At its core, WordPress consists of a set of PHP files and a MySQL database along with some image files. Moving your WordPress website to a new host essentially involves copying those components and plopping them down on your new host.

That sounds simple enough.

But there are some things that can make the process tricky. For instance, hosting configurations (including things like which PHP version your host has implemented, file system permissions, SSL certificates, and other things that are host specific) can affect how your website behaves when it’s moved to its new home. You’ll want to be sure that you’ve considered all of those elements of migrating your website.

If your WordPress instance is a simple, straight forward website (plugins all updated, nothing custom, etc.), then moving it to a new host is usually an easy process. However, if you have done a lot of custom work on your WordPress website, you may need some help from more experienced web hosting experts.

Manually Moving Your WordPress Site to a New Host

Manually moving your WordPress website to your new host is the most technically involved of the methods that I’m going to discuss.

To manually move your WordPress site, you’ll follow these steps:

• Make a compressed (using the zip or tar function) backup of all of the files that comprise your WordPress site. On a new WordPress install, this would be all the files under the wordpress folder.
• Make a backup of the MySQL database you’re using for your WordPress website. You can do this by using a tool such as PHPMyAdmin, which the most popular hosting providers support.
• Copy your compressed WordPress files to your new hosting setup by moving the compressed file to the file system of your new host and decompressing it. Make sure the file structure is set up the same way as it was on the previous host, including that the root WordPress folder is in the web root directory of your new web host.
• Set up a new database that mirrors what you had on the previous host. Once the database is created, you’ll then dump the SQL file you created into the new database instance you create in your new hosting environment.

Because of how different hosting environments are, it’s likely you will need to do some checking and likely a bit of troubleshooting to tweak hosting settings so that your website looks and acts like it did on your old host.

Using a WordPress Migration Plugin

There are several WordPress migration plugins that can be used to bundle up your WordPress instance on your existing host, then move it to your new host without having to deal with so much of the technical issues as you do when you’re manually moving your WordPress site to a new host.

The one that I’ve used most often and that is the most popular for people who want to move a WordPress site to a new host is called All-in-One WP Migration. Using this plugin, you can create a backup of your entire site into a file that is type .wpress.

On your new web host, you’ll go ahead and install a basic WordPress instance, from which you’ll install the All-in-One WP Migration plugin. Once you’ve installed the All-in-One WP Migration plugin on your new host, you can import the .wpress file that you created from your old host.

I’ve had a lot of success using this plugin. However, with larger websites, the .wpress file you create is so large that you may run into issues (e.g. network timeouts, shortage of disk space) downloading it from your existing host or uploading it to the new host.

Having Your New Web Host Move Your WordPress Site

Some web hosting companies offer a service in which they will move your WordPress website over to their hosting service. Web hosting companies are eager to get your business, which means that many of them have dedicated technical resources to ensure that you get moved over to hosting with one of their plans as smoothly as possible.

I recently moved several of my ecommerce stores from LiquidWeb to Pressable, which is one of the web hosts recommended by WooCommerce. Pressable has a specific plugin they have created that allows you to simply connect your old website to a new staging instance you create inside of your Pressable hosting dashboard. The video below is a quick walk-through of how Pressable’s plugin works.

If you run into snags, the Pressable customer support team can take over and do the migration or help you with your use of their plugin.

The post How to Move a WordPress Website To a New Host appeared first on TheTechnologyVault.com.

With Pressable, you get solid web hosting and stellar support, but Pressable doesn’t (currently) have built-in email support like you find with web hosts that use cPanel or one of the other hosting packages that include email together with web hosting. Instead, Pressable has a partnership with a business email service provider called Titan.

While setting up my Titan email for my OnlineSafetyDepot.com service and personal email accounts, I ran into an issue. I tried sending a test email from an account that I have associated with another business of mine (CustomVinylDecor.com) to my new OnlineSafetyDepot.com email hosted on Titan’s email system. The email didn’t go through after several minutes. I wondered if it was likely that the MX records weren’t set up correctly to point my email accounts to Titan’s email servers.

Then I remembered that when you purchase a Titan email account through Pressable, the MX setup is done for you (through internal DNS zones that are handled between Pressable and Titan) if your domain is pointed to Pressable’s DNS servers. In fact, when you’re purchasing a Titan email account, this message is shown during the checkout process.

We will automatically setup your MX records so that Pressable becomes your email provider. You will need to perform this process manually if your domain is managed outside Pressable.

So, MX records couldn’t be the issue.

I tried to send emails from my new email account to the address I was sending from. All of those emails went through just fine. So it had to be an issue between the email address (which is hosted on Gmail) I was sending from and my new OnlineSafetyDepot.com addresses.

I waited a day to see if there were propagation delays that I needed to wait on, and I sent another test email.

The response from the remote server was:

550 5.7.1 <redacted@onlinesafetydepot.com>: Recipient address rejected: Message rejected due to: SPF fail – not authorized. Please see http://www.open-spf.org/Why?s=mfrom;id=redacted@customvinyldecor.com;ip=209.85.214.176;r=redacted@onlinesafetydepot.com;helo=mail-pl1-f176.google.com;

My next troubleshooting step was to send emails from other gmail accounts and some non-gmail accounts I own. All of those went through.

In this strange situation, I had apparently found a configuration where one specific email address couldn’t make its way through to my new email addresses.

I talked with Pressable support about it through chat. They didn’t know what could be causing the issue, so they hooked up with the Titan email support. This is what they said.

Titan Mail support passed this along to us:

“I just checked the logs and the error is “Recipient address rejected reject Message rejected due to: SPF fail – not authorized. Please see http://www.open-spf.org/Why?s=mfrom;id=richard@customvinyldecor.com;ip=209.85.210.182;r=service@onlinesafetydepot.com;helo=mail-pf1-f182.google.com;”

This basically means that the IP address <209.85.210.182> is not included in the sender domain’s SPF records.

The sender domain in this case is <customvinyldecor.com>.

Because of this, our servers are viewing the email to be coming from an invalid source and thus rejecting them.

Kindly request the sender to include the IP address we mentioned in their domain’s SPF records. Once done, their emails should be reaching the user’s inbox without any issues.”

It looks like the issue may actually be with the customvinyldecor.com domain and email setup, and adding the IP address mentioned above should resolve the sending issue to allow the email from the redacted@customvinyldecor.com account to go through.

Looks like that one is a BigCommerce site using Google Mail, so I’d recommend contacting Google Mail’s support for help on this, as they should be able to help resolve the issue.

I’ve never seen such a strange issue as this, but fortunately Titan and Pressable were able to work together to get it figured out.

If you are having a similar issue, I hope this context and solution help you get your problem resolved.

The post How to Fix SMTP 550 5.7.1 Error appeared first on TheTechnologyVault.com.

Pricing: Free

The majority of Google Analytics users install and use the free version of the tool, which handles most or all of what’s required by typical small and medium-sized organizations.

Google Analytics 360

Google also offers a paid, enterprise version of its analytics tool. The paid version is called Google Analytics 360. Google Analytics 360 is for much larger businesses that need upgrades beyond the free Google Analytics tool, including these advantages:

• Higher traffic threshold: 1 billion+ hits per month (at the first GA 360 tier) versus up to 10 million hits per month with the free version
• Fresher data: Google Analytics 360 data is refreshed every 10 minutes to 4 hours versus the 24+ hours used for the standard, free version of Google Analytics

Large organizations that make extensive use of Google Analytics and find themselves limited by the free version are encouraged to consider upgrading to a 360 paid version that fits their needs.

Google Analytics (often referred to as GA in the context of web analytics) is a web analytics tool created by Google to provide reporting on web traffic for a website. Google Analtyics is installed on a website by inserting a

Google Analytics has been around since November, 2005. It was one of the first comprehensive web analytics tools, built to allow website owners to view realtime traffic data along with dynamic, multi-dimensional traffic statistics that make it possible to take actionable steps in response to traffic behavior and patterns. Google launched Google Analytics after acquiring a web analytics company

The video below, Google Analytics Ultimate Beginner’s Guide, will give you a very comprehensive overview of the features of Google Analytics. Although these features change on a continual basis, the standard core features of Google Analytics (the ones used by the majority of webmasters) have been consistent.

Google Analytics Features

The standard, free version of the Google Anaytics tool provides users with five main categories of tools, each of which represent a particular way of looking at those who are visiting your website.

Realtime

The Realtime section of Google Analytics shows you who is on your website currently. Clicking on the overview link within the realtime section will show you who is currently on your website using a world map. The overview also tells you what pages the users are on, which users are using a mobile device versus a desktop, and summary data for the referral sources, showing where the visitors came from.

Audience

The Audience section of Google Analytics shows you historical data, for the time period you select, describing who visited your website. In the overview section of the Audience report, you can see the total number of users for a period of time, how many pageviews those users performed, the bounce rate (who came and left without browsing your website) and other summary data.

In the Audience category of Google Analytics, there are many other customized views of your audience, including their location (Geo), whether they are new or returning, what types of devices they are using, and other user-focused segments.

Acquisition

The Acquisition section of Google Analytics allows marketers to understand what sources brought visitors to the website. Acquisition sources include:

• Organic search: people clicking on a non-paid search result to be directed to your website
• Direct: people who have bookmarked your page in their browsers or who have configured their browsers to not allow specific referral information to be sent
• Referral: visitors who come from other websites
• Social: visitors from Facebook, Twitter, and other social media websites

Behavior

The Behavior section of Google Analytics allows webmasters and marketers to see how visitors to their website are interacting with specific pages, including the flow between pages. This feature is important for helping with conversion and understanding where site visitors are losing interest, troubleshooting pages that are having issues, and for generally understanding how those who have come to the site are interacting with its specific pages.

Conversions

The Conversions section of Google Analytics gives website owners the ability to target specific objectives for visitors to their websites.

Using the Conversions features, Google Analytics users can set up goals and measure how well their pages accomplish those goals, such as doing things like subscribing to a newsletter, scrolling through an entire page, and other evidences that web pages are accomplishing their intended purposes as expected.

Installing Google Analytics

Installing Google Analytics is fairly simple for most websites. It involves placing the Google Analtyics tracking code on each page of the website for which a website owner wants to track visitors. Most website owners install the tracking code on every public page of the site (usually there is no reason to have web tracking in the admin or backend part of the site) so that they can track as much behavior as possible.

To install Google Analytics, you’ll first need to set up a Google Account. A gmail or other type of Google Account can be used for this purpose. You can also set up a Google Account in the process of getting starting with Google Analytics.

Once you’ve got a Google Account set up, you can go to Google Analytics, fill out the information they require (website name and other info), and then get the tracking code to input into your website header or footer.

Once you’ve inserted the Google Analtyics tracking code into each page of your website that you want to track, it’s a good idea to check that the tracking code is working, sending data to Google Analytics that you can see through your Google Analytics dashboard.

Google Analytics with WordPress

WordPress is the most popular content management software available. There are dozens of WordPress plugins that can be used to install Google Analytics on a WordPress website. The most popular of the Google Analytics plugins is Monster Insights.

If you install Monster Insights after setting up your WordPress website, you can go through their setup wizard, including entering your Google Analytics tracking id, fairly easily.

The post Google Analytics appeared first on TheTechnologyVault.com.

For anyone involved in publishing content online, understanding what WordPress is and how it works is highly beneficial.

WordPress is used by 64.2% of all the websites whose content management system we know. This is 43.0% of all websites.

W3Techs.com: Usage share and market share of WordPress

What is WordPress?

WordPress consists of PHP files (with extensions that end in .php), along with some other supporting files. Here is a list of the types of files included with the WordPress software package:

• PHP Files (.php extension): This is the core WordPress functionality.
• Stylesheets (.css extension): These are cascading style sheets, which are used to provide styling information for HTML pages.
• JavaScript (.js extension): JavaScript allows WordPress sites to have dynamic interaction inside a user’s browser.
• Fonts (.woff2 extension): These are font files in the Web Open Font Format. WordPress includes some default fonts with the core download.
• Images (.png extension): WordPress uses several images with its default themes as well as for using graphics on some of its default pages.
• Data structure definitions (.json extension): These files include code block definitions for efficient use of the core code.

WordPress is open-source software, meaning that it’s not owned by a for-profit company that’s using it to make money while keeping proprietary source code hidden. Instead, the WordPress code is owned by the WordPress Foundation, a non-profit that was set up to manage the development of the WordPress project.

Contributing to WordPress

Anyone who is interested in helping with the project can contribute to the development of WordPress. WordPress is kept in a repository called Subversion, which you can browse on the Make WordPress Core section of WordPress.

There are other ways to contribute to WordPress besides writing PHP code. WordPress actively solicits help from people who are interested in helping with anything from design to documentation to translation WordPress into other languages.

Downloading and Installing WordPress

Automated WordPress Installation by a Web Host

In years past, installing WordPress required a user to download the WordPress software files, upload them to a web server, set up a database to use with WordPress, and run the install manually, as described below. Because of how popular WordPress has become, going through this process manually is not necessary, as many web hosts have dedicated resources to make it easier for their customers to use WordPress.

To make WordPress more accessible to the average, non-technical person needing a website up and going quickly, many hosts have one-click WordPress installs. Many web hosts have also created specific WordPress hosting packages that can be purchased, where a WordPress system (often available with the choice of a few professional-looking themes ready to go) is built-in to the hosting platform.

The WordPress installation files can be downloaded directly from the WordPress download page. The WordPress installation file comes packaged in a .zip file that is around 20MB in size. You also have the option to download the WordPress installation files in a compressed .tar.gz file that takes up about 18MB.

Once you’ve downloaded the WordPress files, you’ll need to upload them to your web host using a file manager application. Then you’ll unpack the WordPress files on your host.

Setting up a Database (MySQL) for WordPress

You’ll need to create a database (most often MySQL is used) for your WordPress instance to use, and give your WordPress instance access rights to the database. This is often done using PHPMyAdmin, which is much easier to use than having to remember the MySQL commands for creating a database, setting up a new user with a password, and giving that user access rights to the database.

Running the WordPress Install

After you’ve unpacked the WordPress files and put them in the directory on your web host where you want them, and after you’ve got a database setup that WordPress can login to and use, you’re ready to run the installation, which is straight forward.

Setting the WordPress Root Directory

By default, the WordPress files are kept in a directory named wordpress. Most people move the WordPress files into their root directory so that their WordPress website is served from the root folder on their host (for example, https://mywebsite.com/ versus https://mywebsite.com/wordpress/)

Uses for WordPress

WordPress has many different uses. The initial purpose of WordPress was to create a blogging platform back in the early 2000’s when blogging was just becoming popular and people were looking for dynamic ways to publish web pages. WordPress was originally used to publish blog posts in a chronological order, with features for having people subscribe to your blog.

WordPress has carefully and intentionally evolved to be a popular content management system for creating almost any kind of website, including:

• personal blogs
• informational websites with blogging components
• small business websites with just a few pages
• online retail stores (using the WooCommerce plugin) for small and large businesses
• enterprise content management systems

WordPress Themes

Something that makes WordPress attractive is the flexibility that exists with the design of a blog, website, store, or whatever it is that you’re intending to use WordPress for. There are nearly 5,000 different themes to choose from in the WordPress theme catalog. Installing a theme can be done quickly and easily within the WordPress admin.

Also, WordPress enforces a standard for developing a theme and having it published and available for installation via the WordPress theme interface. This makes it so that each of the themes available has a core set of similar functionality and common configuration options. Switching between themes or altering a theme to better suit a user’s needs is predictable and not difficult to learn.

Because of how ubiquitous WordPress is, there are thousands of potential contractors who can help WordPress users set up a theme and modify it to their liking. Hiring one of these WordPress design contractors usually involves going to a freelancer website such as UpWork or Fiverr and choosing from the many experts who advertise themselves for hire there.

WordPress Plugins

WordPress’ plugin catalog offers powerful add-on tools so that WordPress can be adapted to whatever is needed. For instance, using WooCommerce (one of WordPress’ most popular plugins), you can turn your WordPress system into an online retail store. If you have a publishing site and want to have paywall content (pages and information that can only be accessed by people who have paid subscriptions), you can set that up using one of several different plugins in the WordPress directory that are designed specifically for that.

There are over 50,000 WordPress plugins that can be installed directly from the WordPress Plugins page inside the admin section of the CMS. These plugins include everything from mortgage calculators to contact forms to performance tools that help a WordPress website run more efficiently.

In addition to the 50,000+ plugins that currently exist in the WordPress automatic install directory, it is not hard to create a new plugin to serve a particular purpose. The popularity of WordPress as a publishing platform has created a large need for WordPress plugin developers, so if you can’t find what you need out of the box in the WordPress plugin directory, you can always hire someone to build a plugin that has what you need.

Most Popular WordPress Plugins

To give you an idea of what you can do with WordPress plugins, I’m going to introduce you to some of the most popular WordPress plugins. Each of these plugins has been installed by millions of users. Their popularity is a clear indicator of how useful they are.

Contact Form 7: A simple, flexible contact form

Yoast SEO: A powerful tool for optimizing content for search engines

Elementor Website Builder: A drag and drop page builder

Akismet Spam Protection: A spam blocker for comments on blog posts and contact forms.

WordFence Security: A firewall and malware scanner

MonsterInsights: An automated integration with Google Analytics

Learning WordPress

As with any type of content management system, WordPress takes some time and effort to become fluent enough to make the most effective use of it. Most people who use WordPress don’t have to understand how to write code in PHP or understand the technical details of how things work. However, depending upon your role (if you’re just writing and publishing without regard for what else is happening inside your organization’s WordPress CMS, you likely don’t need much of any training), spending 10-40 hours ensuring that you understand how to publish posts and pages, how to add and use new plugins, how to install and set up themes, and developing a few other useful basic and intermediate WordPress skills.

There are plenty of WordPress courses available from the popular online course platforms, including:

• Skillshare
• Udacity
• Udemy
• LinkedIn Learning

Alternatives to WordPress

While WordPress is hands down the most popular content management system on the internet, there are some popular alternatives that you can use if you decide there is something about WordPress that makes you want to keep shopping for something else. Depending upon what you intend to do with online publishing, the size of your organization, and other specific needs, here are some alternative platforms for publishing content online.

BlogSpot: This is one of the original blogging platforms. Google purchased BlogSpot several years ago and has made improvements to it over the years. BlogSpot is free (both the hosting and the blogging platform) and very popular for casual and serious bloggers.

HubSpot: HubSpot is a marketing platform. They have a robust CMS that they offer for companies and individuals who want to integrate calls-to-action into their published content.

Joomla: Joomla is comparable to WordPress. It can be downloaded and installed on your own web host. Although not as popular as WordPress, there are lots of hosts who have 1-click Joomla installs available.

Drupal: Drupal is yet another flavor of content management. Deciding between Joomla and Drupal as alternatives to WordPress is mostly a matter of preference.

Ghost: Ghost is popular among developers and other technical types for publishing content. Publishing with Ghost involves learning how to us the Markdown syntax as opposed to a standard text editor like WordPress.

Magento: Magento is normally used by larger companies and enterprises because of how complicated it is to set up and manage. Similar to WordPress, Magento has a streamlined shopping cart system that sits alongside its publishing tools.

The post WordPress Content Management System appeared first on TheTechnologyVault.com.

It’s no secret that WordPress is a good choice for building websites, even more complicated ones. Those who use have used it know how easy it is to use and how powerful it can be, especially with all of the plugins already available. Plus, there are thousands of WordPress developers out there who charge reasonable rates to build whatever gadget plugin you might be looking for.

So we’ve established that WordPress is a great tool to host a website, but where should you host your WordPress website?

For those who are not so experienced with websites and hosting, WordPress is an open source set of files (software) that can be downloaded free for use as a content management system. However, in order to make use of WordPress, you have to set it up on a web host so that the world can access it. That's what I'll be discussing in this article.

There are nearly limitless options for hosting your WordPress website. There are thousands of web hosting companies who meet the minimum requirements for being capable of hosting a WordPress website. Those minimum requirements are:

• PHP: support for a recent version of PHP
• MySQL: support a recent version of MySQL
• HTTPS, the secure version of the hypertext transfer protocol

Because they want to stay relevant to the demand for WordPress and other PHP/MySQL-based hosting applications, most web hosting companies provide these minimum requirements for hosting a WordPress installation. However, there’s always a possibility that a web host doesn’t meet those requirements, so it’s a good idea to check if you’re unsure.

WordPress Web Hosting Recommendations

WordPress recommends these three web hosts: Bluehost, DreamHost, and SiteGround

The goal of the WordPress founders and the current WordPress community is to make it as easy and affordable as possible to successfully create and manage a WordPress-based website. WordPress’ choice of these three web hosts represents their commitment “to helping create a wholesome and hassle-free WordPress hosting environment.”

WordPress reviews its recommended hosts list on a regular basis, several times each year, and updates the list if that is warranted. The hosting world tends to evolve, so it makes sense that WordPress would keep tabs on which hosts are best suited, based on their own research and feedback from their community, to be recommended officially by the WordPress team.

WordPress also monitors its recommended hosts, even setting up an email address for reporting issues with one of its recommended hosts. hosting-feedback@wordpress.org

Considering that web hosting situations tend to be fluid, this list may change. However, these

Criteria for Being a Recommended WordPress Host

WordPress takes into consideration several factors to decide who it will recommend as web hosts. Here are some of those factors:

• Does the web host contribute to WordPress.org?
• What is the size of the web host’s customer base?
• Does the host have an easy-to-use- WordPress auto-install feature?
• Does the host support WordPress auto-upgrades?
• Has the web host had any Gnu Public License (GPL) violations?
• Are the web host’s marketing and social perception (design, tone, historical perception) consistent with WordPress and its reputation?
• Does the web host use WordPress branding correctly (correct logo, WordPress capitalization)
• Does the host take ownership of technical issues such as security issues, or does it tend to blame WordPress?
• Is the host’s system software kept up-to-date?

Bluehost

Visit the Bluehost web hosting profile.

Bluehost hosts over 2 million websites. The Bluehost platform is built specifically to host WordPress websites, including providing dashboards, tools, and support for WordPress-based websites.

DreamHost

Visit our DreamHost web hosting profile.

DreamHost has been a contributor to the WordPress community for over a decade. They have various WordPress-centric offerings that are targeted to small, medium, and larger businesses and individuals.

Siteground

Visit the SiteGround web hosting profile.

SiteGround has many WordPress tailored offerings, including 1-click installs. Their hosting features are designed to make WordPress run efficiently. They also have assertive technology in place to prevent hacking WordPress websites they host.

The post Which Web Hosts Does WordPress Recommend? appeared first on TheTechnologyVault.com.

I have a feeling that if you’re here, you either strongly agree or disagree with the title of this article. That’s fine. This is an opinion piece, so feel free to feel however you’d like. But I have data to back me up! According to the 2017 Stack Overflow Developer Survey, 64.5% of respondents said they dread WordPress. It’s the 3rd most dreaded platforms of those they included in their survey.

I want to talk about why developers – the people who are knee-deep in the code; who could and would rather build a custom solution; those who are expected to make it work and work well – hate WordPress. This list is by no means exhaustive, but represents common pain-points I’ve found from my own personal experience and experiences others have shared with me.

First, the Redeeming Qualities

Before getting into the pain-points, I feel I have to mention the things WordPress does well.

To start, it’s dead simple to install and setup. With a basic Apache/MySQL/PHP stack in place, you can be up and running in a matter of minutes.

WordPress is really easy to customize. The catalog of themes and plugins is massive and continues to grow. Building your own theme is really simple. Building a custom plugin isn’t as simple, but simple nonetheless.

And the main reason I think WordPress has become the go-to platform for so many people – the low barrier-to-entry for non-technical users. Once it’s up and running, just about anybody can manage and publish content with WordPress.

Getting Down to the Brass Tacks

But WordPress falls short in a lot of ways. While this may come off as a rant, it’s meant as constructive criticism and I hope the WordPress team and community take it as such. These are the reasons why I, and other developers, hate WordPress.

Jack of All Trades, Master of None

WordPress started out as just a simple blogging platform – an easy way to publish content. But over the years, it has evolved into a chameleon of sorts. I’ve seen it used as a simple site management system, an ecommerce platform, a static site generator (yeah, I find this one really odd), a sales management system, a lead aggregator, a used-car inventory system, and a slough of other things.

One could argue this just illustrates just how flexible WordPress is – and I would agree – but when you try to do everything, it’s hard to do anything 100%. The vast array of available plugins is evidence of people trying to shoehorn WordPress into something they need.

At its core, WordPress caters to this plug-n-play approach. Don’t get me wrong, flexibility is good, but I feel like WordPress lost its focus a long time ago and without it, has been trying to find its way. Rather than focusing on being a great blogging platform, they’ve tried to be a great everything platform. A lofty goal, no doubt, that has unfortunately led to many shortcomings.

To their credit, WordPress still works really well as a basic blogging platform.

Security

This is by far the number one complaint I’ve heard from developers. WordPress hacks are a daily, if not hourly, if not an every-minute occurrence. The common sentiment is that WordPress is swiss-cheese when it comes to security. That may be an exaggeration, but still, it’s a problem.

The problem largely stems from just how widely-used and well-known WordPress is and the fact that it’s open-source. Anybody can download and view the source code. This is definitely not meant as a slight on open-source projects. I’m a big open-source proponent and give props to WordPress for being open-source, but it makes finding vulnerabilities really easy.

According to w3techs.com, WordPress currently accounts for 27.7% of all sites on the internet. 27.7%!! I know the WordPress team works day and night to make sure things are secure, and they do a really good job. But due to the nature of rapid development cycles, things get through. And when they do, it puts a lot of potentially sensitive information at risk.

There’s no real simple, systemic solution to this problem other than to “keep WordPress up to date”, but WordPress’ rapid release cycle leads to other problems (more on that later).

There are those out there that will say “Do these simple things to secure your WordPress site…” They’re right. They are simple. But why should I have to do them? Why aren’t they just built into the core?

These are some of the things I’ve personally dealt with:

• Restrict the upload of executable files by default. All a script-kiddie has to do is get WordPress to upload a malicious PHP file and BAM, your site is hacked. In my experience, this has been the most common attack plane used.
• Keep configurable options out of the filesystem and assume the file-system is read-only. The WordPress core does this pretty well, but plugins don’t. If a plugin modifies a config file in production, don’t use it. This requires a writable filesystem, and if the filesystem is writable, then malicious changes those files can be made without much effort.
• Limit login attempts by default to mitigate brute-force attacks.

Just to name a few. You can’t expect an open-source project as large as WordPress to be completely impervious to attack, but that’s exactly my point. That’s a reason developers are so weary of it. They’d rather build something from scratch, specific to their needs, that they can lock down without the fear of new vulnerabilities being introduced with the next update.

Plugins, Plugins, Plugins

“Hey, there’s a plugin for that!”

This is not the first thing a developer thinks when solving a problem. It goes against the typical developer mindset – architect a simple, elegant, custom-built solution. Turning to plugins for functionality requires a significant shift in thinking.

Ultimately, plugins do provide a way to quickly extend WordPress with specific functionality. One could definitely argue that WordPress’ plugin ecosystem is a strength, but it’s a double-edged sword. With the ease and speed plugins provide comes the potential for security vulnerabilities, version constraints, and bloat.

Security Vulnerabilities

According to a recent report by wpscan.org, 52% of known WordPress vulnerabilities come from plugins. As a developer, you’re beholden to the coding practices, good or bad, of the plugin maintainer. If security is a cause for concern, which it should be for any developer, the process of introducing a new plugin requires vetting. If done thoroughly, this can negate the time-saving benefit plugins provide.

Version Constraints

WordPress’ release cycle can at times be… aggressive. It’s not rare to see multiple patches and/or minor version bumps in a single month. This is completely expected as the WordPress team is constantly finding and mitigating attack planes in the WordPress core. But it’s incredibly frustrating how often these updates break plugins – ‘splosions everywhere.

It’s incredibly important to keep WordPress up to date, but this can come at the cost of a broken site due to plugin version constraints. There is an “upper echelon” of plugin maintainers that are constantly testing and updating their plugins against the latest WordPress release candidates, but the vast majority of plugins do not and when WordPress releases an update, cross your fingers it doesn’t bork your site.

Bloat

I think I’m safe in assuming that the majority of developers like to keep projects lean and clean. While some plugins conform to this paradigm, so many are built to solve “all the things.” There’s usually one problem a developer needs solved and a plugin will solve it… and fifty other problems that aren’t problems.

Obtrusive User Experience

Somewhat related to the issue of bloat is how obtrusive some plugins can be to the WordPress workflow. I’ve been forced to use plugins that completely change how posts are built and published. And I know I’m not the only one who has run into this.

A common complaint I’ve heard is that developers, and even site maintainers, end up working around plugins rather than with them. You’re probably asking, “Then why use that plugin?” Well, because it solves that one problem.

But enough about plugins…

Built for Outdated Web Architectures

WordPress is built with the assumption that a site will run on a single server with a single filesystem. More and more developers are moving towards a modern, micro-service, multi-node architecture because of the flexibility and scalability it provides. Getting WordPress to work in this type of architecture can be tricky for one reason – its deep reliance on FTP for updates.

Updating live code through FTP feels dirty and archaic these days. In an effort to find and resolve issues before code goes live, developers have adopted a workflow that typically involves local development, version controlled code, automated testing, and continuous integration. Uploading code directly into a running environment skirts all of this, leaving plenty of room for things to go wrong.

But a bigger issue is the assumption of a single-node/single-filesystem. Multi-node web clusters provide increased throughput and hardware failover. Hence the shift towards this approach. But if you install a plugin/theme or update WordPress through FTP, it can only apply the change to a single filesystem at a time. If you’re running on a multi-node web cluster, you have to run the update on each and every node separately.

Yes, there are ways around this, but it’s still a pain-point for developers. This also requires a writable filesystem in your live environment which I’ve already touched on as a significant security concern.

PHP WITH NANOBOX

Data Structure & Orphaned Data

This is actually something I’ve dealt with recently. Starting out, the WordPress data structure seems pretty simple. But as you start to work with it, you start to see… quirks. For example, do you really need wp_posts and wp_postsmeta tables or wp_comments and wp_commentsmeta tables? Can’t meta information be included in the base table?

It might seem minor, but this structure makes it really easy to leave crufty, orphaned data all over the database. To mitigate this, WordPress has provided a collection of helper functions to aid in manipulating data. But when you have to manipulate thousands of rows, these functions simply don’t work. They run into PHP timeouts and memory issues and… they just don’t work.

Editing the data directly through SQL queries is easy enough and works great, but to avoid orphaned data everywhere, you have to completely understand the interconnected relationships between tables and write queries to match. This is true for any database, but so much of the data separation in WordPress’ database seems unnecessary.

In Closing

I just want to be clear that WordPress is not a bad platform. It’s provides a simple-to-setup, easy-to-use solution for publishing content. But if you’ve come across a developer who’s been hesitant to use it, these are just a few reasons why.

The post Why Developers Hate WordPress appeared first on TheTechnologyVault.com.