP skills, all of these things can usually be modified, but if you don’t have those skills (or don’t want to pay someone) then it’s good to have the options at your fingertips.
  • Is it GPL? (See http://wordpress.org/about/license/ )
  • Can you remove/alter the theme designer’s info/logo in the footer?
  • Can you figure out how to use any special features like a slideshow option?
  • Can you alter other elements or add your own as needed?
  • Is there a forum or other online support? Is the theme developer available to answer questions through their own website (some do it via comments) or via email?
  • Upload and activate your new theme with your own content. Does anything immediately break (often the navigation bar is the first to go) and if so, can you work around it?

Resources from WordPress.org:

Sites/products discussed at the meetup:
(note: inclusion here does not imply that WP Austin recommends any of the following; they are listed here solely as reference).

Choosing a theme worksheet (PDF file)

Security – Locking Down Your Site

Security, WordPress Beginners, Tips and Tools

This entry is part [part not set] of 4 in the series WordPress Security

Hide WordPress Version in the Header Tag

Although you have deleted the WordPress version meta data from your theme, you may still get WordPress version line in the page returned by the blog software. The culprit is, since version 2.5 WordPress has added the feature to generate this code.

Add the following line to the functions.php file in your theme directory: (Create a blank PHP file with this name if your theme doesn’t already have one)

<?php remove_action('wp_head', 'wp_generator'); ?>
It is important to note that even with all of those above implemented, there is no guarantee that your blog will be safe. Just that you decrease the chance tremendously and discourage those crackers from targeting your blog.

New exploits are discovered every so often and when a fix has not been made available yet, everyone is at risk. However, by implementing all or some of the tips above, at the very least it should give you peace of mind that you are not leaving your house unlocked.

I recommend the plugin Better WP Security which is easy to use and configure, and does many of the security functions for you.

Security – Proper WordPress Installation

Security, Tips and Tools, WordPress Beginners

This entry is part [part not set] of 4 in the series WordPress Security

Change The Default “Admin” Username

The problem
Brute force is one of the easiest ways to break a password. The method is simple: try as many different passwords as possible until the right one is found. Users of the brute force method use dictionaries, which give them a lot of password combinations.

Knowing your username makes it easier for them to guess the right combination. This is why you should always change the default “admin” username to something harder to guess.

Versions of WordPress starting with 3.0 let you choose your desired username by default, so there should be no excuse for not doing it right. If you have a site that was created with an older version, Admin renamer extended.

Pick Secure Password for Admin

Changing your admin username to something else is not a guarantee that people will not be able to guess it. For instance, if you use your username as the displayed meta data in every post, or you enable author specific page in multi-author blog, you will reveal your user name to the world.
With that assumption, you should pick secure password for your WordPress login. Combine upper and lowercase characters and numbers.

You can change your password after your site is installed. You may even want to to change it on a regular basis. I recommend the plugin WP Security Scan because it has a password generator.

Populate wp-config.php Properly

Go through each line in wp-config.php, not only the first block for database configuration.

Use WordPress secret key generation tool to generate random salts for WordPress cookies. These keys are used to insure better encryption of information stored in WordPress user’s cookies.

There is an automatic generator for these at: https://api.wordpress.org/secret-key/1.1/salt/

You also want to modify the WordPress table prefix to something other than wp_. Adding random characters and numbers to the end of wp, such as wpRbX3i_ obfuscates it enough but still allows you to recognize the tables as those belong to WordPress.

Security – Prevent Directory Browsing

Security, Tips and Tools, WordPress Beginners

This entry is part [part not set] of 4 in the series WordPress Security

By default, most hosts allow directory listing. Because there are a standard set of directories in a WordPress installation, the hacker can go directly to the directory inside your site and see all of the files in that directory. This is definitely a security risk, because a hacker could see the last time that files were modified and access them.

This is a simple but important problem to fix. You have three options:

  1. Place an empty file in each directory with the name INDEX.HTML or INDEX.PHP
  2. If you are using an Apache webserver, modify your .htaccess file
  3. Use a Security plugin (see the end of the series for suggestions)

 

Security – The Mind of a Hacker

Security, WordPress Beginners

In class I will show you a few of the ways a hacker finds vulnerabilities in websites.  I will not include that information here because all I want to do is illustrate the no one is immune, not teach you how to hack.

Most often hacking is a crime of opportunity – like an open gate or unlocked car door. In general the hacking process involves three steps:

  1. Find a point of entry
  2. Compare the website / server information to know vulnerabilities
  3. Have fun

The hacker doesn’t even have to know what he or she is doing. There are many programs that can be found on hacker sites that go through this process automatically. Thesw are popular with novice, juvenile, or dilitante hackers. Because they often don’t require any sophisticated understanding to operate, the people who use them are held in very low regard by the “real” hacker community, and are referred to by the derrogitory term “script kiddies.” That does not mean they can’t do some very real damage to your website.

The important point to understand is that these individuals are not targeting your website – you are just one of thousands. It is strictly a numbers game, and some day yours may come up.

In this next piece we will look at a common point of entry for hackers.