If you own many websites, chances are that you’ve had one or several of them compromised at some point and that’s never a pleasant experience.

In this post, we’ll take a look at the exact steps you can take to secure your WordPress websites, as quickly and easily as possible.

Risks

If you’ve been lucky enough to never have had any security issues with your website, you might be wondering: “how likely is it that I’ll get hacked?”

Especially if you have smaller sites, it may seem like they wouldn’t make interesting enough targets for hackers, so you  don’t really have anything to worry about, right? Wrong, unfortunately. My first ever site that got hacked was on a simple little blog that hadn’t been around for more than a few months and that barely got 40 visitors a day. Not a prominent target by any means.

The first thing you need to understand is that there doesn’t have to be any reason for an attack. You don’t have to have made enemies in hacker-circles, you don’t have to have a big, popular or controversial website. An attack can happen out of the blue, for the simple reason that your site is easy to hack. And that’s the number one rule: the easier it is to hack your site, the more likely it is to happen.

In this post, we’ll look at the two most important factors for securing your WordPress site:

1. Backing it up, so that it can easily be restored, in case it does compromised.
2. Adding security measures to make it more difficult to hack and therefore less likely to be attacked.

A WordPress site consists of two main components: the database, which stores all your written content and settings and the files on your server, containing all of your images, plugins, themes etc.

Database Backup

Install the WP-DBmanager plugin, which you can set to automatically create backups of your database at specific intervals and email them to you or store them on your server. In addition, you can also use this plugin to restore your database from a backup file.

Here’s a video showing how to use the installation, setup and restoration features in WP-DBmanger:

Files Backup

The easiest backup solutions are those that come with your hosting provider, but depending on your provider they might not offer all the features you'd want. Our recommended hosting provider for getting started is Hostgator. Hostgator provide a weekly automatic backup on all their shared hosting accounts, as long as you have fewer than 100,000 files stored on the server and less than 20GB of space used.

If you install multiple WordPress websites on one account, it's likely that you'll exceed the file limit at some point. You'll see something like the following in the sidebar of your cPanel dashboard, when this happens:

When you are below the thresholds for files and disk-usage, you'll always have a backup available, but it can be up to a week old and there's only ever one backup stored. It's a good solution, but it's not perfect.

You can manually create backups by going to the backup wizard in your cPanel. This will create a file for you to download, in a few easy steps. You can also use this same wizard to restore your files from an existing backup file.

Our recommended high-end hosting provider, StormOnDemand, comes with it's own, fully customizable backup solution. Here, you can have daily backups created and you can store them for up to 90 days. The service is pay-by-use and the rates are very low.

If you are using a different service or you want to extend the limited backup functionality of a shared hosting account, the SiteAutoBackup service is worth taking a look at. For any cPanel hosting account, you can create automatic, daily backups very easily and you can store them for up to 31 days. The pricing starts at $2/month, so you don't have to break your bank for this added bit of security.

With the above, we've made sure that even if you get a WordPress site compromised, you'll never be more than a few clicks away from restoring all your files and data. The next step is to do what we can to ensure that restoring a backup will never even be necessary.

Updates

Since you're familiar with the Internet, I'm sure you are aware that there are sites and forums/communities on pretty much every topic imaginable. And so there are also sites and communities that are all about documenting and discussing online security flaws and how to exploit them. Someone might read up on such an exploit and then do a quick search to find a site to try it out on. If your site meets the criteria and happens to show up in the search results, that's all it takes for it to become a victim of a hacker attack.

The most commonly exploitable issues with WordPress as well as WP plugins are usually addressed with updates and luckily, WordPress makes updating very easy, via dashboard notifications and one-click-updates.

Always update to the latest WordPress version and always keep your plugins up to date. If you're running an older version, it will still contain all the bugs that have been fixed in the newer version and some of those bugs might be potential security loopholes.

If you run many different WordPress websites, it can be difficult to manage, as you'd need to log in to each dashboard separately, to perform the updates. If you want to make this process easier, take a look at manageWP (hosted service) or WP Mass Updater (Windows desktop software).

When installing new plugins for your site, check to see when they've last been updated and whether they've had multiple versions in the past. As a general rule, a plugin that is updated regularly is less likely to be a potential security risk than one that had only one release, years ago and was never updated since.

Passwords

Any and all security measures are futile if someone can simply log in to your site as an administrator or log into your hosting account, with malicious intent. Because of this, it's very important to use real passwords for all of your accounts.

If you use passwords like 123456, password, letmein, qwerty, your birth date or anything similar, you're simply asking for trouble. You might think that that goes without saying, but I know that some people are reading this and thinking "how did he know my password?" (here's how).

I recommend using LastPass, a free and awesome password management app. Create one truly secure master password for your LastPass account and then have it auto-generate secure passwords for you, for every account you use. The downside to this is that with any password manager, you'll have a single point of failure: if someone gets access to your password manager, they have access to everything. This is still a far smaller risk than using non-secure passwords on your accounts or writing down your passwords to remember them, though.

The only alternative I'd recommend would be to use memorizable, secure passwords by stringing together random words and remembering them as visual representations. You'll still need some discipline and a good memory to do this, if you're going to use different passwords for all your critical accounts (as you should).

Bottom line: replace all your insecure passwords with secure ones, right now.

In addition, also make sure that your admin username is neither "admin" nor the same as your display name. If your username is either of those, that's one less thing a hacker needs to figure out, in order to breach your website. In the WordPress admin menu, go to "Users" -> "Your Profile". Here, you can set a nickname to anything you want and you can set the display name on your site to be your nickname:

Secure FTP

FTP clients are extremely useful for managing the files on your server, but on a standard FTP connection, all of the communication between your computer and your server is un-encrypted. This means that, among other things, your username and password is sent in plain text and could, theoretically, be intercepted.

The solution is to use an SFTP (secured file transfer protocol) connection.

The general procedure is very simple: make sure you have SSH (secure shell) access enabled on your hosting account, set your FTP client to use SFTP and use your main username and password to connect (i.e. the password you use to log in to your cPanel account - logins for individual FTP accounts don't work via SFTP). Here is the same in more detail:

SSH Access

If you are using Hostgator, log in to you client and billing dashboard and click on the "View Hosting Packages" link in the sidebar menu. Then, click on the "Enable Shell Access" link:

If you are using StormOnDemand, SSH is enabled by default. If you're using a different hosting provider and you don't know how to activate SSH access, a look at the knowledge-base or a quick support request should get you sorted.

FileZilla

Next, download and install the free FileZilla FTP client (available for Windows, Mac OS and Linux). Launch it and open the site manager (File -> Site Manager).

Use the following settings:

1. Set the host to your registered domain for the hosting account, preceeded by "ftp." or enter your server's IP address.
2. If you are using Hostgator, enter "2222" as the port. On StormOnDemand, leave this field blank.
3. Select the SFTP option for the Protocol drop-down menu.
4. Select the logon type "Normal".
5. Enter your cPanel username and password.
6. Click on connect.

That's it, you now have a secure FTP connection to your hosted files!

BulletProof Security Plugin

BulletProof Security is a comprehensive WordPress plugin that creates htaccess files to protect all of your critical files and folders. It protects from many types of code injection attacks, it hides your WordPress version number and it also makes recommendations for how to change folder permissions in your WordPress files.

Here's a quick video, demonstrating how to use the plugin:

CloudFlare

CloudFlare is a service that was already mentioned and recommended in the post about how to speed up WordPress based websites. It's primary purpose is to act as something like a content distribution network and caching tool and most of it's features are all about increasing your site's loading speeds. However, another feature of CloudFlare is that it automatically blocks requests from known malicious sources. It mostly blocks spam bots, harvesting bots and botnet zombies. Especially with the latter, CloudFlare adds a layer of security to your site.

To take advantage of this, simply sign up for CloudFlare (it's free) and install the CloudFlare plugin (also free) on your WordPress site.

Conclusion

Follow the steps above and you'll be presenting any potential hacker with a tough nut to crack, making it likely that they'll go look elsewhere, for victims. However, also keep in mind that you can never make a website 100% secure. Making attacks impossible is, unfortunately, impossible. That's why above all else, good back-up practices as described in the first section of this article, are the backbone of a secure site. With regular backups, even if things do go wrong, you never risk losing all of your valuable content and the hard work it represents.

In this review, you’ll find a comparison of six different WordPress plugins that are all designed to help you get feedback from your website visitors. The six candidates are: smartFeedback, ninety Feedback Plugin, Creative Feedback Form, Usernoise Pro, Avia Feedback Box and TotalFeedback.

Video Tour

Videos speak louder than words (that’s a saying, right?), so here’s a video tour of all six plugins:

Click to View Video in a Larger Window!

Plugin Details

Here are some details about each of the plugins:

smartFeedback

The smartFeedback plugin places a “Feedback” tab on the left side of the screen, on every page of your site.

On click, a simple feedback form opens, where users can add comments in any number of categories (e.g. bug-reports, ideas, praise) that you can freely define.

The feedback form is aesthetically pleasing, but not customizable in any way. I also missed any way for customizing the feedback tab created by the plugin. You can neither deactivate it on specific pages, nor change the color, size or position of it.

ninety Feedback Plugin

The feedback plugin created by ninety is quite similar to smartFeedback. It also creates a tab on the left side of the screen, which opens a  modal box, where visitors can leave feedback.

Instead of a selection of different categories of feedback, ninety invites your visitors to communicate their mood, via a selection of emoticons – a feature that I believe was inspired by a similar one found in GetSatisfaction.

A potential problem with this plugin is that the feedback tab is gray and not eye-catching at all. While you can customize the text, you can’t change the color. If your site has a grey or other light background, many visitors might simply not notice the feedback tab at all.

Creative Feedback Form

Like it’s competitors, Creative Feedback Form adds a feedback tab to your site, but it takes the concept one step further by adding a small community element. Whenever a user opens the feedback form and selects a category, they will see previous entries made to that category, by other users. The existing suggestions can even be voted on.

Unfortunately, it’s not possible to comment on the existing suggestions.

The feedback tab as well as the form itself is very customizable. You can choose between different color themes (none of which are particularly appealing) and you can choose the position of the tab. You can also change the wording or even entirely translate all of the text elements into a different language.

Usernoise Pro

Usernoise is a free WordPress plugin, which adds a feedback form, similar to smartFeedback, to you site. Usernoise Pro is an update, which adds a community element to this feedback form.

The community feature is better implemented in Usernoise Pro than in the Creative Feedback plugin, since it not only allows voting on topics, but also allows comments. In terms of design and usability, it’s also ahead of it’s direct competitor.

The community features are so well done that I wish there were a way to display them on a page, on your WordPress site. The fact that they are confined to the small modal window is their only drawback.

Avia Feedback Box

Avia Feedback Box is the plugin I use for the recently introduced Votebox on IM Impact.

Avia creates something like a hybrid between a feedback form and a forum. In contrast to the other plugins reviewed here, this one is placed on a specific page and it doesn’t create a feedback tab that is shown on all of your pages. The advantage of this is that it’s not constrained to a small box and thanks to it’s voting, commenting and annotation features, it encourages community interaction more effectively than the other plugins.

Avia Feedback Box comes with a light, a dark and a “blank” skin, to choose from. One issue I’ve noticed is that it seems to lose all previous entries and settings whenever it’s deactivated and then reactivated.

TotalFeedback

TotalFeedback offers a different and potentially much more focused way to get feedback from your visitors. Instead of displaying a form that users can fill out with any ideas, suggestions or complaints they may have, TotalFeedback pops up a small box with a mini-survey consisting of one question and a limited set of possible answers.

Theoretically, it’s possible to just use it as a feedback form with a question like “tell us your thoughts” and a custom text field, but used as a surveying tool, it has a lot more potential.

Using TotalFeedback, you can have different polls showing on different pages of your site and you can even have them triggered by different actions, such as a visitor scrolling down 50% of the page. Unfortunately, the visual style can not be changed, so if the form happens to be a similar color to the background on your site, you’re out of luck.

Conclusion

Most of the plugins in this roundup do their job well, but some have a better job-description than others. Simply having a feedback form on your site can be useful in many ways, but if all you do is invite open feedback, how many replies do you need before you can make a smart decision based on them?

In terms of being useful for marketing, the winners of this roundup are Avia Feedback and TotalFeedback.

Avia has a strong focus on community and instead of just gathering everyone’s random thoughts, it helps you find the most in-demand ideas, suggestions and questions, via it’s voting system. And it does so without limiting the possible range of suggestions you’ll get.

TotalFeedback is for laser-focused research. You can pinpoint users who spend a specific amount of time looking at a specific page, for example. A tool like TotalFeedback is extremely valuable on a sales-page, as it gives you an opportunity to ask your prospects about their buying decisions (or lack thereof) directly. In addition, it does great reporting on on all the feedback it collects.

If, for some reason, you want something closer to a “normal” feedback form, my recommendation goes to Usernoise Pro.

Read on to learn about how these two products are different and see which one comes out on top.

Overview

What the two products have in common (apart from the fact that all the developers involved are British) is that they let you create an aesthetically pleasing opt-in form that “pops up” in one way or another, when someone visits your site.

Let’s take a step back and look at what is necessary, in principle, to get someone to sign up to your mailing list. There are two main factors that come into play:

1. An Enticing Offer
   It goes without saying that if you don’t have an enticing offer, a good reason for people to sign up, then your list-building efforts are almost certainly doomed to fail. That’s not to say that a “sign up to my newsletter” message never works, it’s just that a “sign up to get X” usually works far, far better.
2. An Effective Presentation
   The second factor is how this offer is presented and that’s where these two plugins come in. And it’s also where the two plugins are most different.

Video Comparison

Instead of trying to express what these two programs do in writing, it’s a lot more effective to just show you what they do, on video:

And here's a recap and overview of the two products:

PopUp Domination 2.0

PopUp Domination is all about delivering an enticing and attractive presentation. It creates lightboxes which are large, eye-grabbing and beautifully designed. You can use images and bullet points to create very professional looking opt-in forms, without needing any design-skills yourself.

There are seven different lightbox-designs to choose from and for each one, you can select a theme color and a button color. All of the text in the lightboxes (headlines, bullet-points, button-text) are customizable, but there are hard limits to the text. For example, if you choose a lightbox that supports a one-line headline and three bullent-points, then that's exactly what you get. There's no way to add a fourth bullet point. This is not a huge drawback, but it is something you should be aware of.

Here are just a few examples of what the PopUp Domination 2.0 lightboxes can look like (click to expand):

Digi List Builder

Digi List Builder has less emphasis on making the opt-in form look good (although they still are well designed) - you can upload a custom image (like an ecover image or a visual call-to-action), upload a custom button and input some text.

The focus with this plugin lies on how and where you can present your form to the site visitors and Digi List Builder offers four options:

• a lightbox that appears every X number of pageloads (you can set the number of pageloads)
• an opt-in box that appears at the end of each blog post, before the comments section
• a footer opt-in area that scrolls with the page (i.e. it's always visible)
• an option that allows you subscribe people who comment on your blog to your list (can be unticked by visitor)

See the four variations below (click to expand):

Two more things are worth emphasizing about Digi List Builder: First of all, you can use any combination of these opt-in forms. Potentially, you can have all of them running at the same time, hammering your visitors with opt-in forms relentlessly (not recommended, but possible). Secondly, and this one is brilliant, anyone who subscribes to your list through Digi List Builder will henceforth no longer see the forms when they visit your site. This is extremely cool, as it allows you to crank up the "annoying" factor somewhat, without it turning off your subscribers.

Note that if you implement Digi List Builder on your site and you already have subscribers on your mailing list, they will still see the forms. The forms only vanish for those who opt in through Digi List Builder.

Conclusion

So, which one is better? Both of these products are very good in their own way, so I can't make a recommendation for one over the other. The way I see it, which of these plugins is better suited for you depends on how you want to utilize them.

If you have a site that is purely built as a traffic-magnet, to get people on your list, then Digi List Builder is the better choice. On a site like this, you don't have to worry about annoying people with the lightbox or footer opt-in, as you really want visitors to either sign up or leave, anyway.

If you have a blog where you are doing personal branding, then PopUp Domination might be the better choice, as it is easier to adapt to your site's overall visual style and has more of a "wow-factor". More advantages are that you can use PopUp Domination 2.0 on non-WordPress sites, you can specify specific pages and categories, if you don't want the lighbox to appear everywhere on your blog and you can use it as an exit-popup.

Read on to find out.

Overview

The first thing you need to know about this plugin is that it integrates with Google Website Optimizer and that’s a good thing. Like Analytics, Website Optimizer is a very powerful tool that you get to use for free, courtesy of Google (and their hunger for data). The thing is, GWO doesn’t usually play nice with WordPress and while there are integration options and even free plugins to help integrate the two, most of them still have some severe limitations.

So, let’s see if WP Split Test Optimizer can justify the asking price, compared to what free Optimizer plugins offer.

WP Split Test Optimizer Video

Here’s a video detailing what this plugin does and how it compares to the free ones that are available.

To recap, the WordPress Split Test Optimizer plugin has two advantages over free plugins:

1. It’s slightly easier to set up and manage. This isn’t a huge advantage, but it’s nice to have.
2. It allows you to very easily track clicks on particular links as conversions. This makes the plugin very useful for affiliate marketers. Unless you’re a coding Ninja, Website Optimizer is otherwise almost useless for affiliate marketing.

Conclusion

This plugin is being sold for $47 and while it definitely works as advertised and is a good product, I guess the main question would be: is it worth the price, compared to the free plugins available?

I’d say that depends mainly on how good you are at coding and how valuable your time is. To me, spending 50 bucks on a plugin like this is a much cheaper solution than spending hours fiddling with code (trying to get click-tracking to work, for example).

In general, if you want to start split-testing and you like to use WordPress, then this is a good solution. If you want to do more advanced, multivariate split testing and don’t mind spending more money on it, then my first recommendation is Visual Website Optimizer. For more “causal” use, WP Split Test Optimizer is the better choice, simply because it’s a solid solution and comes with a one-time price.

Click Here to Get Your Copy

I don’t really want to go in-depth on this, so let me just say: if you use or want to use any kind of tables on a WordPress site, do yourself a favour and get the plugin.

As you may already know, I personally like to use WordPress for building all kinds of marketing sites. From blog-style sites to squeeze-pages or sales-pages, with the right themes and plugins, WP can be the ideal platform for any kind of website.

In today’s review, I take a look at a new plugin called WP Split Test and as the name implies, this tool helps you set up and track split tests on your WordPress websites.

Overview

WP Split Test is a WordPress plugin which lets easily set up split-tests for posts and pages on a WordPress site. For more information on the point of all this, please check out my Split Testing Basics post.

Installation and Setup

WP Split Test installs like any other WordPress Plugin and I had no difficulties activating it. Once the plugin is activated, you’ll find a new options tab in your WordPress admin panel, from where you can set up your A/B-tests.

You can set up as many different campaigns as you like and for each campaign, you can create up to four different pages. The pages are created in a simple editor, just like the one used for creating normal WP post. If you prefer, you can compose your pages in an HTML editor and copy-paste them into the WP Split Test editor.

In other words, you have complete freedom in creating your pages. There are absolutely no restrictions imposed by the plugin. Whether you want to test small changes like different titles or different order-button colours or make completely different pages (video sales page vs. text sales page, for example), you can do it using WP Split Test.

Once you’ve created your pages, you simply grab a small code snippet and insert that into a new WordPress post. You don’t need to add anything else but that code snippet to the post. Once it’s published, the plugin will rotate the different pages for each visit to the post.

Tracking

Of course, just rotating page variations is only part of the equation for effective split-testing. You also need to be able to track conversion-rates so that you can determine which version of a page is the most profitable one. WP Split Test does click-tracking for your campaigns and interestingly, it tracks clicks within your page contents and also (separately) tracks clicks to your sidebar, navbar and footer contents. For your main page content, you can determine conversion rates simply by checking out the clicks you get to your affiliate link, order button or sign-up button.

Changes can be made on the fly, so if you see that one of your pages is a clear winner, you can give it more weight, deactivate all the other pages or make another minor change within seconds, from the plugin’s admin panel.

Overall Rating

WP Split Test is a very solid plugin. It couldn’t be easier to install and set up, it rotates pages very cleanly (I like the fact that the URL doesn’t change) and it has no negative impact on page loading times, as far as I can tell.

In my previous post about split-testing, I’ve already expressed how important testing and tracking is for any kind of online money-making venture. You absolutely must do split-testing if you are serious about your online business and if WordPress happens to be your preferred CMS, then WP Split Test is the ideal solution for you.

This is for you, if:

• You like to use WordPress for your sales-pages/squeeze-pages/landing-pages
• You have monetized WordPress blogs or blog-style landing pages
• You are looking for a simple, easy-to-use split-testing solution

This is not for you, if:

• You already have a split-testing solution in place that you are satisfied with

Click the banner below to grab your copy of WP Split Test right now!

Here’s another video I made after a reader made a suggestion to me. Someone recommended the SEO Quake Firefox plugin and asked me if I could make a video about it. I took some time to play around with the tool and liked it quite a bit. Here’s the video I ended up making:

The plugin is mainly a website analysis tool, although it comes with a few features that go beyond that. While I always try to show both sides of a story, I can’t really find anything to complain about with SEO Quake. It’s fast and functional, you can easily deactivate it an re-activate it (so it’s data and toolbar doesn’t annoy you during regular surfing) and it’s completely free.

If you don’t have a program for analyzing websites yet, I recommend you hop over to the SEO Quake homepage and give this one a try.

Cheers,