Well, with entirely file-based CMS you can easily put the whole directory into version control system to record any changes to the site. The synchronization with the server would be also trivial because it would only involve uploading the files via ftp.
With these benefits in mind, I am a little puzzled about the popularity of databases as the only storage mode, even when the CMS in question is meant to be used by amateurs for small websites.
How does your versioning and synchronization workflow looks like?
What kind of simplified versioning/synchronization workflow would you suggest for a casual, non-tech, WordPress user, to give them the benefit of working locally and encouraging them to have a backup of their site?
Most CMS systems nowadays tend to have some or other backup solution in place to help you. Since Wordpress is a CMS for the masses and also caters for the non-tech population, you're sure to find a plugin that can help you with this. I know it's built-in backup solution just backups posts etc. to XML, but even this does a pretty decent job of restoring over a clean wordpress installation and working fine.
But I found this plugin (which works for Wordpress and Joomla) by asking Google, which most probably is the answer to your question: XCloner
Also in terms of workflow, specifically for Wordpress, don't give the user Admin privileges, but editor or contributor or something, so they can still edit content, etc. but not make changes that could mess up the CMS itself. And maybe this XCloner plugin can do some kind of recurring backup or something. Otherwise, I suggest you move to a LAMP stack hosting environment where you can at least have cron jobs setup to backup your databse and files regularly. Most hosing companies do this in any case at no cost.
Wordpress also keeps revisions of all posts and pages, so if a user doesn't like an update they've made, the full revision history is available. Be sure to check screen options at the top to see that Revisions is checked, if you aren't seeing this option. Kind of a nice built-in.
Can also (depending on host) have scheduled database/file backups through cPanel, in addition to scheduled database backup plugins through WordPress. Some will save remotely or even email the database out.
Related
I'm researching to see if building a full website for a hotel be a good idea to do on WordPress.
I read that wordpress is okay but there are better options.
I want to design and code my own front end look to the website, but have the backend on a stable platform that can take all the reservations seamlessly.
My main concern is to be able to have a backup of all the files and easily switch to another server in case something goes wrong.
I can host the website on my server or host with the service you suggest that comes with the platform all together.
Any ideas and/or suggestions are greatly appreciated!
There are other options, no doubt, but yes, it can and is really possible to build it using WordPress as CMS.
If you want to design and code your own theme, you'll need to study the WordPress Theme Structure and, since you'll build it by yourself, you'll also need to develop plugins to create custom post types (aka CPT) to make the hotel management easier on the WP back-end.
About the theme structure, files, child themes and everything, I'd recommend you to read https://codex.wordpress.org/Theme_Development
About the plugins development: https://developer.wordpress.org/plugins/
About Custom Post Types: https://developer.wordpress.org/plugins/post-types/registering-custom-post-types/
About the backup: it's super easy and you can even make a full backup using free plugins via back-end. But if the site goes down you can easily do it via FTP downloading only wp-content folder and the database. It's really simple to migrate from one WordPress to another, or from host to host.
About the hosting, you'll need to use a server if you want to build this project. There's a difference between wordpress.com and wordpress.org
The .com is simpler, you are not able to build everything you want. The .org is the open source project, which you get the files, upload to your server and connect to database (MariaDB or MySQL). Most hosts offer automatic installation for WordPress and, from there, you can change whatever you want and need.
Note: many developers create CPTs INSIDE the theme's code, but this is not recommended by WP as you can see in We recommend that you put custom post types in a plugin rather than a theme. This ensures that user content remains portable even if they change their theme.
WP is not really hard, after 1 week studying you'll see yourself getting over most difficulties. Even if it takes longer, don't give up. There's a huge community to help you with WP questions.
Hope it helps and I'm sorry my bad writing, I'm not an english native speaker.
C ya
I want to set up a system where a developer can work on a separate server on a wordpress website.
My question is: If in the meantime changes are made to the live site (like plugin updates, new plugins, new posts, new comments, etc), how is one able to import a new feature (e.g. a new page) from the development server on the live site while making sure that previous changes on the live site don't get deleted?
I am looking to understand how this all works. In a sense, I would like to have some kind of version control system.
Thanks in advance :)
You can version control your own code using git. Basically we would init a new git repo and commit changes onto this repository. This can lie separately outside of the core files. i.e you only need to include the wp-content directory and ignore all the other core wordpress files.
Here is a good article on how to do a really good versioning system for a website.
http://toroid.org/git-website-howto
The posts and pages (basically content) in a wordpress site however lies in the database.Any changes made there will be permanent.
The only option is to keep taking regular backups of the content. You can do this by using an automated backup tool.
If you really want to version control your database, here is an article that helps:
https://blog.codinghorror.com/get-your-database-under-version-control/
This one is a tricky one. You cant host a single website on two servers. Just imagine a website having 2 hosted urls..!! No way.. You can never do that.
You better create a new user and give access to him. Look carefully in the settings and be a admin. You will have a chance to approve or reject what the second user changes.
Hope this helps.
I have made the case for using WordPress as a CMS for an important project.
IT has challenged me to build out this base WP installation alongside the local (WAMP) served intranet and lock it down the best I can. They will then attack the installation with enterprise level penetration testing software.
I am only privy to a minimum amount of details however some security tools I am up against have been mentioned and will be used in conjunction with enterprise level software:
Kali.org
Tools from darknet.org.uk
Watabo
What I've done:
Wiped all basic WP out-of-the-box data such as Administrator username, changed login page URL, removed ajax calls, leveraged all options within iThemes Security plugin (which is pretty impressive) and a few of my own.
My question is for advanced advice on securing WordPress running 2015 theme and its PHP framework and Database. Proper htaccess configuration and possible pitfalls. Advice on any advanced methods of securing a website where it's likely to fail a pen test.
It's not easy to make a website completely invulnerable, especially if you have chosen Wordpress.
You should update your Wordpress website constantly. It means that you have to follow all the updates and install them immediately. Sometimes it's not easy to do, if everything is working as it should, and the database is not small. Wordpress is the most popular open source CMS in the world and many people want to crack it, write crawlers which are searching vulnerabilities online etc.
Simple steps to increase the security of any website:
Close a port if you don't use it or install firewall, tcpwrapped etc.
Don't use FTP, ever. Use SSH instead.
Don't make rights 777 on the whole folder. Make it 555 and when you need to upload some image or something else change the rights to 777 or 755 (if you do it by ssh). After doing your job change rights back to 555. Nobody couldn't upload payload or other malicious code to your website through the front end if it's not allowed for writing.
Check your website for sql injection vulnerability.
Don't use simple passwords. You could even change your passwords every month.
Don't duplicate passwords.
Regularly update your software.
For back end security you could use some IDS, for example Snort - https://www.snort.org/, but it's not easy to configure properly. Furthermore you should understand how a network works, tcp/ip, attack types and so much more.
Use OpenBSD as your server operating system if you do not understand the information security well. It was created with an emphasis on increased security.
Take some network scanner (for example nmap) and test your server for vulnerabilities.
Finally: I wouldn't recommend to use Wordpress for the reliable security :) and to say more I need to take a look at the website.
My apologies in advance if I am posting it in the wrong forum.
I have a WordPress site. Every couple of days, a new user is added as an "Administrator" as shown below
I have changed my password many times using complex passwords but to no use. I even searched on Google and have read links like this one.
I have also unchecked the option "Anyone can register"
However, I am unable to stop them from registering.
Fortunately, no malicious activity has been noticed (Ex: Deletions/Unwanted posts etc)
Please advise me on what I can do to stop these?
You clearly have a more serious compromise, like an uploaded malicious script or an unpatched vulnerability. You need to rebuild your site from scratch (clean install of the current versions of WP and any plugins and themes, using a known-good database export) ASAP before something really bad happens.
Unfortunately, it's impossible to say what happened without digging through your server. My guess is that somebody exploited a vulnerability and uploaded a script. It could be anything - an hole in the WP core, a plugin, or a theme; a malicious plugin or theme; a stolen password; a breach of another site on the same server; or a number of other things.
Regardless of what happened, the only safe fix is to rebuild the site. If you have data backups, you can achieve this in a few hours.
I strongly recommend installing the security plugin WordFence to help prevent similar problems in the future. (I have no affiliation with WordFence, but use it on a number of sites.)
Finally, you might want to read this discussion on security.stackexchange.com. The consensus in this situation is "nuke it from orbit." Good luck!
Someone is making a SQL injection in your site.
If you want to prevent this in future, you should do some things.
Rebuild your website from scratch.
Install some of the security plugins, like Bulletproof Security, Wordfence, iThemes Security. I suggest you to buy the license of Bulletproof, or use the free version + one of the others. And be careful for the equal settings.
The most common attack are with SQL Injection XSS, Plugin exploits and of course brute-forcing the admin pass. You should upgrade every plugin and Wordpress every time when you see a new version.
Use less plugins. They are one of the main reason for hacked websites. If you use Linux, Ican tell you how to scan your website for vulnerabilities. Or just tell me the url, and I will tell you the results.
Also change your /wp-admin path, there are a lot of bots who search the web and make bruteforce attacks.
Also is important to use different admin username from admin or Admin. And use strong passwords. It's a good practice when you make a new Wordpress installation, to do two more users. The first will be an Author and will post everything in the site, the second you should make with Administration role. After that delete the first admin user and start the new one.
Hackers knows that almost every time the user with id:1 is the admin, so they can try to access again. So in this case your admin will be with id:3, and again don't use username like admin and etc.
Best regards and wish you luck.
Kasmetski
Check index.php, wp-admin/index.php to see if they have been modified. Usually the following line of code is added to the top of the index.php file. A code starting with 'required' is usually added.
The file being ‘required’/’included’ here contains malicious code which is executed along with each run of WordPress. Such code can generate fake pharma pages, Japanese SEO spam pages and other malware infections.
Delete the #require code from the file after comparing it with the contents of the core WP files from it’s GitHub repository.
Check if there are any new files in the root of the server or /wp-admin folder that were not created by you. Some of the files that you may find are:
Marvins.php
db_.php
8c18ee
83965
admin.php
buddy.zip
dm.php
If you find any of the above suspicious files, take a backup and delete them.
Source: https://www.getastra.com/blog/911/fix-wordpress-admin-dashboard-wp-admin-hack/
Not sure if this is the right place to ask, sorry if its not. I build a lot of Wordpress sites. My problem is, the number of them is getting big and harder to update them all when new releases come out.
I have written an app that will download the latest Wordpress release, and manually ftp the new files to all the clients, but this takes forever... need a new way.
I wanted to restructure this while I can or start a new process at least. Whats the best way to manage multiple Wordpress sites and keep them all updated? Some people have said 1 DB and modded config, others I have seen said to keep all installs separate and use plugins to automatically upgrade, but I don't know whats best to do. Ideas? Thanks :)
If these were all sites you managed on your own server, I'd recommend using a Multisite installation rather than separate instances of WordPress. This way you only have one set of themes, one set of plug-ins, and one copy of WordPress to maintain.
If these sites are on different servers (i.e. you're maintaining sites for clients remotely), I'd recommend you look in to a beta account with WP Remote. This is a service specifically built to allow you to remotely monitor and update multiple WordPress installations. It might be the best solution for you because it allows you to use the one-click update rather than manually downloading/FTP-ing the new files.
You can use this free self hosted app http://infinitewp.com
No limitation in number of sites being managed. You can update WP/plugin/themes, do backups, one click login to your WordPress admin panel.
EAMann is right, especially with the new Multi Site features in Wordpress 3.0, there is no better way to manage multiple sites under one umbrella. Being a developer myself, I know the pain of having to login to all those different accounts!
The way to set it up is create a "master domain name" that you will log into. Place this in your WP Config:
define('WP_ALLOW_MULTISITE', true);
Then login to your admin panel, navigate to TOOLS>Network.
After you've set everything up, copy/paste what it tells you to your HTAccess and WP Config file.
The next step, especially if you are putting clients on this network, is they will want their own domain name, not AIBot.com/theirname right? Thats where Domain Mapping comes in:
http://ottopress.com/2010/wordpress-3-0-multisite-domain-mapping-tutorial/
Check that out and good luck!
What you need is www.managewp.com it can do all of that for you plus a ton of other excellent features.